AWS opensearch-service documentation change
Summary
Reorganized steps in collection creation workflow, including moving encryption configuration to a later step, adding explicit 'Security' step, expanding network access control details, and clarifying data access policy management.
Security assessment
Changes include expanded documentation about encryption (AWS KMS), network access controls (VPC endpoints), and data access policies. These are security features but there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-manage.md b/opensearch-service/latest/developerguide/serverless-manage.md index 9db3bd0c5..f12518efc 100644 --- a/opensearch-service/latest/developerguide/serverless-manage.md +++ b/opensearch-service/latest/developerguide/serverless-manage.md @@ -100,2 +99,0 @@ You can use the console or the AWS CLI to create a serverless collection. These - * **Search** – Full-text search that powers applications in your internal networks and internet-facing applications. All search data is stored in hot storage to ensure fast query response times. - @@ -103,0 +102,2 @@ You can use the console or the AWS CLI to create a serverless collection. These + * **Search** – Full-text search that powers applications in your internal networks and internet-facing applications. All search data is stored in hot storage to ensure fast query response times. + @@ -108 +108 @@ For more information, see [Choosing a collection type](./serverless-overview.htm - 6. Under **Deployment type** , choose the redundancy setting for your collection. By default, each collection is created with redundancy, meaning that the indexing and search OpenSearch Compute Units (OCUs) each have their own standby replicas in a different Availability Zone. For development and testing purposes, you can choose to disable redundancy, which reduces the number of OCUs in your collection to two. For more information, see [How it works](./serverless-overview.html#serverless-process). + 6. For **Deployment type** , choose the redundancy setting for your collection. By default, each collection has redundancy, which means that the indexing and search OpenSearch Compute Units (OCUs) each have their own standby replicas in a different Availability Zone. For development and testing purposes, you can choose to disable redundancy, which reduces the number of OCUs in your collection to two. For more information, see [How it works](./serverless-overview.html#serverless-process). @@ -110 +110 @@ For more information, see [Choosing a collection type](./serverless-overview.htm - 7. Under **Encryption** , choose an AWS KMS key to encrypt your data with. OpenSearch Serverless notifies you if the collection name that you entered matches a pattern defined in an encryption policy. You can choose to keep this match or override it with unique encryption settings. For more information, see [Encryption in Amazon OpenSearch Serverless](./serverless-encryption.html). + 7. For **Security** , choose **Standard create**. @@ -112 +112 @@ For more information, see [Choosing a collection type](./serverless-overview.htm - 8. Under **Network access settings** , configure network access for the collection. + 8. For **Encryption** , choose an AWS KMS key to encrypt your data with. OpenSearch Serverless notifies you if the collection name that you entered matches a pattern defined in an encryption policy. You can choose to keep this match or override it with unique encryption settings. For more information, see [Encryption in Amazon OpenSearch Serverless](./serverless-encryption.html). @@ -114 +114,5 @@ For more information, see [Choosing a collection type](./serverless-overview.htm - * For **Access type** , select public or private. Then, specify which VPC endpoints and AWS services can access the collection. + 9. For **Network access settings** , configure network access for the collection. + + * For **Access type** , select public or private. + +If you choose private, specify which VPC endpoints and AWS services can access the collection. @@ -120 +124 @@ For more information, see [Choosing a collection type](./serverless-overview.htm - * For **Resource type** , select whether the collection will be accessible through its _OpenSearch_ endpoint (to make API calls through curl, Postman, and so on), through the _OpenSearch Dashboards_ endpoint (to work with visualizations and make API calls through the console), or through both. + * For **Resource type** , select whether users can access the collection through its _OpenSearch_ endpoint (to make API calls through cURL, Postman, and so on), through the _OpenSearch Dashboards_ endpoint (to work with visualizations and make API calls through the console), or both. @@ -128 +132 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 9. (Optional) Add one or more tags to the collection. For more information, see [Tagging Amazon OpenSearch Serverless collections](./tag-collection.html). + 10. (Optional) Add one or more tags to the collection. For more information, see [Tagging Amazon OpenSearch Serverless collections](./tag-collection.html). @@ -130 +134 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 10. Choose **Next**. + 11. Choose **Next**. @@ -132 +136 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 11. Configure data access rules for the collection, which define who can access the data within the collection. For each rule that you create, perform the following steps: + 12. Configure data access rules for the collection, which define who can access the data within the collection. For each rule that you create, perform the following steps: @@ -140 +144,3 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 12. Choose **Next**. + 13. Choose **Next**. + + 14. For **Data access policy settings** , choose what to do with the rules you just created. You can either use them to create a new data access policy, or add them to an existing policy. @@ -142 +148 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 13. Under **Data access policy settings** , choose what to do with the rules you just created. You can either use them to create a new data access policy, or add them to an existing policy. + 15. Choose **Next**. @@ -144 +150 @@ OpenSearch Serverless notifies you if the collection name that you entered match - 14. Review your collection configuration and choose **Submit**. + 16. Review your collection configuration and choose **Submit**.