AWS opensearch-service documentation change
Summary
Restructured documentation for OpenSearch UI applications, including updated terminology, simplified navigation, and expanded security configuration details for IAM Identity Center integration.
Security assessment
Added detailed instructions for configuring IAM Identity Center authentication, including required IAM role permissions and trust policies. However, there's no evidence this addresses a specific security vulnerability rather than general security feature documentation.
Diff
diff --git a/opensearch-service/latest/developerguide/application.md b/opensearch-service/latest/developerguide/application.md index c26b8fb84..6288bd2a2 100644 --- a/opensearch-service/latest/developerguide/application.md +++ b/opensearch-service/latest/developerguide/application.md @@ -5 +5 @@ -Creating an OpenSearch applicationControlling access to an OpenSearch Application Define OpenSearch Application adminAssociate data sources with an OpenSearch applicationAssociate with OpenSearch domains in VPCAssociate with OpenSearch Serverless collections in VPCCreating workspaces in an OpenSearch application +Creating an applicationConfiguring single sign-onAssociating data sourcesIntegrating with VPC domainsIntegrating with VPC collectionsSetting up workspaces @@ -7 +7 @@ Creating an OpenSearch applicationControlling access to an OpenSearch Applicatio -# Centralized OpenSearch user interface (Dashboards) with Amazon OpenSearch Service +# Using the OpenSearch user interface in Amazon OpenSearch Service @@ -9 +9 @@ Creating an OpenSearch applicationControlling access to an OpenSearch Applicatio -OpenSearch user interface is the modernized operational analytics experience for Amazon OpenSearch Service. In comparison to the existing OpenSearch Dashboards that is hosted in individual domains or collections and supports only one data source, OpenSearch user interface is created as a web-based application and runs in the AWS cloud, so that it can be associated with data sources across multiple managed clusters, serverless collections, and connected AWS data sources such as Amazon S3. With OpenSearch user interface, you can gain a comprehensive insights across your data in a unified interface. If you are looking for documentation on OpenSearch Dashboards which are co-located with each managed cluster or collection, see [Dashboards (co-located with cluster)](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/dashboards.html). +The OpenSearch user interface (UI) is a web-based application for Amazon OpenSearch Service that lets you visualize and interact with data stored in more than one OpenSearch resources. It contains customizable dashboards, advanced data exploration, and support for multiple query languages. You can use the OpenSearch UI to manage multiple OpenSearch clusters, OpenSearch Serverless collections, and other integrated data sources from a unified interface. @@ -11 +11 @@ OpenSearch user interface is the modernized operational analytics experience for -OpenSearch user interface introduces the concept of workspaces. A workspace is a tailored experience for common use cases such as observability and security analytics. You can create one workspace for each of your use cases or teams, and manage collaborators and data sources associated with each workspace, so that you can easily manage the access control and collaboration across your teams. In OpenSearch user interface, Discover provides a unified log exploration experience supporting popular languages like SQL and Piped-Processing-Language (PPL), in addition to offering existing support for DQL and Lucene. +Unlike _OpenSearch Dashboards_ , which runs within individual domains or collections and supports only one data source, the OpenSearch UI runs in the AWS Cloud. It connects to multiple data sources to provide a unified view of your data. For information about OpenSearch Dashboards, see [Using OpenSearch Dashboards with Amazon OpenSearch Service](./dashboards.html). @@ -13 +13 @@ OpenSearch user interface introduces the concept of workspaces. A workspace is a -To use OpenSearch user interface, you can create an OpenSearch UI application from the AWS Management Console or via the AWS Command Line Interface (CLI). You can find the list of your created OpenSearch applications under your Amazon OpenSearch Service console, Central Management section. Each OpenSearch application has its own endpoint URL and Amazon Resource Name (ARN). You can use the endpoint URL to open the OpenSearch application, and easily share it to your colleagues for collaboration. You can configure each OpenSearch application to support login with AWS Identity and Access Management Identity and Access Management (IAM) credentials and/or IAM Identity Center, and manage the user and group permissions to the application. +The OpenSearch UI has the following features: @@ -15 +15 @@ To use OpenSearch user interface, you can create an OpenSearch UI application fr -###### Note + * **Discover** – Unified log exploration with support for SQL, PPL, DQL, and Lucene. @@ -17 +17 @@ To use OpenSearch user interface, you can create an OpenSearch UI application fr -OpenSearch user interface (Dashboards) application does not support use of IAM Identity Center applications created in a different region. To use IAM Identity Center, create OpenSearch application in the same region as your IAM Identity Center application instance. + * **Centralized management** – View all OpenSearch applications in the AWS console. @@ -19 +19 @@ OpenSearch user interface (Dashboards) application does not support use of IAM I -## Creating an OpenSearch application + * **Collaboration** – Each application has a unique endpoint URL for easy sharing. @@ -21 +21 @@ OpenSearch user interface (Dashboards) application does not support use of IAM I -To create an OpenSearch Application in the console, do the following: + * **Access control** – Supports authentication through IAM credentials or IAM Identity Center. @@ -23 +22,0 @@ To create an OpenSearch Application in the console, do the following: - 1. Open the AWS Management Console and go to the Amazon OpenSearch Service homepage. @@ -25 +23,0 @@ To create an OpenSearch Application in the console, do the following: - 2. In the left navigation window, find the OpenSearch user interface (Dashboards) tab @@ -27 +24,0 @@ To create an OpenSearch Application in the console, do the following: - 3. Select `Create Application` @@ -28,0 +26 @@ To create an OpenSearch Application in the console, do the following: +After you create an OpenSearch UI application, associate it with data sources to analyze, query, and visualize data across your infrastructure. Then, configure _workspaces_ within the application, which provide tailored experiences for observability, security analytics, and team collaboration. Each workspace has its own data sources, collaborators, and access controls, which makes it easy to manage permissions. @@ -29,0 +28 @@ To create an OpenSearch Application in the console, do the following: + @@ -30,0 +30 @@ To create an OpenSearch Application in the console, do the following: +###### Topics @@ -32 +32 @@ To create an OpenSearch Application in the console, do the following: -To create an OpenSearch Application in the AWS Command Line Interface do the following: + * Creating an OpenSearch UI application @@ -33,0 +34 @@ To create an OpenSearch Application in the AWS Command Line Interface do the fol + * Configuring single sign-on authentication @@ -35,2 +36 @@ To create an OpenSearch Application in the AWS Command Line Interface do the fol - aws opensearch create-application \ - --name myapplication + * Associating data sources with your application @@ -38,9 +38,20 @@ To create an OpenSearch Application in the AWS Command Line Interface do the fol - aws opensearch create-application \ - --name myapplication \ - --iam-identity-center-options " - { - \"enabled\":true, - \"iamIdentityCenterInstanceArn\":\"arn:aws:sso:::instance/ssoins-xxxxxxxxx\", - \"iamRoleForIdentityCenterApplicationArn\":\"arn:aws:iam::555555555555:role/xxxxxxxx\" - } - " + * Integrating applications with OpenSearch domains in a VPC + + * Integrating applications with OpenSearch Serverless collections in a VPC + + * Setting up workspaces + + + + +## Creating an OpenSearch UI application + +Create an application by providing a name, authentication method, and administrators. + +###### To create a UI application in the console + + 1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). + + 2. In the left navigation pane, choose **OpenSearch UI (Dashboards)**. + + 3. Choose **Create application**. @@ -48 +59 @@ To create an OpenSearch Application in the AWS Command Line Interface do the fol -## Controlling access to an OpenSearch Application + 4. For **Application name** , enter a name for the application. @@ -50 +61 @@ To create an OpenSearch Application in the AWS Command Line Interface do the fol -OpenSearch user interface supports both AWS Identity and Access Management (IAM) and IAM Identity Center for login. When creating an OpenSearch application, the default options is to use IAM and you can manage permissions to the OpenSearch application by IAM users. Optionally, you can opt to use IAM Identity Center that links to your existing identity providers, for user login to the OpenSearch application. To enable IAM Identity Center, click on the checkbox for “Authenticate with IAM Identity Center" in the OpenSearch application creation workflow, and then grant IAM Identity Center users the permission to access the OpenSearch application. + 5. (Optional) Configure single sign-on by enabling **Authentication with IAM Identity Center**. For more information, see Configuring single sign-on authentication. @@ -52 +63 @@ OpenSearch user interface supports both AWS Identity and Access Management (IAM) -You can also configure IAM and IAM Identity Center configurations through the AWS Command Line Interface. See the following example: + 6. If needed, add additional application administrators. The OpenSearch application administrator role grants permissions to edit and delete an OpenSearch application. By default, the creator of an OpenSearch application becomes the first administrator. You can add additional administrators, or grant administrator permission to all users. @@ -53,0 +65 @@ You can also configure IAM and IAM Identity Center configurations through the AW +You can remove extra administrators, but at least one must remain for each application. @@ -55,2 +67 @@ You can also configure IAM and IAM Identity Center configurations through the AW - aws opensearch create-application \ - --name myapplication + 7. (Optional) Add tags to describe the application. @@ -58 +69,16 @@ You can also configure IAM and IAM Identity Center configurations through the AW - aws opensearch create-application \ + 8. Choose **Create**. + + + + +To create an application using the AWS CLI, use the [create-application](https://docs.aws.amazon.com/cli/latest/reference/opensearch/create-application.html) command with the following options: + + * `--name` – The name of the application. + + * `--iam-identity-center-options` – (Optional) The IAM Identity Center instance and the IAM role that OpenSearch will use for authentication and access control. + + + + + + aws opensearchservice create-application \ @@ -60,7 +86,5 @@ You can also configure IAM and IAM Identity Center configurations through the AW - --iam-identity-center-options " - { - \"enabled\":true, - \"iamIdentityCenterInstanceArn\":\"arn:aws:sso:::instance/ssoins-xxxxxxxxx\", - \"iamRoleForIdentityCenterApplicationArn\":\"arn:aws:iam::555555555555:role/xxxxxxxx\" - } - " + --iam-identity-center-options '{ + "enabled": true, + "iamIdentityCenterInstanceArn": "arn:aws:sso:::instance/ssoins-xxxxxxxxx", + "iamRoleForIdentityCenterApplicationArn": "arn:aws:iam::123456789012:role/xxxxxxxx" + }' @@ -68 +92 @@ You can also configure IAM and IAM Identity Center configurations through the AW -You will also need to specify the following trust policy for their IAM role using `iamRoleForIdentityCenterApplication`: +## Configuring single sign-on authentication @@ -69,0 +94,5 @@ You will also need to specify the following trust policy for their IAM role usin +You can control access to an OpenSearch application using AWS Identity and Access Management (IAM) or IAM Identity Center. + + * **IAM (Default)** – Manage access by assigning IAM roles or users. + + * **IAM Identity Center (Optional)** – Allows users to log in using existing identity providers. @@ -71,20 +99,0 @@ You will also need to specify the following trust policy for their IAM role usin - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "application.opensearchservice.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetContext" - ], - "Condition": { - "ForAllValues:ArnEquals": { - "sts:RequestContextProviders": "arn:aws:iam::aws:contextProvider/IdentityCenter" - } - } - } - ] - } @@ -92 +101,9 @@ You will also need to specify the following trust policy for their IAM role usin -You will need to define the following permissions policies for the role as well: + + +###### Note + +OpenSearch UI doesn't support IAM Identity Center instances in a different AWS Region. To use IAM Identity Center, create the application in the same Region. + +To enable IAM Identity Center, select **Authenticate with IAM Identity Center** when you create an application, and choose an IAM role. + +The role must have the following permissions: @@ -122 +139 @@ You will need to define the following permissions policies for the role as well: - "Sid": "OpenSearchServerless", // if need to access OpenSearch serverless collections + "Sid": "OpenSearchServerless", // If users need to access OpenSearch Serverless collections @@ -132 +149 @@ You will need to define the following permissions policies for the role as well: -In addition to enabling IAM Identity Center in OpenSearch, you'll need to specify the following Trust policy for your IAM role using the `iamRoleForIdentityCenterApplication` parameter: +The role must have the following trust policy: @@ -156 +173 @@ In addition to enabling IAM Identity Center in OpenSearch, you'll need to specif -## Define OpenSearch Application admin +## Associating data sources with your application @@ -158 +175 @@ In addition to enabling IAM Identity Center in OpenSearch, you'll need to specif -OpenSearch application admin is the defined role with permission to edit and delete an OpenSearch application. As the creator of an OpenSearch, you will by default become the first admin of the OpenSearch application. Additional admins can be added to the OpenSearch application in the AWS Management Console, either during the application creation workflow or in the “**edit application** ” page, by searching for the ARN of IAM principals or the name of IAM Identity Center users in the OpenSearch application admins management search bar. Extra admins can be removed but there must be at least one admin for an OpenSearch application. +After you create an OpenSearch application, associate it with one or more data sources to analyze, query and visualize data across your infrastructure. An application can connect to multiple data sources, including OpenSearch Service domains and OpenSearch Serverless collections. It also supports external sources like Amazon Security Lake and Amazon CloudWatch Logs. @@ -160 +177 @@ OpenSearch application admin is the defined role with permission to edit and del -OpenSearch application admin management can also be done through the AWS Command Line Interface. Here are the examples of how to add IAM principals and IAM Identity Center users as admin while creating an OpenSearch application. +###### To connect a data source in the console @@ -161,0 +179 @@ OpenSearch application admin management can also be done through the AWS Command + 1. Select an application to open its details. @@ -163,8 +181 @@ OpenSearch application admin management can also be done through the AWS Command - aws opensearch create-application \ - --name myapplication \ - --app-configs " - { - \"key\":\"opensearchDashboards.dashboardAdmin.users\", - \"value\":\"arn:aws:iam::555555555555:user/xxxxxxxx\" - } - " + 2. Under **Associated data sources** , choose **Manage data sources**. @@ -172,15 +183 @@ OpenSearch application admin management can also be done through the AWS Command - aws opensearch create-application \ - --name myapplication \ - --iam-identity-center-options "