AWS opensearch-service documentation change
Summary
Added detailed configuration steps for Amazon Q alert insights including IAM role setup, role mapping, and knowledge base configuration via CloudFormation. Updated alert viewing procedure steps.
Security assessment
The changes focus on operational setup procedures (IAM role creation/mapping and knowledge base configuration) rather than addressing vulnerabilities. While IAM configuration relates to security practices, there's no evidence this addresses a specific security incident.
Diff
diff --git a/opensearch-service/latest/developerguide/Amazon-Q-developer-support-alert-summary.md b/opensearch-service/latest/developerguide/Amazon-Q-developer-support-alert-summary.md index dc1166a94..2c205953b 100644 --- a//opensearch-service/latest/developerguide/Amazon-Q-developer-support-alert-summary.md +++ b//opensearch-service/latest/developerguide/Amazon-Q-developer-support-alert-summary.md @@ -4,0 +5,2 @@ +Before you beginViewing alert summaries and insights + @@ -11 +13 @@ You can configure OpenSearch Service to create an alert monitor when data from o -If you connected a knowledge base to provide additional context about your environment, Amazon Q creates insights about an alert. Insights provide details and troubleshooting options to help you remedy the root cause of an alert. For the previously shown alert, Amazon Q also produced the following insights. +If you connect a knowledge base to provide additional context about your environment, as described later in this topic, Amazon Q creates insights about an alert. Insights provide details and troubleshooting options to help you remedy the root cause of an alert. For the previously shown alert, Amazon Q also produced the following insights. @@ -18,0 +21,65 @@ Depending on the nature of the alert and the information available, Amazon Q can +###### Topics + + * Before you begin + + * Viewing alert summaries and insights + + + + +## Before you begin + +Complete the following steps to configure an Amazon Bedrock knowledge base so that Amazon Q can create insights for OpenSearch Service alerts. + +### Step 1: Create the LambdaInvokeOpenSearchMLCommonsRole IAM role + +Create a new role named `LambdaInvokeOpenSearchMLCommonsRole` in AWS Identity and Access Management (IAM). OpenSearch Service uses this role to create an AI connector in OpenSearch that helps produce insights based on configured knowledge base articles. You must map this role to the OpenSearch Service `ml_full_access` role, as described in step 2. + +When you create the new role, for **Trusted entity type** , choose **AWS account**. You don't need to specify a permission policy. On the **Add permissions** page, choose **Next**. For more information about creating a new role, see [Creating a role for an AWS service (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html#roles-creatingrole-service-console). + +### Step 2: Map the LambdaInvokeOpenSearchMLCommonsRole role to the OpenSearch Service ml_full_access role + +Use the following procedure to map the `LambdaInvokeOpenSearchMLCommonsRole` role to the OpenSearch Service `ml_full_access` role. This mapping also helps OpenSearch Service create the AI connector. + +###### To map the required IAM role to the OpenSearch Service ml_full_access role + + 1. Open the OpenSearch Service Dashboard **Data administration** page. + + 2. Under **Data access and user** , choose **Roles**. + + 3. Use the search box to locate the `ml_full_access` role. + + 4. On the **ml_full_access** page, choose the **Mapped users** tab. + + 5. Choose **Map users**. + + 6. In the **Backend roles** field, paste the Amazon Resource Name (ARN) of the `LambdaInvokeOpenSearchMLCommonsRole` role, and then choose **Map**. + + + + +### Step 3: Configure an OpenSearch Service knowledge base using AWS CloudFormation + +Use the following procedure to configure an OpenSearch Service knowledge base using AWS CloudFormation so that Amazon Q can generate insights. + +###### To configure a knowledge base for insights + + 1. Sign in to the Amazon OpenSearch Service console [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home) in a supported AWS Region. For more information, see [Supported AWS Regions](./Amazon-Q-developer-support.html#Amazon-Q-developer-supported-regions). + + 2. In the navigation pane, choose **Integrations**. + + 3. In the **Integration templates** section, choose the **Integrate with knowledge base through Amazon Bedrock** template. If you don't see this template, verify you're in a supported Region. + + 4. In the **Integrate with knowledge base through Amazon Bedrock** tile, choose **Configure domain** , and then choose one of the available options. OpenSearch Service opens the AWS CloudFormation stack template with the required fields pre-populated. The AWS CloudFormation stack supports integration for public and VPC domains. + + 5. Choose **Create stack**. After AWS CloudFormation creates the resources, the service displays the Amazon Bedrock agent **AgentId** , **ConnectorId** , and **ModelId**. + + + + +When applicable, Amazon Q now creates insights for OpenSearch Service alerts. + +## Viewing alert summaries and insights + +Use the following procedure to view alert summaries and insights in OpenSearch Service. + @@ -25,3 +92 @@ Depending on the nature of the alert and the information available, Amazon Q can - 3. For insights, verify that you've [created one or more knowledge bases in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html) so that Amazon Q can generate alert insights. You can provision knowledge bases using the [AWS::Bedrock::KnowledgeBase](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrock-knowledgebase.html) AWS CloudFormation resource. - - 4. In the OpenSearch Dashboards main menu, choose **Alerting** , and then choose **Alerts**. + 3. In the OpenSearch Dashboards main menu, choose **Alerting** , and then choose **Alerts**. @@ -29 +94 @@ Depending on the nature of the alert and the information available, Amazon Q can - 5. Choose the Amazon Q icon beside an alert. Amazon Q can take up to 10 seconds to generate the summary. + 4. Choose the Amazon Q icon beside an alert. Amazon Q can take up to 10 seconds to generate the summary. @@ -31 +96 @@ Depending on the nature of the alert and the information available, Amazon Q can - 6. If present in the alert summary, choose **View insights** to view more details about the alert based on your configured knowledge base. + 5. If present in the alert summary, choose **View insights** to view more details about the alert based on your configured knowledge base. @@ -33 +98 @@ Depending on the nature of the alert and the information available, Amazon Q can - 7. If present in the alert summary, choose **View in Discover** to view the alert data on the **Discover** page in the OpenSearch Dashboards. + 6. If present in the alert summary, choose **View in Discover** to view the alert data on the **Discover** page in the OpenSearch Dashboards.