AWS opensearch-service low security documentation change
Summary
Updated documentation to clarify package management processes, added details about custom/third-party plugins, introduced plugin limits, and revised permissions/encryption guidance.
Security assessment
Added explicit guidance about using S3-managed keys instead of KMS for encrypted dictionary files containing sensitive information. This addresses secure handling of sensitive data but does not indicate a specific vulnerability being patched.
Diff
diff --git a/opensearch-service/latest/developerguide/custom-packages.md b/opensearch-service/latest/developerguide/custom-packages.md index b1d138a27..cc624e4ca 100644 --- a//opensearch-service/latest/developerguide/custom-packages.md +++ b//opensearch-service/latest/developerguide/custom-packages.md @@ -5 +5 @@ -Package permissions requirementsUploading packages to Amazon S3Importing and associating packagesUsing packages with OpenSearchUpdating packagesManual index updates for dictionariesDissociating and removing packages +Required permissionsUploading packages to Amazon S3Importing and associating packagesUsing packages with OpenSearchUpdating packagesManually updating indexes with a new dictionaryDissociating and removing packages @@ -7 +7 @@ Package permissions requirementsUploading packages to Amazon S3Importing and ass -# Custom packages for Amazon OpenSearch Service +# Importing and managing packages in Amazon OpenSearch Service @@ -9 +9 @@ Package permissions requirementsUploading packages to Amazon S3Importing and ass -Amazon OpenSearch Service lets you upload custom dictionary files, such as stop words and synonyms, and also provides several pre-packaged, optional plugins that you can associate with your domain. The generic term for both these types of files is _packages_. +Amazon OpenSearch Service lets you upload custom dictionary files, such as stop words and synonyms, and associate plugins with your domain. These plugins can be pre-packaged, custom, or third-party, which gives you flexibility to extend your domain’s functionality. The generic term for all these types of files is _packages_. @@ -11 +11 @@ Amazon OpenSearch Service lets you upload custom dictionary files, such as stop -Dictionary files improve your search results by telling OpenSearch to ignore certain high-frequency words or to treat terms like "frozen custard," "gelato," and "ice cream" as equivalent. They can also improve [stemming](https://en.wikipedia.org/wiki/Stemming), such as in the Japanese (kuromoji) Analysis plugin. + * **Dictionary files** help refine search results by instructing OpenSearch to ignore common high-frequency words or to treat similar terms, like "frozen custard," "gelato," and "ice cream," as equivalent. They can also improve [stemming](https://en.wikipedia.org/wiki/Stemming), as seen with the Japanese (kuromoji) analysis plugin. @@ -13 +13,16 @@ Dictionary files improve your search results by telling OpenSearch to ignore cer -Optional plugins can provide added functionality to your domain. For example, you can use the Amazon Personalize plugin to give you personalized search results. Optional plugins use the `ZIP-PLUGIN` package type. For more information about optional plugins, see [Plugins by engine version in Amazon OpenSearch Service](./supported-plugins.html). + * **Pre-packaged plugins** provide built-in functionality, such as the Amazon Personalize plugin for personalized search results. These plugins use the `ZIP-PLUGIN` package type. For more information, see [Plugins by engine version in Amazon OpenSearch Service](./supported-plugins.html). + + * **Custom and third-party plugins** allow you to add tailored features or integrate with external systems, which offers even more flexibility for your domain. Like pre-packaged plugins, you upload custom plugins as `ZIP-PLUGIN` packages. For third-party plugins, you must also import the plugin license and configuration files as separate packages, then associate them all with the domain. + +For more information, see the following topics: + + * [Installing custom plugins in Amazon OpenSearch Service](./custom-plugins.html) + + * [Installing third-party plugins in Amazon OpenSearch Service](./plugins-third-party.html) + + + + +###### Note + +You can associate a maximum of 20 plugins with a single domain. This limit includes all plugin types—optional, third-party, and custom plugins. @@ -17 +32 @@ Optional plugins can provide added functionality to your domain. For example, yo - * Package permissions requirements + * Required permissions @@ -27 +42 @@ Optional plugins can provide added functionality to your domain. For example, yo - * Manual index updates for dictionaries + * Manually updating indexes with a new dictionary @@ -30,0 +46 @@ Optional plugins can provide added functionality to your domain. For example, yo + * [Installing custom plugins in Amazon OpenSearch Service](./custom-plugins.html) @@ -31,0 +48 @@ Optional plugins can provide added functionality to your domain. For example, yo + * [Installing third-party plugins in Amazon OpenSearch Service](./plugins-third-party.html) @@ -34 +51,3 @@ Optional plugins can provide added functionality to your domain. For example, yo -## Package permissions requirements + + +## Required permissions @@ -38 +57 @@ Users without administrator access require certain AWS Identity and Access Manag - * `es:CreatePackage` \- create a package in an OpenSearch Service Region + * `es:CreatePackage` – Create a package @@ -40 +59 @@ Users without administrator access require certain AWS Identity and Access Manag - * `es:DeletePackage` \- delete a package from an OpenSearch Service Region + * `es:DeletePackage` – Delete a package @@ -42 +61 @@ Users without administrator access require certain AWS Identity and Access Manag - * `es:AssociatePackage` \- associate a package to a domain + * `es:AssociatePackage` – Associate a package to a domain @@ -44 +63 @@ Users without administrator access require certain AWS Identity and Access Manag - * `es:DissociatePackage` \- dissociate a package from a domain + * `es:DissociatePackage` – Dissociate a package from a domain @@ -55 +74 @@ Grant all permission within IAM, not in the domain access policy. For more infor -This section covers how to up upload custom dictionary packages, since optional plugin packages are already pre-installed. Before you can associate a custom dictionary with your domain, you must upload it to an Amazon S3 bucket. For instructions, see [Uploading objects](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/upload-objects.html) in the _Amazon Simple Storage Service User Guide_. Supported plugins don't need to be uploaded. +This section covers how to up upload custom dictionary packages, since pre-packaged plugin packages are already installed. Before you can associate a custom dictionary with your domain, you must upload it to an Amazon S3 bucket. For instructions, see [Uploading objects](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/upload-objects.html) in the _Amazon Simple Storage Service User Guide_. Supported plugins don't need to be uploaded. @@ -57 +76 @@ This section covers how to up upload custom dictionary packages, since optional -If your dictionary contains sensitive information, specify [server-side encryption with S3-managed keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) when you upload it. OpenSearch Service can't access files on S3 that you protect using an AWS KMS key. +If your dictionary contains sensitive information, specify [server-side encryption with S3-managed keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) when you upload it. OpenSearch Service can't access files in S3 that you protect using an AWS KMS key. @@ -76 +95 @@ The console is the simplest way to import a custom dictionary into OpenSearch Se -Optional plugins are already pre-installed in OpenSearch Service so you don't need to upload them yourself, but you do need to associate a plugin with a domain. Available plugins are listed on the **Packages** screen in the console. +Optional plugins are already pre-installed in OpenSearch Service so you don't need to upload them yourself, but you do need to associate a plugin to a domain. Available plugins are listed on the **Packages** screen in the console. @@ -82 +101 @@ Optional plugins are already pre-installed in OpenSearch Service so you don't ne - 3. Give the custom dictionary a descriptive name. + 3. Give the package a descriptive name. @@ -84 +103 @@ Optional plugins are already pre-installed in OpenSearch Service so you don't ne - 4. Provide the S3 path to the file, and then choose **Submit**. + 4. Provide the S3 path to the file, and then choose **Import**. @@ -88 +107 @@ Optional plugins are already pre-installed in OpenSearch Service so you don't ne - 6. When the package status is **Available** , select it. Optional plugins will automatically be **Available**. + 6. When the package status is **Available** , select it. @@ -92 +111 @@ Optional plugins are already pre-installed in OpenSearch Service so you don't ne - 8. Select a domain, and then choose **Associate**. + 8. Select a domain, and then choose **Next**. Review the packages and choose **Associate**. @@ -101,2 +119,0 @@ Optional plugins are already pre-installed in OpenSearch Service so you don't ne -Alternately, use the AWS CLI, SDKs, or configuration API to import and associate packages. For more information, see the [AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/) and [Amazon OpenSearch Service API Reference](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html). - @@ -105 +122 @@ Alternately, use the AWS CLI, SDKs, or configuration API to import and associate -This section covers how to use both types of packages: custom dictionaries and optional plugins. +This section covers how to use both types of packages: custom dictionaries and pre-packaged plugins. @@ -109 +126 @@ This section covers how to use both types of packages: custom dictionaries and o -After you associate a file with a domain, you can use it in parameters such as `synonyms_path`, `stopwords_path`, and `user_dictionary` when you create tokenizers and token filters. The exact parameter varies by object. Several objects support `synonyms_path` and `stopwords_path`, but `user_dictionary` is exclusive to the kuromoji plugin. +After you associate a file to a domain, you can use it in parameters such as `synonyms_path`, `stopwords_path`, and `user_dictionary` when you create tokenizers and token filters. The exact parameter varies by object. Several objects support `synonyms_path` and `stopwords_path`, but `user_dictionary` is exclusive to the kuromoji plugin. @@ -214 +231 @@ Dictionary files use Java heap space proportional to their size. For example, a -### Using optional plugins +### Using pre-packaged plugins @@ -216 +233 @@ Dictionary files use Java heap space proportional to their size. For example, a -OpenSearch Service lets you associate pre-installed, optional OpenSearch plugins to use with your domain. An optional plugin package is compatible with a specific OpenSearch version, and can only be associated to domains with that version. The list of available packages for your domain includes all supported plugins that are compatible with your domain version. After you associate a plugin to a domain, an installation process on the domain begins. Then, you can reference and use the plugin when you make requests to OpenSearch Service. +OpenSearch Service lets you associate pre-installed, optional OpenSearch plugins to use with your domain. An pre-packaged plugin package is compatible with a specific OpenSearch version, and can only be associated to domains with that version. The list of available packages for your domain includes all supported plugins that are compatible with your domain version. After you associate a plugin to a domain, an installation process on the domain begins. Then, you can reference and use the plugin when you make requests to OpenSearch Service. @@ -262 +279 @@ The following example demonstrates how to use system and user dictionaries with -This section only covers how to update a custom dictionary package, because optional plugin packages are already updated for you. Uploading a new version of a dictionary to Amazon S3 does _not_ automatically update the package on Amazon OpenSearch Service. OpenSearch Service stores its own copy of the file, so if you upload a new version to S3, you must manually update it. +This section only covers how to update a custom dictionary package, because pre-packaged plugin packages are already updated for you. Uploading a new version of a dictionary to Amazon S3 does _not_ automatically update the package on Amazon OpenSearch Service. OpenSearch Service stores its own copy of the file, so if you upload a new version to S3, you must manually update it. @@ -270 +287 @@ Each of your associated domains stores _its_ own copy of the file, as well. To k - 3. Provide the S3 path to the file, and then choose **Update package**. + 3. Provide a new S3 path to the file, and then choose **Update package**. @@ -276 +293 @@ Each of your associated domains stores _its_ own copy of the file, as well. To k - 6. The next steps vary depending on how you configured your indices: + 6. The next steps vary depending on how you configured your indexes: @@ -278 +295 @@ Each of your associated domains stores _its_ own copy of the file, as well. To k - * If your domain is running OpenSearch or Elasticsearch 7.8 or later, and only uses search analyzers with the updateable field set to true, you don't need to take any further action. OpenSearch Service automatically updates your indices using the [_plugins/_refresh_search_analyzers API](https://opensearch.org/docs/im-plugin/refresh-analyzer/index/). + * If your domain is running OpenSearch or Elasticsearch 7.8 or later, and only uses search analyzers with the updateable field set to true, you don't need to take any further action. OpenSearch Service automatically updates your indexes using the [_plugins/_refresh_search_analyzers API](https://opensearch.org/docs/im-plugin/refresh-analyzer/index/). @@ -280 +297 @@ Each of your associated domains stores _its_ own copy of the file, as well. To k - * If your domain is running Elasticsearch 7.7 or earlier, uses index analyzers, or doesn't use the `updateable` field, see Manual index updates for dictionaries. + * If your domain is running Elasticsearch 7.7 or earlier, uses index analyzers, or doesn't use the `updateable` field, see Manually updating indexes with a new dictionary. @@ -380 +397 @@ If you receive a "package not found" error when you run the script using the AWS -## Manual index updates for dictionaries +## Manually updating indexes with a new dictionary @@ -382 +399 @@ If you receive a "package not found" error when you run the script using the AWS -Manual index updates only apply to custom dictionaries, not optional plugins. To use an updated dictionary, you must manually update your indexes if you meet any of the following conditions: +Manual index updates only apply to custom dictionaries, not pre-packaged plugins. To use an updated dictionary, you must manually update your indexes if you meet any of the following conditions: @@ -474 +491 @@ If you don't need the old index, delete it: -Dissociating a package, whether it's a custom dictionary or optional plugin, from a domain means that you can no longer use that package when you create new indexes. After a package is dissociated, existing indexes that were using the package can no longer use it. You must remove the package from any index before you can dissociate it, otherwise the dissociation fails. +Dissociating a package, whether it's a custom dictionary or pre-packaged plugin, from a domain means that you can no longer use that package when you create new indexes. After a package is dissociated, existing indexes that were using the package can no longer use it. You must remove the package from any index before you can dissociate it, otherwise the dissociation fails. @@ -478 +495 @@ The console is the simplest way to dissociate a package from a domain and remove - 1. Go to [https://aws.amazon.com](https://aws.amazon.com), and then choose **Sign In to the Console**. + 1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). @@ -480 +497 @@ The console is the simplest way to dissociate a package from a domain and remove - 2. Under **Analytics** , choose **Amazon OpenSearch Service**. + 2. In the navigation pane, choose **Domains**. @@ -482 +499 @@ The console is the simplest way to dissociate a package from a domain and remove - 3. In the navigation pane, choose your domain, and then choose the **Packages** tab. + 3. Choose the domain, then navigate to the **Packages** tab. @@ -505 +522 @@ Searching data -SQL support +Custom plugins