AWS opensearch-service documentation change
Summary
Removed all content about third-party plugins and simplified optional plugins section
Security assessment
The removed content included security-related plugins (e.g., Portal26 encryption), but the change itself is documentation cleanup/restructuring rather than addressing a specific security vulnerability. No evidence of security incident response in the diff.
Diff
diff --git a/opensearch-service/latest/developerguide/supported-plugins.md b/opensearch-service/latest/developerguide/supported-plugins.md index 967092902..13a1c2b54 100644 --- a//opensearch-service/latest/developerguide/supported-plugins.md +++ b//opensearch-service/latest/developerguide/supported-plugins.md @@ -5 +5 @@ -Optional pluginsThird party plugins +Optional plugins @@ -60,112 +60 @@ Note that for the [Sudachi plugin](https://github.com/WorksApplications/elastics -Optional plugins use the `ZIP-PLUGIN` package type. For more information about optional plugins, see [Custom packages for Amazon OpenSearch Service](./custom-packages.html). - -## Third party plugins - -Amazon OpenSearch Service now supports third party plugins from select partners. Like optional plugins, you can use the AWS Management Console and AWS CLI to associate a plugin to a domain, disassociate a plugin from a domain, and list all third party plugins in your domain. Third party plugin packages are compatible with specific OpenSearch versions, and can only be associated to domains with that OpenSearch version. - -Third party plugins are owned and provided by a third-party developer. You are responsible for obtaining and maintaining valid licences directly from the third-party developers. These third party plugins are avilable in all [AWS regions](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) where Amazon OpenSearch Service is available except **AWS GovCloud (US) Regions**. - -###### Note - -Some plugin providers may not enable their plugins in all AWS regions where Amazon OpenSearch Service is available, please reach out to the plugin provider on questions related to availability of the plugin in your AWS region. - -For more information about third party plugins, see [Custom packages for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/custom-packages.html). - -The following third party plugins are now available on Amazon OpenSearch Service: - - * **Portal26 Encrypted Search Plugin (Titanium-lockbox) :** Portal26 encryption plugin from Portal26.ai uses NIST FIPS 140-2 certified encryption to encrypt data as its indexed by Amazon OpenSearch Service. This plugin includes a Bring Your Own Key (BYOK) capability, allowing you to setup separate encryption keys for each index. - - * **Babel Street Match Plugin for OpenSearch (RNI):** This plugin accurately matches names, organizations, addresses, and dates in over 24 languages, enhancing security operations and regulatory compliance while reducing false positives and increasing operational efficiency. - - - - -The following third party plugins are available for use with Amazon OpenSearch Service: - -Plugin Name | Third Party Provider | Minimum required OpenSearch Service version | Minimum required Elasticsearch version | Requires a license ----|---|---|---|--- -Titanium-lockbox | Portal26.ai | 2.15 | Not supported | Y -Name Match (RNI) OpenSearch plugin | babelstreet.com | 2.15 | Not supported | Y - -The following Amazon OpenSearch Service features are unavailable for use when using third party plugins: - -Plugin Name | Encryption plugin | Babel Street Match plugin ----|---|--- -[Cross cluster search](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cross-cluster-search.html) | Not supported | Not supported -[Cross cluster replication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/replication.html) | Not supported | Not supported -[Remote-reindex](https://docs.aws.amazon.com/prescriptive-guidance/latest/opensearch-service-migration/remote-reindexing.html) | Not supported | Not supported -[Auto-tune](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/auto-tune.html) | Not supported | Not supported -[Ultrawarm](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ultrawarm.html) | Not supported | Supported -[Multi-AZ with Standby](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-multiaz.html#managedomains-za-standby) | Not supported | Not supported - -You can use the `"CreatePackage"`, `"AssociatePackage"` and `"DissociatePackage"` to upload and associate the plugin you use with your Amazon OpenSearch Service managed domain. `"PACKAGE-CONFIG"` and `"PACKAGE-LICENSE"` package types are supported for uploading the plugin configuration and license files. To obtain the license files to install Portal26, see [Portal26.ai](https://portal26.ai/). To obtain the license files to install the Name Match (RNI) OpenSearch plugin, see [Babel Street](https://www.babelstreet.com/). - -### Prerequisites - - * Ensure that you have the plugin configuration and license files for theOpenSearch version running on your Amazon OpenSearch Service domain. - - * You must have the following enabled on your Amazon OpenSearch Service domain: - - * [Node to node encryption](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ntn.html) - - * [Encryption of data at rest](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html#enabling-ear) - - * Set ‘[EnforceHTTPS](https://docs.aws.amazon.com/config/latest/developerguide/opensearch-https-required.html)’ to 'true' - - * Enable support for **TLSSecurityPolicy 'Policy-Min-TLS-1-2-PFS-2023-10'**. For more information, see [DomainEndpointOptions](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DomainEndpointOptions.html). - - - - -### Installing third party plugins with AWS CLI - -To enable use of third party plugins using the AWS CLI you will need to apply the following service model JSON: - - 1. Fetch the list of available third party plugins using the [describe-packages](https://docs.aws.amazon.com/cli/latest/reference/es/describe-packages.html?highlight=describepackages) API. - - aws opensearch --region $REGION describe-packages --filters '[{"Name": "PackageType","Value": ["ZIP-PLUGIN"]}, {"Name": "PackageName","Value": ["<package-name>"]}]' - - 2. Create a new package for plugin license using the existing [CreatePackage](https://docs.aws.amazon.com/cli/latest/reference/opensearch/create-package.html) API. - - aws opensearch --region $REGION create-package --package-name <package-name> --package-type PACKAGE-LICENSE --package-source S3BucketName=<bucket>,S3Key=<key> - -Please update the bucket and key location to point to the license file in the account's s3 bucket. The file must have a .json or .xml extension. - - 3. Create a new package for plugin config using the existing [CreatePackage](https://docs.aws.amazon.com/cli/latest/reference/opensearch/create-package.html) API. - - aws opensearch --region $REGION create-package --package-name <package-name> --package-type PACKAGE-CONFIG --package-source S3BucketName=<bucket>,S3Key=<key - -###### Note - -Please update the bucket and key location to point to the config zip file in the calling account’s s3 bucket. The s3 must be in the same region where the package is created. Only zip files are supported for config type packages. The contents of the zip file must follow directory structure as expected by the plugin. - - 4. Use the new [AssociatePackage](https://docs.aws.amazon.com/cli/latest/reference/opensearch/associate-package.html) API to associate the partner plugin along with license and configuration with a compatible Amazon OpenSearch Service domain (matching version) using the package ids of these packages. - - aws opensearch --region $REGION associate-packages --domain-name <domain-name> --package-list '[{"PackageID": "<plugin-package-id>"},{"PackageID": "<license-package-id>","PrerequisitePackageIDList":["<plugin-package-id>"]},{"PackageID":"<config-package-id>","PrerequisitePackageIDList":["<plugin-package-id>"]}]' - -###### Note - -Plugins are installed and uninstalled using a [blue/green deployment process](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-configuration-changes.html). - - 5. Use the existing [ListPackagesForDomain](https://docs.aws.amazon.com/cli/latest/reference/opensearch/list-packages-for-domain.html) API to see the status of the association. The association status will change as the workflow progresses from ASSOCATING to ACTIVE. The association status changes to ACTIVE once the plugin installation workflow has been completed and plugin is ready to be used. - - aws opensearch --region $REGION list-packages-for-domain --domain-name <domain name> - - 6. Use the existing [GetPackageVersionHistory](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/opensearch/get-package-version-history.html) API to see the versions for any package. - - 7. License/config packages can be updated using the existing [UpdatePackage](https://docs.aws.amazon.com/cli/latest/reference/opensearch/update-package.html) API. Use the following API to apply package updates to a domain. - - aws opensearch --region $REGION update-package --package-id <package-id> --package-source S3BucketName=<bucket>,S3Key=<key> --package-description <description> - - 8. Use the existing [DissociatePackage](https://docs.aws.amazon.com/cli/latest/reference/opensearch/dissociate-package.html) API to uninstall the plugin from any domain. You can use the existing [ListPackagesForDomain](https://docs.aws.amazon.com/cli/latest/reference/opensearch/list-packages-for-domain.html) API to see the status of the dissociation. - - aws opensearch --region $REGION dissociate-package --package-id <plugin-package-id> --domain-name <domain name> - -###### Note - -In order to uninstall a plugin, you will have first have to disable the plugin from every index before dissociating the plugin package. - - 9. Use the existing [ListPackagesForDomain](https://docs.aws.amazon.com/cli/latest/reference/opensearch/list-packages-for-domain.html) API to see the status of the dissociation. - - - +Optional plugins use the `ZIP-PLUGIN` package type. For more information about optional plugins, see [Importing and managing packages in Amazon OpenSearch Service](./custom-packages.html).