AWS opensearch-service documentation change
Summary
Added documentation for Shared VPC setup between AWS accounts, including owner/consumer account configuration and network policy management
Security assessment
The changes document secure network architecture patterns using VPC endpoints and cross-account access controls, but there's no evidence of addressing a specific security vulnerability. The update enhances security documentation by explaining proper shared VPC configuration.
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-vpc.md b/opensearch-service/latest/developerguide/serverless-vpc.md index 282e4b204..5d7a81c91 100644 --- a//opensearch-service/latest/developerguide/serverless-vpc.md +++ b//opensearch-service/latest/developerguide/serverless-vpc.md @@ -5 +5 @@ -DNS resolution of collection endpointsVPCs and network access policiesVPCs and endpoint policiesConsiderationsPermissions requiredCreate an interface endpointProvide the endpoint access to a collection +DNS resolution of collection endpointsVPCs and network access policiesVPCs and endpoint policiesConsiderationsPermissions requiredCreate an interface endpointShared VPC setup for Amazon OpenSearch Serverless @@ -29 +29 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Next step: Grant the endpoint access to a collection + * Shared VPC setup for Amazon OpenSearch Serverless @@ -211 +211 @@ You can also include IAM and SAML users in the same VPC endpoint policy. To do t -You can also access an Amazon OpenSearch Serverless collection from Amazon EC2 via interface VPC endpoints. For more information on this see, [Access an OpenSearch Serverless collection from Amazon EC2 (via interface VPC endpoints)](https://aws.amazon.com/blogs/big-data/network-connectivity-patterns-for-amazon-opensearch-serverless/). +You can also access an Amazon OpenSearch Serverless collection from Amazon EC2 via interface VPC endpoints. For more information see, [Access an OpenSearch Serverless collection from Amazon EC2 (via interface VPC endpoints)](https://aws.amazon.com/blogs/big-data/network-connectivity-patterns-for-amazon-opensearch-serverless/). @@ -329,3 +329 @@ To create a VPC endpoint using the OpenSearch Serverless API, use the `CreateVpc -After you create an endpoint, note its ID (for example, `vpce-050f79086ee71ac05`. In order to provide the endpoint access to your collections, you must include this ID in one or more network access policies. - -## Next step: Grant the endpoint access to a collection +After you create an endpoint, note its ID (for example, `vpce-abc123def4EXAMPLE`. In order to provide the endpoint access to your collections, you must include this ID in one or more network access policies. @@ -334,0 +333,65 @@ After you create an interface endpoint, you must provide it access to collection +## Shared VPC setup for Amazon OpenSearch Serverless + +You can use Amazon Virtual Private Cloud (VPC) to share VPC subnets with other AWS accounts in your organization, as well as share networking infrastructure such as a VPN between resources in multiple AWS accounts. + +Currently, Amazon OpenSearch Serverless doesn’t support creating an AWS PrivateLink connection into a shared VPC unless you are an owner of that VPC. AWS PrivateLink also doesn’t support sharing connections between AWS accounts. + +However, based on the flexible and modular architecture of OpenSearch Serverless, you can still set up a shared VPC. This is because the OpenSearch Serverless networking infrastructure is separate from that of the individual collection (OpenSearch Service) infrastructure. You can therefore create an AWS PrivateLink VPCe endpoint for one account where a VPC located, and then use a VPCe ID in the network policy of other accounts to restrict traffic to come only from that shared VPC. + +The following procedures refer to an _owner account_ and a _consumer account_. + +An owner account acts as a common networking account where you set up a VPC and share it with other accounts. Consumer accounts are those accounts that create and maintain their OpenSearch Serverless collections in the VPC shared with them by the owner account. + +###### Prerequisites + +Ensure the following requirements are met before setting up the shared VPC: + + * The intended owner account must have already set up a VPC, subnets, route table, and other required resources in Amazon Virtual Private Cloud. For more information, see the _[Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/)_. + + * The intended owner account and consumer accounts must belong to the same organization in AWS Organizations. For more information, see the _[AWS Organizations User Guide](https://docs.aws.amazon.com/organizations/latest/userguide/)_. + + + + +###### To set up a shared VPC in an owner account/common networking account. + + 1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). + + 2. Follow the steps in Create an interface endpoint for OpenSearch Serverless. As you do, make the following selections: + + * Select a VPC and subnets that are shared with the consumer accounts in your organization. + + 3. After you create the endpoint, make a note of the VPCe ID that is generated and provide it to the administrators who are to perform the setup task in consumer accounts. + +VPCe IDs are in the format `vpce-abc123def4EXAMPLE`. + + + + +###### To set up a shared VPC in a consumer account + + 1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). + + 2. Use the information in [Managing Amazon OpenSearch Serverless collections](./serverless-manage.html) to create a collection, if you don't have one already. + + 3. Use the information in [Creating network policies (console)](./serverless-network.html#serverless-network-console) to create a network policy. As you do, make the following selections. + +###### Note + +You can also update an existing network policy for this purpose. + + 1. For **Access type** , select **VPC (recommended)**. + + 2. For **VPC endpoints for access** , choose the VPCe ID provided to you by the owner account, in the format `vpce-abc123def4EXAMPLE`. + + 3. In the **Resource type** area, do the following: + + * Select the **Enable access to OpenSearch endpoint** box, and then select the collection name or collection pattern to use to enable access from that shared VPC. + + * Select the **Enable access to OpenSearch Dashboard** box, and then select the collection name or collection pattern to use to enable access from that shared VPC. + + 4. For a new policy, choose **Create**. For an existing policy, choose **Update**. + + + +