AWS opensearch-service documentation change
Summary
Rewrote documentation to focus on OpenSearch UI features, removed detailed configuration steps, and added links to new dedicated guides. Added sections about workspace permissions, SSO integration, and cross-region support.
Security assessment
The changes add documentation about security features like workspace privacy settings, IAM Identity Center/SAML integration, and access management, but there's no evidence of addressing a specific security vulnerability. These are enhancements to security documentation rather than fixes.
Diff
diff --git a/opensearch-service/latest/developerguide/application.md b/opensearch-service/latest/developerguide/application.md index 6288bd2a2..664704f9f 100644 --- a//opensearch-service/latest/developerguide/application.md +++ b//opensearch-service/latest/developerguide/application.md @@ -5 +5 @@ -Creating an applicationConfiguring single sign-onAssociating data sourcesIntegrating with VPC domainsIntegrating with VPC collectionsSetting up workspaces +# Using OpenSearch UI in Amazon OpenSearch Service @@ -7 +7 @@ Creating an applicationConfiguring single sign-onAssociating data sourcesIntegra -# Using the OpenSearch user interface in Amazon OpenSearch Service +OpenSearch UI (user interface) is a modernized operational analytics experience for Amazon OpenSearch Service that provides a unified view for you to interact with data across multiple sources. Unlike OpenSearch Dashboards, which works with only the one domain or collection that hosts it, OpenSearch UI is hosted in the AWS Cloud. This makes it possible for OpenSearch UI to achieve high availability and stay functional during cluster upgrades, and to natively connect with multiple data sources. For information about OpenSearch Dashboards, see [Using OpenSearch Dashboards with Amazon OpenSearch Service](./dashboards.html). @@ -9 +9 @@ Creating an applicationConfiguring single sign-onAssociating data sourcesIntegra -The OpenSearch user interface (UI) is a web-based application for Amazon OpenSearch Service that lets you visualize and interact with data stored in more than one OpenSearch resources. It contains customizable dashboards, advanced data exploration, and support for multiple query languages. You can use the OpenSearch UI to manage multiple OpenSearch clusters, OpenSearch Serverless collections, and other integrated data sources from a unified interface. +The following are key features of OpenSearch UI: @@ -11 +11 @@ Creating an applicationConfiguring single sign-onAssociating data sourcesIntegra -Unlike _OpenSearch Dashboards_ , which runs within individual domains or collections and supports only one data source, the OpenSearch UI runs in the AWS Cloud. It connects to multiple data sources to provide a unified view of your data. For information about OpenSearch Dashboards, see [Using OpenSearch Dashboards with Amazon OpenSearch Service](./dashboards.html). + * **Multiple data source support** – OpenSearch UI can connect with multiple data sources to create a comprehensive view. This includes OpenSearch domains and serverless collections, as well as integrated AWS data sources such as Amazon CloudWatch, Amazon Security Lake, and Amazon Simple Storage Service (Amazon S3). @@ -13 +13 @@ Unlike _OpenSearch Dashboards_ , which runs within individual domains or collect -The OpenSearch UI has the following features: + * **Zero downtime during upgrades** – OpenSearch UI is hosted in the AWS Cloud. This means that OpenSearch remain operational and can retrieve data from clusters during upgrade processes. @@ -15 +15 @@ The OpenSearch UI has the following features: - * **Discover** – Unified log exploration with support for SQL, PPL, DQL, and Lucene. + * **Workspaces** – Curated spaces for team collaborations for various workflows, such as Observability, Security Analytics and Search. You can define the privacy settings and manage permissions for collaborators in your workspace. @@ -17 +17 @@ The OpenSearch UI has the following features: - * **Centralized management** – View all OpenSearch applications in the AWS console. + * **Single sign-on** – OpenSearch UI works with AWS IAM Identity Center and SAML through AWS Identity and Access Management (IAM) federatation to integrate with your identity providers to create a single sign-on experience for your end users. @@ -19 +19 @@ The OpenSearch UI has the following features: - * **Collaboration** – Each application has a unique endpoint URL for easy sharing. + * **GenAI-powered analytics** – OpenSearch UI supports natural language query generation to help generate the right queries for your analysis. OpenSearch UI also works with Amazon Q Developer to provide the Amazon Q chat and help generate visualizations, alert summary, insights, and recommended anomaly detectors. @@ -21 +21 @@ The OpenSearch UI has the following features: - * **Access control** – Supports authentication through IAM credentials or IAM Identity Center. + * **Multiple query language support** – OpenSearch UI supports Piped Processing Language (PPL), SQL, Lucene, and Dashboards Query Language (DQL). @@ -22,0 +23 @@ The OpenSearch UI has the following features: + * **Cross-Region and cross-account support** – OpenSearch UI can utilize the cross-cluster search feature to connect with OpenSearch domains in different accounts and different Regions for aggregated analysis and visualizations. @@ -26 +26,0 @@ The OpenSearch UI has the following features: -After you create an OpenSearch UI application, associate it with data sources to analyze, query, and visualize data across your infrastructure. Then, configure _workspaces_ within the application, which provide tailored experiences for observability, security analytics, and team collaboration. Each workspace has its own data sources, collaborators, and access controls, which makes it easy to manage permissions. @@ -28 +28 @@ After you create an OpenSearch UI application, associate it with data sources to - +To get started and create your first OpenSearch UI, follow the instructions in [Getting started with the OpenSearch user interface in Amazon OpenSearch Service](./application-getting-started.html). @@ -30,156 +30 @@ After you create an OpenSearch UI application, associate it with data sources to -###### Topics - - * Creating an OpenSearch UI application - - * Configuring single sign-on authentication - - * Associating data sources with your application - - * Integrating applications with OpenSearch domains in a VPC - - * Integrating applications with OpenSearch Serverless collections in a VPC - - * Setting up workspaces - - - - -## Creating an OpenSearch UI application - -Create an application by providing a name, authentication method, and administrators. - -###### To create a UI application in the console - - 1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). - - 2. In the left navigation pane, choose **OpenSearch UI (Dashboards)**. - - 3. Choose **Create application**. - - 4. For **Application name** , enter a name for the application. - - 5. (Optional) Configure single sign-on by enabling **Authentication with IAM Identity Center**. For more information, see Configuring single sign-on authentication. - - 6. If needed, add additional application administrators. The OpenSearch application administrator role grants permissions to edit and delete an OpenSearch application. By default, the creator of an OpenSearch application becomes the first administrator. You can add additional administrators, or grant administrator permission to all users. - -You can remove extra administrators, but at least one must remain for each application. - - 7. (Optional) Add tags to describe the application. - - 8. Choose **Create**. - - - - -To create an application using the AWS CLI, use the [create-application](https://docs.aws.amazon.com/cli/latest/reference/opensearch/create-application.html) command with the following options: - - * `--name` – The name of the application. - - * `--iam-identity-center-options` – (Optional) The IAM Identity Center instance and the IAM role that OpenSearch will use for authentication and access control. - - - - - - aws opensearchservice create-application \ - --name myapplication \ - --iam-identity-center-options '{ - "enabled": true, - "iamIdentityCenterInstanceArn": "arn:aws:sso:::instance/ssoins-xxxxxxxxx", - "iamRoleForIdentityCenterApplicationArn": "arn:aws:iam::123456789012:role/xxxxxxxx" - }' - -## Configuring single sign-on authentication - -You can control access to an OpenSearch application using AWS Identity and Access Management (IAM) or IAM Identity Center. - - * **IAM (Default)** – Manage access by assigning IAM roles or users. - - * **IAM Identity Center (Optional)** – Allows users to log in using existing identity providers. - - - - -###### Note - -OpenSearch UI doesn't support IAM Identity Center instances in a different AWS Region. To use IAM Identity Center, create the application in the same Region. - -To enable IAM Identity Center, select **Authenticate with IAM Identity Center** when you create an application, and choose an IAM role. - -The role must have the following permissions: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "IdentityStoreOpenSearchDomainConnectivity", - "Effect": "Allow", - "Action": [ - "identitystore:DescribeUser", - "identitystore:ListGroupMembershipsForMember", - "identitystore:DescribeGroup" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledViaLast": "es.amazonaws.com" - } - } - }, - { - "Sid": "OpenSearchDomain", - "Effect": "Allow", - "Action": [ - "es:ESHttp*" - ], - "Resource": "*" - }, - { - "Sid": "OpenSearchServerless", // If users need to access OpenSearch Serverless collections - "Effect": "Allow", - "Action": [ - "aoss:APIAccessAll" - ], - "Resource": "*" - } - ] - } - -The role must have the following trust policy: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "application.opensearchservice.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetContext" - ], - "Condition": { - "ForAllValues:ArnEquals": { - "sts:RequestContextProviders": "arn:aws:iam::aws:contextProvider/IdentityCenter" - } - } - } - ] - } - -## Associating data sources with your application - -After you create an OpenSearch application, associate it with one or more data sources to analyze, query and visualize data across your infrastructure. An application can connect to multiple data sources, including OpenSearch Service domains and OpenSearch Serverless collections. It also supports external sources like Amazon Security Lake and Amazon CloudWatch Logs. - -###### To connect a data source in the console - - 1. Select an application to open its details. - - 2. Under **Associated data sources** , choose **Manage data sources**. - - 3. Choose one or more domains or collections to associate with the application. Alternatively, choose **Create data connection** to connect other AWS sources. - - 4. OpenSearch Service notifies you if any of the resources you selected require additional enablement for VPC access. To grant access, select the resource and choose **Enable access to VPC**. +For information about the latest features released for OpenSearch UI, see [Amazon OpenSearch Service user interface release history](./application-release-history.html). @@ -187,105 +32 @@ After you create an OpenSearch application, associate it with one or more data s -Alternatively, you can configure access directly within the domain or collection. For more information, see the following: - - * Integrating applications with OpenSearch domains in a VPC