AWS opensearch-service medium security documentation change
Summary
Removed explicit 'sts_role_arn' references in pipeline configurations, adjusted section headings, and updated blueprint documentation links.
Security assessment
Removing hardcoded STS role ARNs from configuration examples prevents accidental exposure of sensitive IAM role information in documentation, reducing the risk of misconfiguration or credential leakage. This change enforces security best practices by avoiding explicit role ARNs in user-facing examples.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md b/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md index 5489989d7..4d376732e 100644 --- a//opensearch-service/latest/developerguide/configure-client-confluent-kafka.md +++ b//opensearch-service/latest/developerguide/configure-client-confluent-kafka.md @@ -5 +5 @@ -Connectivity to Confluent Cloud public Kafka clustersConnectivity to Confluent Cloud Kafka clusters in a VPC +Connectivity to Confluent Cloud public Kafka clusters @@ -169 +168,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -171,2 +169,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - index: "confluent-index" - extension: @@ -178 +174,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -182 +177,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -184 +179 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch -You can use a preconfigured blueprint to create this pipeline. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +You can use a preconfigured blueprint to create this pipeline. For more information, see [Working with blueprints](./pipeline-blueprint.html). @@ -186 +181 @@ You can use a preconfigured blueprint to create this pipeline. For more informat -## Connectivity to Confluent Cloud Kafka clusters in a VPC +### Connectivity to Confluent Cloud Kafka clusters in a VPC @@ -203 +198 @@ OpenSearch Ingestion supports Confluent Cloud Kafka clusters configured in all s -### Prerequisites +#### Prerequisites @@ -253 +248 @@ To create an IAM role with the correct permissions to access write data to the c -### Step 1: Configure the pipeline role +#### Step 1: Configure the pipeline role @@ -316 +311 @@ You must provide the above Amazon EC2 permissions on the IAM role that you use t -### Step 2: Create the pipeline +#### Step 2: Create the pipeline @@ -351 +345,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -360 +353,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -364,3 +356,0 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" - -You can use a preconfigured blueprint to create this pipeline. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html).