AWS opensearch-service documentation change
Summary
Updated example placeholders (bucket names, regions, ARNs), fixed URL formatting, removed redundant sts_role_arn references, and updated blueprint documentation links
Security assessment
Changes primarily involve example standardization and documentation corrections. Removal of hardcoded ARNs/regions improves security hygiene but doesn't address a specific vulnerability. No evidence of patching a security flaw or disclosing a vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-s3.md b/opensearch-service/latest/developerguide/configure-client-s3.md index 6175931db..e62fd5388 100644 --- a//opensearch-service/latest/developerguide/configure-client-s3.md +++ b//opensearch-service/latest/developerguide/configure-client-s3.md @@ -81 +81 @@ The following sample policy shows the required permissions for using S3 as a sou - "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*" + "Resource": "arn:aws:s3:::bucket-name/*" @@ -109 +108,0 @@ You must attach these permissions to the IAM role that you specify in the `sts_r - **sts_role_arn** : arn:aws:iam::account-id:role/pipeline-role @@ -133 +132 @@ To set up S3-SQS processing, configure your pipeline to specify S3 as the source - queue_url: "https://sqs.us-east-1.amazonaws.com/account-id/ingestion-queue" + queue_url: "https://sqs.us-east-1amazonaws.com/account-id/ingestion-queue" @@ -136,3 +135 @@ To set up S3-SQS processing, configure your pipeline to specify S3 as the source - region: "us-east-1" - - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "region" @@ -149 +146 @@ To set up S3-SQS processing, configure your pipeline to specify S3 as the source - hosts: ["https://search-domain-endpoint.us-east-1.es.amazonaws.com"] + hosts: ["https://search-domain-endpoint.us-east-1es.amazonaws.com"] @@ -152,3 +149 @@ To set up S3-SQS processing, configure your pipeline to specify S3 as the source - # IAM role that the pipeline assumes to access the domain sink - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" - region: "us-east-1" + region: "region" @@ -164 +159 @@ You can configure scheduled scans with either a _one-time scan_ , which is ideal -To configure your pipeline to read from Amazon S3, use the preconfigured Amazon S3 blueprints. You can edit the `scan` portion of your pipeline configuration to meet your scheduling needs. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +To configure your pipeline to read from Amazon S3, use the preconfigured Amazon S3 blueprints. You can edit the `scan` portion of your pipeline configuration to meet your scheduling needs. For more information, see [Working with blueprints](./pipeline-blueprint.html). @@ -183,2 +178 @@ The following configuration sets up a one-time scan for all buckets and all obje - region: "us-east-1" - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "region" @@ -211 +205 @@ The following configuration sets up a one-time scan for all buckets and all obje - hosts: ["https://search-domain-endpoint.us-east-1.es.amazonaws.com"] + hosts: ["https://search-domain-endpoint.us-east-1es.amazonaws.com"] @@ -214,2 +208 @@ The following configuration sets up a one-time scan for all buckets and all obje - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" - region: "us-east-1" + region: "region" @@ -220 +212,0 @@ The following configuration sets up a one-time scan for all buckets and all obje - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -311 +303 @@ The following configuration sets up a recurring scan, with a delay of 12 hours b -To write data from an OpenSearch Ingestion pipeline to an S3 bucket, use the preconfigured S3 blueprint to create a pipeline with an [S3 sink](https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sinks/s3/). This pipeline routes selective data to an OpenSearch sink and simultaneously sends all data for archival in S3. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +To write data from an OpenSearch Ingestion pipeline to an S3 bucket, use the preconfigured S3 blueprint to create a pipeline with an [S3 sink](https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sinks/s3/). This pipeline routes selective data to an OpenSearch sink and simultaneously sends all data for archival in S3. For more information, see [Working with blueprints](./pipeline-blueprint.html). @@ -348 +340 @@ You can also use `include_keys` and `exclude_keys` in your sink to filter data t -To create pipelines with such filters, use the preconfigured sink filter blueprint. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +To create pipelines with such filters, use the preconfigured sink filter blueprint. For more information, see [Working with blueprints](./pipeline-blueprint.html).