AWS opensearch-service medium security documentation change
Summary
Updated region references from us-west-2 to us-east-1, removed sts_role_arn parameters in multiple configurations, adjusted documentation links to relative paths, modified section headings, and fixed minor text formatting.
Security assessment
The removal of explicit sts_role_arn parameters in pipeline configurations could lead to security misconfigurations if users omit proper IAM role associations. STS roles are critical for secure AWS resource access, and their removal from documentation examples might result in pipelines running with incorrect permissions.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-self-managed-kafka.md b/opensearch-service/latest/developerguide/configure-client-self-managed-kafka.md index aa3076204..531908af1 100644 --- a//opensearch-service/latest/developerguide/configure-client-self-managed-kafka.md +++ b//opensearch-service/latest/developerguide/configure-client-self-managed-kafka.md @@ -5 +5 @@ -Migrating data from public Kafka clusters Migrating data from Kafka clusters in a VPC +Migrating data from public Kafka clusters @@ -21 +21 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see [Creating OpenSearch Service domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains) and [Creating collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-manage.html#serverless-create). + 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see [ Creating OpenSearch Service domains](./createupdatedomains.html#createdomains) and [Creating collections](./serverless-manage.html#serverless-create). @@ -76 +76 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - - "bootstrap-server.us-west-2.aws.private.confluent.cloud:9092" + - "bootstrap-server.us-east-1.aws.private.confluent.cloud:9092" @@ -84 +84 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - registry_url: https://my-registry.us-west-2.aws.confluent.cloud + registry_url: https://my-registry.us-east-1.aws.confluent.cloud @@ -90 +90 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - hosts: ["https://search-mydomain.us-west-2.es.amazonaws.com"] + hosts: ["https://search-mydomain.us-east-1.es.amazonaws.com"] @@ -92,2 +92 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" - region: "us-west-2" + region: "us-east-1" @@ -100,2 +99 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" @@ -104,2 +102,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" + @@ -107 +105 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch -You can use a preconfigured blueprint to create this pipeline. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +You can use a preconfigured blueprint to create this pipeline. For more information, see [Working with blueprints](./pipeline-blueprint.html). @@ -109 +107 @@ You can use a preconfigured blueprint to create this pipeline. For more informat -## Migrating data from Kafka clusters in a VPC +### Migrating data from Kafka clusters in a VPC @@ -113 +111 @@ You can also use OpenSearch Ingestion pipelines to migrate data from a self-mana -### Prerequisites +#### Prerequisites @@ -159 +157 @@ To create an IAM role with the correct permissions to access write data to the c -### Step 1: Configure the pipeline role +#### Step 1: Configure the pipeline role @@ -222 +220 @@ You must provide the above Amazon EC2 permissions on the IAM role that you use t -### Step 2: Create the pipeline +#### Step 2: Create the pipeline @@ -241 +239 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - - "bootstrap-server.us-west-2.aws.private.confluent.cloud:9092" + - "bootstrap-server.us-east-1.aws.private.confluent.cloud:9092" @@ -249 +247 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - registry_url: https://my-registry.us-west-2.aws.confluent.cloud + registry_url: https://my-registry.us-east-1.aws.confluent.cloud @@ -255 +253 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - hosts: ["https://search-mydomain.us-west-2.es.amazonaws.com"] + hosts: ["https://search-mydomain.us-east-1.es.amazonaws.com"] @@ -257,2 +255 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" - region: "us-west-2" + region: "us-east-1" @@ -265,2 +262 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" @@ -269,2 +265,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" + @@ -272 +268 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch -You can use a preconfigured blueprint to create this pipeline. For more information, see [Using blueprints to create a pipeline](./pipeline-blueprint.html). +You can use a preconfigured blueprint to create this pipeline. For more information, see [Working with blueprints](./pipeline-blueprint.html). @@ -282 +278 @@ OpenTelemetry Collector -Self-managed OpenSearch +Self-managed OpenSearch clusters