AWS opensearch-service medium security documentation change
Summary
Added new section 'Custom plugin installation fails due to version compatibility' explaining version mismatch errors and resolution steps
Security assessment
The change explicitly states that OpenSearch requires exact version matching between plugins and core installation 'for reasons of stability and security'. This addresses potential security risks from incompatible plugin versions that could introduce vulnerabilities.
Diff
diff --git a/opensearch-service/latest/developerguide/handling-errors.md b/opensearch-service/latest/developerguide/handling-errors.md index 490c1f704..72e678d99 100644 --- a//opensearch-service/latest/developerguide/handling-errors.md +++ b//opensearch-service/latest/developerguide/handling-errors.md @@ -5 +5 @@ -Can't access OpenSearch DashboardsCan't access VPC domainCluster in read-only stateRed cluster statusYellow cluster statusClusterBlockExceptionError migrating to Multi-AZ with StandbyJVM OutOfMemoryErrorFailed cluster nodesExceeded maximum shard limitDomain stuck in processing stateLow EBS burst balanceCan't enable audit logsCan't close indexClient license checksRequest throttlingCan't SSH into node"Not Valid for the Object's Storage Class" snapshot errorInvalid host headerInvalid M3 instance typeHot queries stop working after enabling UltraWarmCan't downgrade after upgradeNeed summary of domains for all AWS RegionsBrowser error when using OpenSearch DashboardsNode shard and storage skewIndex shard and storage skewUnauthorized operation after selecting VPC accessStuck at loading after creating VPC domainDenied requests to the OpenSearch APICan't connect from Alpine LinuxToo many requests for Search BackpressureCertificate error when using SDK +Can't access OpenSearch DashboardsCan't access VPC domainCluster in read-only stateRed cluster statusYellow cluster statusClusterBlockExceptionError migrating to Multi-AZ with StandbyJVM OutOfMemoryErrorFailed cluster nodesExceeded maximum shard limitDomain stuck in processing stateLow EBS burst balanceCan't enable audit logsCan't close indexClient license checksRequest throttlingCan't SSH into node"Not Valid for the Object's Storage Class" snapshot errorInvalid host headerInvalid M3 instance typeHot queries stop working after enabling UltraWarmCan't downgrade after upgradeNeed summary of domains for all AWS RegionsBrowser error when using OpenSearch DashboardsNode shard and storage skewIndex shard and storage skewUnauthorized operation after selecting VPC accessStuck at loading after creating VPC domainDenied requests to the OpenSearch APICan't connect from Alpine LinuxToo many requests for Search BackpressureCertificate error when using SDKCustom plugin installation fails due to version compatibility @@ -522,0 +523,56 @@ Currently, OpenSearch Service domains in the us-east-1 Region use certificates f +## Custom plugin installation fails due to version compatibility + +**Problem** : The plugin installation failed due to a version mismatch between the plugin and the running OpenSearch instance. The system returns the following error: + + + PluginValidationFailureReason : The provided plugin could not be loaded. + +**Cause** : The plugin was compiled for OpenSearch $`{MAJOR}`.$`{MINOR}.{PATCH}`, but your environment is running OpenSearch $`{MAJOR}`.$`{MINOR}`.0. OpenSearch requires exact version matching between plugins and the core OpenSearch installation for reasons of stability and security. + +**Possible fix** : Build the plugin with OpenSearch version $`{MAJOR}`.$`{MINOR}`.0 to match your cluster version. + +###### To verify and update the version of OpenSearch + + 1. Use your cluster's API or dashboard to run the following command. Replace the `default placeholder values` with your own information. + +**API request:** + + curl -X GET your-opensearch-endpoint/ + +**Dev Tools console in dashboard:** + + GET / + +The command returns information in the following format. + + { + "name": "node-id", + "cluster_name": "account-id:domain-name", + "cluster_uuid": "cluster-uuid", + "version": { + "distribution": "opensearch", + "number": "2.17.0", + "build_type": "tar", + "build_hash": "unknown", + "build_date": "2024-12-17T11:00:09.799828091Z", + "build_snapshot": false, + "lucene_version": "9.11.1", + "minimum_wire_compatibility_version": "7.10.0", + "minimum_index_compatibility_version": "7.0.0" + }, + "tagline": "The OpenSearch Project: https://opensearch.org/" + } + + 2. If the version number is not $`{MAJOR}`.$`{MINOR}`.0, rebuild the plugin by doing the following: + + 1. Update the plugin's `descriptor.properties` to specify version $`{MAJOR}`.$`{MINOR}`.0. + + 2. Rebuild the plugin using the command for your project type. + + 3. Run the [update-package](https://docs.aws.amazon.com/cli/latest/reference/opensearch/update-package.html) command using the newly built `.zip` file. + + 4. Run the [associate-package](https://docs.aws.amazon.com/cli/latest/reference/opensearch/associate-package.html) command to associate the latest plugin version that was created when you ran the `update-package` command in the previous step. + + + +