AWS opensearch-service documentation change
Summary
Added clarification that ABAC is only supported for control plane operations in OpenSearch Serverless
Security assessment
Clarifies security controls by specifying limitations of ABAC and directing users to data access policies for data plane security. This improves security documentation but does not fix a specific vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/security-iam-serverless.md b/opensearch-service/latest/developerguide/security-iam-serverless.md index 602768226..a5f3ae42e 100644 --- a//opensearch-service/latest/developerguide/security-iam-serverless.md +++ b//opensearch-service/latest/developerguide/security-iam-serverless.md @@ -159,0 +160,4 @@ For more information about ABAC, see [Define permissions with ABAC authorization +###### Important + +OpenSearch Serverless supports attribute-based access control (ABAC) for control plane operations only. ABAC is not supported for data plane operations such as indexing and searching data within collections. For data plane access control, use data access policies as described in [Data access control for Amazon OpenSearch Serverless](./serverless-data-access.html). +