AWS opensearch-service documentation change
Summary
Updated VPC configuration instructions for Confluent Cloud Kafka cluster and added DNS settings for AWS PrivateLink connectivity
Security assessment
The changes clarify network configuration requirements for secure connectivity to Confluent Cloud Kafka via AWS PrivateLink. While this improves documentation accuracy and provides proper DNS settings (domain-name: aws.private.confluent.cloud) to ensure secure VPC endpoint resolution, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md b/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md index 4d376732e..b051ba759 100644 --- a//opensearch-service/latest/developerguide/configure-client-confluent-kafka.md +++ b//opensearch-service/latest/developerguide/configure-client-confluent-kafka.md @@ -208 +208 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - 4. Obtain the ID of the VPC that that has access to self-managed Kafka. Choose the VPC CIDR to be used by OpenSearch Ingestion. + 4. Obtain the ID of the VPC that has access to the Confluent Cloud Kafka cluster. Choose the VPC CIDR to be used by OpenSearch Ingestion. @@ -212 +212 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step -If you're using the AWS Management Console to create your pipeline, you must also attach your OpenSearch Ingestion pipeline to your VPC in order to use self-managed Kafka. To do so, find the **Network configuration** section, select the **Attach to VPC** checkbox, and choose your CIDR from one of the provided default options, or select your own. You can use any CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918). +If you're using the AWS Management Console to create your pipeline, you must also attach your OpenSearch Ingestion pipeline to your VPC in order to use Confluent Cloud Kafka cluster. To do so, find the **Network configuration** section, select the **Attach to VPC** checkbox, and choose your CIDR from one of the provided default options, or select your own. You can use any CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918). @@ -221,0 +222,7 @@ If you are using AWS PrivateLink to connect your Confluent Cloud Kafka, you will +Specifically, use the following option set values: + + domain-name: aws.private.confluent.cloud + domain-name-servers: AmazonProvidedDNS + +This change ensures that DNS resolution for the Confluent PrivateLink endpoint works correctly within the VPC. +