AWS opensearch-service documentation change
Summary
Updated SAML configuration documentation with CLI instructions and example placeholders
Security assessment
The changes provide clearer guidance on SAML audience restrictions and authentication configuration, which are security-related authentication mechanisms. However there's no evidence of addressing a specific vulnerability
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-saml.md b/opensearch-service/latest/developerguide/serverless-saml.md index f1731ba85..3db00e775 100644 --- a//opensearch-service/latest/developerguide/serverless-saml.md +++ b//opensearch-service/latest/developerguide/serverless-saml.md @@ -129 +129,5 @@ In Okta, for example, you create a "SAML 2.0 web application" and specify the AC - 7. Provide the audience restriction if your IdP has a field for it. The audience restriction is a value within the SAML assertion that specifies who the assertion is intended for. For OpenSearch Serverless, specify `aws:opensearch:<aws account id>`. For example, `aws:opensearch:`123456789012``. + 7. Provide the audience restriction if your IdP has a field for it. The audience restriction is a value within the SAML assertion that specifies who the assertion is intended for. With OpenSearch Serverless, you can do the following. Make sure to replace the `content` in the following code example with your own AWS account ID: + + 1. Use the default audience restriction `:opensearch:`111122223333``. + + 2. (Optional) configure a custom audience restriction using the AWS CLI. For more information, see Creating SAML providers (AWS CLI). @@ -233 +237,2 @@ Specify `saml-options`, including the metadata XML, as a key-value map within a - "metadata": "<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" ... ... ... IDPSSODescriptor>\r\n<\/EntityDescriptor>" + "openSearchServerlessEntityId": "aws:opensearch:111122223333:app1", + "metadata": "EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" ... ... ... IDPSSODescriptor\r\n\/EntityDescriptor" @@ -235,0 +241,4 @@ Specify `saml-options`, including the metadata XML, as a key-value map within a +###### Note + +(Optional) configure a custom audience restriction using the AWS CLI. For more information, see Creating SAML providers (AWS CLI). + @@ -252 +261 @@ The request returns information about all existing SAML providers, including the - "id": "saml/123456789012/myprovider", + "id": "saml/111122223333/myprovider", @@ -256 +265 @@ The request returns information about all existing SAML providers, including the - "metadata": "<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" ... ... ... IDPSSODescriptor>\r\n<\/EntityDescriptor>", + "metadata": "EntityDescriptorxmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" ...... ...IDPSSODescriptor\r\n/EntityDescriptor", @@ -257,0 +267 @@ The request returns information about all existing SAML providers, including the + "openSearchServerlessEntityId": "aws:opensearch:111122223333:app1",