AWS AWSCloudFormation documentation change
Summary
Clarified encryption requirements by explaining two KMS key association options and their precedence
Security assessment
Enhanced documentation about encryption configuration options for OpenSearch Serverless collections, explicitly explaining security best practices for KMS key management without fixing a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-collection.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-collection.md index 11c22e5eb..f6b71c268 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-collection.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-collection.md @@ -13 +13 @@ Specifies an OpenSearch Serverless collection. For more information, see [Creati -You must create a matching [encryption policy](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html) in order for a collection to be created successfully. You can specify the policy resource within the same CloudFormation template as the collection resource if you use the [DependsOn](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html) attribute. See [Examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-opensearchserverless-collection.html#aws-resource-opensearchserverless-collection--examples) for a sample template. Otherwise the encryption policy must already exist before you create the collection. +To create a collection successfully, you must associate a KMS key for encryption. You have two options: 1\. Specify the KMS key directly in the CreateCollection request – Use the encryption-config parameter when creating the collection. 2\. Define the KMS key in an encryption security policy – Create a matching [encryption policy](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html) before or alongside your collection. Note: If you specify a KMS key in both locations, the key provided in the CreateCollection request takes precedence over the security policy configuration. When using CloudFormation templates, you can include the encryption policy resource in the same template as the collection resource by using the [DependsOn](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html) attribute to ensure proper resource creation order. Alternatively, ensure the encryption policy or KMS key configuration exists before creating the collection. @@ -57 +57 @@ To declare this entity in your CloudFormation template, use the following syntax -The name of the collection group that contains this collection. +The name of the collection group to associate with the collection. @@ -87 +87 @@ _Required_ : No -Encryption settings for a collection. +Encryption settings for the collection.