AWS opensearch-service medium security documentation change
Summary
Added note about instance families not supporting VPC Encryption Controls, reordered instance type listings, and updated Graviton3 storage reference
Security assessment
The change explicitly documents security limitations of specific instance families regarding VPC Encryption Controls - a feature that enforces encryption in transit. This indicates potential security risks when using listed instance types without encryption enforcement.
Diff
diff --git a/opensearch-service/latest/developerguide/supported-instance-types.md b/opensearch-service/latest/developerguide/supported-instance-types.md index 26197c7fa..f921c8613 100644 --- a//opensearch-service/latest/developerguide/supported-instance-types.md +++ b//opensearch-service/latest/developerguide/supported-instance-types.md @@ -12,0 +13,2 @@ For information about which instance type is appropriate for your use case, see +Please note that following instance families do not support VPC Encryption Controls: T2, T3, R3, I3, C4, M4, R4, C5, M5, R5, C6g, M6g, R6g, and R6gd. VPC Encryption Controls is a security and compliance feature that offers you centralized authoritative control to monitor the encryption status of your traffic flows, helps you identify resources that allow cleartext communication, and eventually gives you mechanisms to enforce encryption in transit within and across your VPCs in a region. To learn more details visit [ VPC Encryption Controls documentation.](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html) + @@ -20 +21,0 @@ i4i | i4i.large.search i4i.xlarge.search i4i.2xlarge.search i4i.4xlarge.search i -i4g | i4g.large.search i4g.xlarge.search i4g.2xlarge.search i4g.4xlarge.search i4g.8xlarge.search i4g.16xlarge.search | The i4g instance types require Elasticsearch 7.9 or later or any version of OpenSearch, and do not support EBS storage volumes. @@ -22 +23 @@ i8g | i8g.large.search i8g.xlarge.search i8g.2xlarge.search i8g.4xlarge.search i -Graviton3 | C7g.large.search C7g.xlarge.search C7g.2xlarge.search C7g.4xlarge.search C7g.8xlarge.search C7g.12xlarge.search C7g.16xlarge.search M7g.large.search M7g.xlarge.search M7g.2xlarge.search M7g.4xlarge.search M7g.8xlarge.search M7g.12xlarge.search M7g.16xlarge.search R7g.medium.search R7g.large.search R7g.xlarge.search R7g.2xlarge.search R7g.4xlarge.search R7g.8xlarge.search R7g.12xlarge.search R7g.16xlarge.search R7gd.large.search R7gd.xlarge.search R7gd.2xlarge.search R7gd.4xlarge.search R7gd.8xlarge.search R7gd.12xlarge.search R7gd.16xlarge.search | Graviton3 only supports GP3. +Graviton3 | C7g.large.search C7g.xlarge.search C7g.2xlarge.search C7g.4xlarge.search C7g.8xlarge.search C7g.12xlarge.search C7g.16xlarge.search M7g.large.search M7g.xlarge.search M7g.2xlarge.search M7g.4xlarge.search M7g.8xlarge.search M7g.12xlarge.search M7g.16xlarge.search R7g.medium.search R7g.large.search R7g.xlarge.search R7g.2xlarge.search R7g.4xlarge.search R7g.8xlarge.search R7g.12xlarge.search R7g.16xlarge.search R7gd.large.search R7gd.xlarge.search R7gd.2xlarge.search R7gd.4xlarge.search R7gd.8xlarge.search R7gd.12xlarge.search R7gd.16xlarge.search | Graviton3 only supports gp3 storage. @@ -44,28 +44,0 @@ Im4gn | `im4gn.large.search` `im4gn.xlarge.search` `im4gn.2xlarge.search` `im4g -C5 | `c5.large.search` `c5.xlarge.search` `c5.2xlarge.search` `c5.4xlarge.search` `c5.9xlarge.search` `c5.18xlarge.search` | The C5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. -C6g | `c6g.large.search` `c6g.xlarge.search` `c6g.2xlarge.search` `c6g.4xlarge.search` `c6g.8xlarge.search` `c6g.12xlarge.search` | - - * The C6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. - * C6g instances are only compatible with other Graviton instance types (Im4gn, M6g, R6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. - - -I3 | `i3.large.search` `i3.xlarge.search` `i3.2xlarge.search` `i3.4xlarge.search` `i3.8xlarge.search` `i3.16xlarge.search` | -M5 | `m5.large.search` `m5.xlarge.search` `m5.2xlarge.search` `m5.4xlarge.search` `m5.12xlarge.search` | The M5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. -M6g | `m6g.large.search` `m6g.xlarge.search` `m6g.2xlarge.search` `m6g.4xlarge.search` `m6g.8xlarge.search` `m6g.12xlarge.search` | - - * The M6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. - * M6g instances are only compatible with other Graviton instance types (Im4gn, C6g, R6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. - - -R5 | `r5.large.search` `r5.xlarge.search` `r5.2xlarge.search` `r5.4xlarge.search` `r5.12xlarge.search` | The R5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. -R6g | `r6g.large.search` `r6g.xlarge.search` `r6g.2xlarge.search` `r6g.4xlarge.search` `r6g.8xlarge.search` `r6g.12xlarge.search` | - - * The R6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. - * R6g instances are only compatible with other Graviton instance types (Im4gn, C6g, M6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. - - -R6gd | `r6gd.large.search` `r6gd.xlarge.search` `r6gd.2xlarge.search` `r6gd.4xlarge.search` `r6gd.8xlarge.search` `r6gd.12xlarge.search` `r6gd.16xlarge.search` | - - * The R6gd instance types require Elasticsearch 7.9 or later or any version of OpenSearch, and do not support EBS storage volumes. - * R6gd instances are only compatible with other Graviton instance types (Im4gn, C6g, M6g, R6g). You can't combine Graviton and non-Graviton instances in the same cluster. - - @@ -132,0 +106,29 @@ R4 | `r4.large.search` `r4.xlarge.search` `r4.2xlarge.search` `r4.4xlarge.searc +i4g | i4g.large.search i4g.xlarge.search i4g.2xlarge.search i4g.4xlarge.search i4g.8xlarge.search i4g.16xlarge.search | The i4g instance types require Elasticsearch 7.9 or later or any version of OpenSearch, and do not support EBS storage volumes. +C5 | `c5.large.search` `c5.xlarge.search` `c5.2xlarge.search` `c5.4xlarge.search` `c5.9xlarge.search` `c5.18xlarge.search` | The C5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. +C6g | `c6g.large.search` `c6g.xlarge.search` `c6g.2xlarge.search` `c6g.4xlarge.search` `c6g.8xlarge.search` `c6g.12xlarge.search` | + + * The C6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. + * C6g instances are only compatible with other Graviton instance types (Im4gn, M6g, R6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. + + +I3 | `i3.large.search` `i3.xlarge.search` `i3.2xlarge.search` `i3.4xlarge.search` `i3.8xlarge.search` `i3.16xlarge.search` | +M5 | `m5.large.search` `m5.xlarge.search` `m5.2xlarge.search` `m5.4xlarge.search` `m5.12xlarge.search` | The M5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. +M6g | `m6g.large.search` `m6g.xlarge.search` `m6g.2xlarge.search` `m6g.4xlarge.search` `m6g.8xlarge.search` `m6g.12xlarge.search` | + + * The M6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. + * M6g instances are only compatible with other Graviton instance types (Im4gn, C6g, R6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. + + +R5 | `r5.large.search` `r5.xlarge.search` `r5.2xlarge.search` `r5.4xlarge.search` `r5.12xlarge.search` | The R5 instance types require Elasticsearch 5.1 or later or any version of OpenSearch. +R6g | `r6g.large.search` `r6g.xlarge.search` `r6g.2xlarge.search` `r6g.4xlarge.search` `r6g.8xlarge.search` `r6g.12xlarge.search` | + + * The R6g instance types require Elasticsearch 7.9 or later or any version of OpenSearch. + * R6g instances are only compatible with other Graviton instance types (Im4gn, C6g, M6g, R6gd). You can't combine Graviton and non-Graviton instances in the same cluster. + + +R6gd | `r6gd.large.search` `r6gd.xlarge.search` `r6gd.2xlarge.search` `r6gd.4xlarge.search` `r6gd.8xlarge.search` `r6gd.12xlarge.search` `r6gd.16xlarge.search` | + + * The R6gd instance types require Elasticsearch 7.9 or later or any version of OpenSearch, and do not support EBS storage volumes. + * R6gd instances are only compatible with other Graviton instance types (Im4gn, C6g, M6g, R6g). You can't combine Graviton and non-Graviton instances in the same cluster. + +