AWS opensearch-service medium security documentation change
Summary
Added IAM role mapping prerequisite for domains using fine-grained access control and restructured setup steps
Security assessment
Explicitly documents required IAM role mapping for secure ML model access when using fine-grained access control. Failure to configure this could lead to unauthorized access to ML capabilities. The change emphasizes proper permission configuration for security-sensitive operations.
Diff
diff --git a/opensearch-service/latest/developerguide/cfn-template-agentic-search.md b/opensearch-service/latest/developerguide/cfn-template-agentic-search.md index 79de9e610..b15257cc4 100644 --- a//opensearch-service/latest/developerguide/cfn-template-agentic-search.md +++ b//opensearch-service/latest/developerguide/cfn-template-agentic-search.md @@ -15 +15 @@ Follow the steps below to open and run a CloudFormation template that automatica - 1. Open the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). + 1. **Prerequisite:** If your domain uses fine-grained access control, map `arn:aws:iam::`your-account-id`:role/`LambdaInvokeOpenSearchMLCommonsRole`` as a backend role to the `ml_full_access` role before running the template. This IAM role will be created automatically by CloudFormation if it doesn't already exist. For more information on how to configure the mapping, see [Map the ML role in OpenSearch Dashboards (if using fine-grained access control)](./ml-external-connector.html#connector-external-fgac). @@ -17 +17 @@ Follow the steps below to open and run a CloudFormation template that automatica - 2. In the left navigation, choose **Integrations**. + 2. Open the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/home](https://console.aws.amazon.com/aos/home). @@ -19 +19 @@ Follow the steps below to open and run a CloudFormation template that automatica - 3. Under **Integration with Bedrock Claude for Agentic Search** , choose **Configure domain**. Ensure your domain is on version 3.3 or greater. + 3. In the left navigation, choose **Integrations**. @@ -21 +21 @@ Follow the steps below to open and run a CloudFormation template that automatica - 4. Follow the prompt to set up your model. Note the IAM role specified in the Lambda Invoke OpenSearch ML Commons Role Name field in the CloudFormation template, defaulted to `LambdaInvokeOpenSearchMLCommonsRole`. Ensure this full role ARN is mapped as the backend role to `ml_full_access` before proceeding with the template provisioning. For more details, see [Map the ML role in OpenSearch Dashboards (if using fine-grained access control)](./ml-external-connector.html#connector-external-fgac). Then, click **Create Stack** and wait for the provisioning to complete to make your model available for your domain. + 4. Under **Integration with Bedrock Claude for Agentic Search** , choose **Configure domain**. Ensure your domain is on version 3.3 or greater. @@ -23 +23,3 @@ Follow the steps below to open and run a CloudFormation template that automatica - 5. From the Amazon OpenSearch Service console, select **Domains** , and select your domain. Click the **OpenSearch Dashboards URL** to access OpenSearch Dashboards. + 5. In the CloudFormation template, enter your OpenSearch Service domain endpoint and select a model. The remaining fields are optional or pre-filled. Click **Create Stack** and wait for the provisioning to complete. + + 6. From the Amazon OpenSearch Service console, select **Domains** , and select your domain. Click the **OpenSearch Dashboards URL** to access OpenSearch Dashboards.