AWS opensearch-service documentation change
Summary
Restructured documentation to separate data plane and control plane AWS PrivateLink access. Removed detailed VPC endpoint creation instructions and example policies. Added clarification about DNS resolution and security recommendations.
Security assessment
The changes improve clarity about security best practices (e.g., discouraging VPC peering for cross-account access, emphasizing separate VPC endpoints per account) and better differentiate between data/control plane security. However, there's no direct evidence of addressing a specific vulnerability. Security documentation is enhanced through clearer guidance about network isolation and access policies.
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-vpc.md b/opensearch-service/latest/developerguide/serverless-vpc.md index a55cb9c1e..ca02aa8f8 100644 --- a//opensearch-service/latest/developerguide/serverless-vpc.md +++ b//opensearch-service/latest/developerguide/serverless-vpc.md @@ -5 +5 @@ -Creating Collection/Policies using PrivateLinkDNS resolution of collection endpointsVPCs and network access policiesVPCs and endpoint policiesConsiderationsPermissions requiredCreate an interface endpointShared VPC setup for Amazon OpenSearch Serverless +DNS resolution of collection endpointsVPCs and network access policiesVPCs and endpoint policiesConsiderationsPermissions requiredCreate an interface endpointShared VPC setup for Amazon OpenSearch Serverless @@ -7 +7,3 @@ Creating Collection/Policies using PrivateLinkDNS resolution of collection endpo -# Access Amazon OpenSearch Serverless using an interface endpoint (AWS PrivateLink) +# Data plane access through AWS PrivateLink + +Amazon OpenSearch Serverless supports two types of AWS PrivateLink connections for control plane and data plane operations. Control plane operations include the creation and deletion of collections and the management of access policies. Data plane operations are for indexing and querying data within a collection. This page covers data plane VPC endpoints. For information about control plane AWS PrivateLink endpoints, see [Control plane access through AWS PrivateLink](./serverless-vpc-cp.html). @@ -17,2 +18,0 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Creating Collection/Policies using PrivateLink - @@ -36,101 +35,0 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// -## Creating Collection/Policies using PrivateLink - -You can improve the security posture of your VPC by configuring OpenSearch Serverless to use an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink. This technology enables you to privately access OpenSearch Serverless APIs without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. - -For more information about AWS PrivateLink and VPC endpoints, see [VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html#concepts-vpc-endpoints) in the Amazon VPC User Guide. - -### Considerations - - * VPC endpoints are supported within the same Region only. - - * VPC endpoints only support Amazon-provided DNS through Amazon Route 53. - - * VPC endpoints support endpoint policies to control access to OpenSearch Serverless Collections, Policies and VpcEndpoints. - - * OpenSearch Serverless supports interface endpoints only. Gateway endpoints are not supported. - - - - -### Creating the VPC endpoint for OpenSearch Serverless - -To create the VPC endpoint for Amazon OpenSearch Serverless, use the [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint) procedure in the _Amazon VPC Developer Guide_. Create the following endpoint: - - * `com.amazonaws.region.aoss` - - - - -To create a VPC endpoint using the console - - * Open the Amazon VPC console at https://console.aws.amazon.com/vpc/. - - * In the navigation pane, choose Endpoints. - - * Choose Create Endpoint. - - * For Service category, choose AWS services. - - * For Services, choose `com.amazonaws.<region>.aoss`. Example: `com.amazonaws.us-east-1.aoss` - - * For VPC, choose the VPC in which to create the endpoint. - - * For Subnets, choose the subnets (Availability Zones) in which to create the endpoint network interfaces. - - * For Security groups, choose the security groups to associate with the endpoint network interfaces. Ensure HTTPS (port 443) is allowed. - - * For Policy, choose Full access to allow all operations, or choose Custom to attach a custom policy. - - * Choose Create endpoint. - - - - -### Creating an endpoint policy for your VPC endpoint - -You can attach an endpoint policy to your VPC endpoint that controls access to Amazon OpenSearch Serverless. The policy specifies the following information: - - * The principal that can perform actions. - - * The actions that can be performed. - - * The resources on which actions can be performed. - - - - -For more information, see [Controlling access to services with VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) in the _Amazon VPC User Guide_. - -Example: VPC endpoint policy for OpenSearch Serverless - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": "*", - "Action": [ - "aoss:ListCollections", - "aoss:BatchGetCollection" - ], - "Resource": "*" - } - ] - } - -Example: Restrictive policy allowing only list operations - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": "*", - "Action": "aoss:ListCollections", - "Resource": "*" - } - ] - } - @@ -139 +38 @@ Example: Restrictive policy allowing only list operations -When you create a VPC endpoint, the service creates a new Amazon Route 53 [private hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) and attaches it to the VPC. This private hosted zone consists of a record to resolve the wildcard DNS record for OpenSearch Serverless collections (`*.aoss.us-east-1.amazonaws.com`) to the interface addresses used for the endpoint. You only need one OpenSearch Serverless VPC endpoint in a VPC to access any and all collections and Dashboards in each AWS Region. Every VPC with an endpoint for OpenSearch Serverless has its own private hosted zone attached. +When you create a data plane VPC endpoint through the OpenSearch Serverless console, the service creates a new Amazon Route 53 [private hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) and attaches it to the VPC. This private hosted zone consists of a record to resolve the wildcard DNS record for OpenSearch Serverless collections (`*.aoss.us-east-1.amazonaws.com`) to the interface addresses used for the endpoint. You only need one OpenSearch Serverless VPC endpoint in a VPC to access any and all collections and Dashboards in each AWS Region. Every VPC with an endpoint for OpenSearch Serverless has its own private hosted zone attached. @@ -141 +40 @@ When you create a VPC endpoint, the service creates a new Amazon Route 53 [priva -OpenSearch Serverless also creates a public Route 53 wildcard DNS record for all collections in the Region. The DNS name resolves to the OpenSearch Serverless public IP addresses. Clients in VPCs that don't have an OpenSearch Serverless VPC endpoint or clients in public networks can use the public Route 53 resolver and access the collections and Dashboards with those IP addresses. The IP address type (IPv4, IPv6, or Dualstack) of VPC endpoint is determined based on the subnets provided when you [Create an interface endpoint for OpenSearch Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-vpc.html#serverless-vpc-create). +OpenSearch Serverless also creates a public Route 53 wildcard DNS record for all collections in the Region. The DNS name resolves to the OpenSearch Serverless public IP addresses. Clients in VPCs that don't have an OpenSearch Serverless VPC endpoint or clients in public networks can use the public Route 53 resolver and access the collections and Dashboards with those IP addresses. The IP address type (IPv4, IPv6, or Dualstack) of VPC endpoint is determined based on the subnets provided when you create an interface endpoint for OpenSearch Serverless. @@ -153 +52 @@ To grant network permission to OpenSearch APIs and Dashboards for your collectio -Since you can specify multiple VPC endpoint IDs in a network policy, we recommend that you create a VPC endpoint for every VPC that needs to access a collection. These VPCs can belong to different AWS accounts than the account that owns the OpenSearch Serverless collection and network policy. We don’t recommend that you create a VPC-to-VPC peering or other proxying solution between two accounts so that one account's VPC can use another account's VPC endpoint. This is less secure and cost effective than each VPC having its own endpoint. The first VPC will not be easily visible to the other VPC’s admin, who has set up access to that VPC's endpoint in the network policy. +Since you can specify multiple VPC endpoint IDs in a network policy, we recommend that you create a VPC endpoint for every VPC that needs to access a collection. These VPCs can belong to different AWS accounts than the account that owns the OpenSearch Serverless collection and network policy. We don't recommend that you create a VPC-to-VPC peering or other proxying solution between two accounts so that one account's VPC can use another account's VPC endpoint. This is less secure and cost effective than each VPC having its own endpoint. The first VPC will not be easily visible to the other VPC's admin, who has set up access to that VPC's endpoint in the network policy. @@ -159 +58 @@ Amazon OpenSearch Serverless supports endpoint policies for VPCs. An endpoint po -To use an endpoint policy, you must first create an interface endpoint. You can create an interface endpoint using either the OpenSearch Serverless console or the OpenSearch Serverless API. After you create your interface endpoint, you will need to add the endpoint policy to the endpoint. For more information, see [Access Amazon OpenSearch Serverless using an interface endpoint (AWS PrivateLink)](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-vpc.html#serverless-vpc-creat). +To use an endpoint policy, you must first create an interface endpoint. You can create an interface endpoint using either the OpenSearch Serverless console or the OpenSearch Serverless API. After you create your interface endpoint, you will need to add the endpoint policy to the endpoint. For more information, see Create an interface endpoint for OpenSearch Serverless. @@ -363 +262 @@ Before you set up an interface endpoint for OpenSearch Serverless, consider the - * If you enable public internet access to your collection’s API or Dashboards in a network policy, your collection is accessible by any VPC and by the public internet. + * If you enable public internet access to your collection's API or Dashboards in a network policy, your collection is accessible by any VPC and by the public internet. @@ -456 +355 @@ You can create an interface endpoint for OpenSearch Serverless using either the - 7. For **Security groups** , select the security groups to associate with the endpoint network interfaces. This is a critical step where you limit the ports, protocols, and sources for inbound traffic that you’re authorizing into your endpoint. Make sure that the security group rules allow the resources that will use the VPC endpoint to communicate with OpenSearch Serverless to communicate with the endpoint network interface. + 7. For **Security groups** , select the security groups to associate with the endpoint network interfaces. This is a critical step where you limit the ports, protocols, and sources for inbound traffic that you're authorizing into your endpoint. Make sure that the security group rules allow the resources that will use the VPC endpoint to communicate with OpenSearch Serverless to communicate with the endpoint network interface. @@ -475 +374 @@ You can use Amazon Virtual Private Cloud (VPC) to share VPC subnets with other A -Currently, Amazon OpenSearch Serverless doesn’t support creating an AWS PrivateLink connection into a shared VPC unless you are an owner of that VPC. AWS PrivateLink also doesn’t support sharing connections between AWS accounts. +Currently, Amazon OpenSearch Serverless doesn't support creating an AWS PrivateLink connection into a shared VPC unless you are an owner of that VPC. AWS PrivateLink also doesn't support sharing connections between AWS accounts. @@ -544 +443 @@ Data access control -SAML authentication +Control plane VPC endpoint