AWS cli documentation change

Service: cli · 2026-03-22 · Documentation low

File: cli/latest/reference/opensearch/add-direct-query-data-source.md

Summary

Added Prometheus as a supported data source type for direct queries, including IAM role requirements and ARN constraints. Made --open-search-arns parameter optional with clarified requirements.

Security assessment

The change adds documentation about required IAM roles (security controls) and ARN validation patterns for Prometheus integration, but does not address any specific vulnerability. The security-related aspects are part of normal feature documentation rather than patching a security issue.

Diff

diff --git a/cli/latest/reference/opensearch/add-direct-query-data-source.md b/cli/latest/reference/opensearch/add-direct-query-data-source.md
index ee1f847e8..58ccbe551 100644
--- a//cli/latest/reference/opensearch/add-direct-query-data-source.md
+++ b//cli/latest/reference/opensearch/add-direct-query-data-source.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.12 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.14 Command Reference](../../index.html) »
@@ -70 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
-    --open-search-arns <value>
+    [--open-search-arns <value>]
@@ -116 +116 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
-> This is a Tagged Union structure. Only one of the following top level keys can be set: `CloudWatchLog`, `SecurityLake`.
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `CloudWatchLog`, `SecurityLake`, `Prometheus`.
@@ -148,0 +149,26 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
+> 
+> Prometheus -> (structure)
+>
+>> Specifies Prometheus as a type of data source for direct queries.
+>> 
+>> RoleArn -> (string) [required]
+>>
+>>> The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `32`
+>>>   * max: `200`
+>>>   * pattern: `^arn:aws[a-zA-Z-]*:iam::\d{12}:role(\/service-role)?\/[A-Za-z0-9+=,.@\-_]{1,64}$`
+>>> 
+
+>> 
+>> WorkspaceArn -> (string) [required]
+>>
+>>> The unique identifier of the Amazon Managed Prometheus Workspace that is associated with the specified data source.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `^arn:aws[a-zA-Z-]*:aps:[a-z0-9-]+:[0-9]{12}:workspace\/ws-[a-z0-9-]*$`
+>>> 
+
@@ -153 +179 @@ Shorthand Syntax:
-    CloudWatchLog={RoleArn=string},SecurityLake={RoleArn=string}
+    CloudWatchLog={RoleArn=string},SecurityLake={RoleArn=string},Prometheus={RoleArn=string,WorkspaceArn=string}
@@ -164,0 +191,4 @@ JSON Syntax:
+      },
+      "Prometheus": {
+        "RoleArn": "string",
+        "WorkspaceArn": "string"
@@ -180 +210 @@ JSON Syntax:
-`--open-search-arns` (list) [required]
+`--open-search-arns` (list)
@@ -182 +212 @@ JSON Syntax:
-> A list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source.
+> An optional list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source. This field is required for CloudWatchLogs and SecurityLake datasource types.
@@ -391 +421 @@ DataSourceArn -> (string)
-  * [AWS CLI 2.34.12 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.14 Command Reference](../../index.html) »