AWS opensearch-service documentation change
Summary
Added clarification about VPC endpoint behavior when stopping/starting pipelines, noting that service-managed VPC endpoints are removed and self-managed endpoints must be recreated.
Security assessment
This change adds important documentation about network security implications when stopping/starting pipelines. It clarifies that VPC endpoints (a security feature for private network access) are affected by pipeline operations, which could impact security posture if not properly managed. However, there is no evidence this addresses a specific security vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/pipeline--stop-start.md b/opensearch-service/latest/developerguide/pipeline--stop-start.md index 9c3b5246f..430f19b22 100644 --- a//opensearch-service/latest/developerguide/pipeline--stop-start.md +++ b//opensearch-service/latest/developerguide/pipeline--stop-start.md @@ -9 +9,3 @@ You can start and stop ingestion pipelines in Amazon OpenSearch Ingestion to con -Starting and stopping simplifies the setup and teardown processes for pipelines that you use for development, testing, or similar activities that don't require continuous availability. While your pipeline is stopped, you aren't charged for any Ingestion OCU hours. You can still update stopped pipelines, and they receive automatic minor version updates and security patches. Stopping and starting a pipeline will result in reprocessing all the data from the beginning for pull based pipelines (DDB, S3, DocDB, etc). +Starting and stopping simplifies the setup and teardown processes for pipelines that you use for development, testing, or similar activities that don't require continuous availability. While your pipeline is stopped, you aren't charged for any Ingestion OCU hours. You can still update stopped pipelines, and they receive automatic minor version updates and security patches. + +Stopping and starting a pipeline will result in reprocessing all the data from the beginning for pull based pipelines (DDB, S3, DocDB, etc). When you stop a pipeline, any service-managed VPC endpoints created by the pipeline are removed. For pipelines with self-managed VPC endpoints, you must recreate the VPC endpoint in your account when you restart the pipeline. For more information, see [Self-managed VPC endpoints](./pipeline-security.html#pipeline-vpc-self-managed).