AWS opensearch-service documentation change
Summary
Modified IAM policy example by removing wildcard from resource ARN (changed from 'domain/domain-name/*' to 'domain/domain-name')
Security assessment
This change improves security documentation by demonstrating the principle of least privilege in IAM policies. Removing the wildcard restricts permissions to the domain resource only, rather than all sub-resources. This is a security best practice update but doesn't address a specific security vulnerability.
Diff
diff --git a/opensearch-service/latest/developerguide/opensearch-semantic-enrichment.md b/opensearch-service/latest/developerguide/opensearch-semantic-enrichment.md index 6abb347c4..b338a17df 100644 --- a//opensearch-service/latest/developerguide/opensearch-semantic-enrichment.md +++ b//opensearch-service/latest/developerguide/opensearch-semantic-enrichment.md @@ -193 +193 @@ The following sample identity-based access policy provides the permissions neces - "Resource": "arn:aws:es:aws-region:111122223333:domain/domain-name/*" + "Resource": "arn:aws:es:aws-region:111122223333:domain/domain-name"