AWS opensearch-service documentation change
Summary
Updated the wildcard DNS record format from '*.aoss.us-east-1.amazonaws.com' to '*.us-east-1.aoss.amazonaws.com' and clarified that the interface endpoint creates the public Route 53 wildcard DNS record.
Security assessment
This change corrects the DNS record pattern and provides clarification on endpoint creation. While VPC endpoints are a network security feature, the update is a documentation correction for accuracy and does not indicate a security issue. It ensures users have the correct DNS information for configuring private access.
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-vpc.md b/opensearch-service/latest/developerguide/serverless-vpc.md index ca02aa8f8..a7ff70004 100644 --- a//opensearch-service/latest/developerguide/serverless-vpc.md +++ b//opensearch-service/latest/developerguide/serverless-vpc.md @@ -38 +38 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// -When you create a data plane VPC endpoint through the OpenSearch Serverless console, the service creates a new Amazon Route 53 [private hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) and attaches it to the VPC. This private hosted zone consists of a record to resolve the wildcard DNS record for OpenSearch Serverless collections (`*.aoss.us-east-1.amazonaws.com`) to the interface addresses used for the endpoint. You only need one OpenSearch Serverless VPC endpoint in a VPC to access any and all collections and Dashboards in each AWS Region. Every VPC with an endpoint for OpenSearch Serverless has its own private hosted zone attached. +When you create a data plane VPC endpoint through the OpenSearch Serverless console, the service creates a new Amazon Route 53 [private hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) and attaches it to the VPC. This private hosted zone consists of a record to resolve the wildcard DNS record for OpenSearch Serverless collections (`*.us-east-1.aoss.amazonaws.com`) to the interface addresses used for the endpoint. You only need one OpenSearch Serverless VPC endpoint in a VPC to access any and all collections and Dashboards in each AWS Region. Every VPC with an endpoint for OpenSearch Serverless has its own private hosted zone attached. @@ -40 +40 @@ When you create a data plane VPC endpoint through the OpenSearch Serverless cons -OpenSearch Serverless also creates a public Route 53 wildcard DNS record for all collections in the Region. The DNS name resolves to the OpenSearch Serverless public IP addresses. Clients in VPCs that don't have an OpenSearch Serverless VPC endpoint or clients in public networks can use the public Route 53 resolver and access the collections and Dashboards with those IP addresses. The IP address type (IPv4, IPv6, or Dualstack) of VPC endpoint is determined based on the subnets provided when you create an interface endpoint for OpenSearch Serverless. +The OpenSearch Serverless interface endpoint also creates a public Route 53 wildcard DNS record for all collections in the Region. The DNS name resolves to the OpenSearch Serverless public IP addresses. Clients in VPCs that don't have an OpenSearch Serverless VPC endpoint or clients in public networks can use the public Route 53 resolver and access the collections and Dashboards with those IP addresses. The IP address type (IPv4, IPv6, or Dualstack) of VPC endpoint is determined based on the subnets provided when you create an interface endpoint for OpenSearch Serverless.