AWS IAM documentation change
Summary
Changed OpenSearch domain creation method from direct CLI commands to CloudFormation deployment. Removed manual status checking logic since CloudFormation handles waiting. Simplified endpoint retrieval and reduced fine-grained access control wait time from 8 to 2 minutes. Updated cleanup to delete CloudFormation stack.
Security assessment
The change replaces manual OpenSearch provisioning with CloudFormation but maintains equivalent security settings (encryption, HTTPS enforcement, access policies). No security vulnerabilities are mentioned or addressed. The wait time reduction for access control initialization doesn't indicate a security fix.
Diff
diff --git a/IAM/latest/UserGuide/sts_example_opensearch_GettingStarted_016_section.md b/IAM/latest/UserGuide/sts_example_opensearch_GettingStarted_016_section.md index 55d5441cd..5b5ebfb89 100644 --- a//IAM/latest/UserGuide/sts_example_opensearch_GettingStarted_016_section.md +++ b//IAM/latest/UserGuide/sts_example_opensearch_GettingStarted_016_section.md @@ -145,25 +145,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ACCESS_POLICY="{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::${ACCOUNT_ID}:root\"},\"Action\":[\"es:ESHttpGet\",\"es:ESHttpPut\",\"es:ESHttpPost\",\"es:ESHttpDelete\",\"es:ESHttpHead\"],\"Resource\":\"arn:aws:es:${AWS_REGION}:${ACCOUNT_ID}:domain/${DOMAIN_NAME}/*\"}]}" - - echo "Access policy created for region: $AWS_REGION" - echo "Access policy: [REDACTED]" - - # Create the domain (matches tutorial command exactly) - echo "Creating domain $DOMAIN_NAME..." - CREATE_OUTPUT=$(aws opensearch create-domain \ - --domain-name "$DOMAIN_NAME" \ - --engine-version "OpenSearch_2.11" \ - --cluster-config "InstanceType=t3.small.search,InstanceCount=1,ZoneAwarenessEnabled=false" \ - --ebs-options "EBSEnabled=true,VolumeType=gp3,VolumeSize=10" \ - --node-to-node-encryption-options "Enabled=true" \ - --encryption-at-rest-options "Enabled=true" \ - --domain-endpoint-options "EnforceHTTPS=true,TLSSecurityPolicy=Policy-Min-TLS-1-2-2019-07" \ - --advanced-security-options "Enabled=true,InternalUserDatabaseEnabled=true,MasterUserOptions={MasterUserName=$MASTER_USER,MasterUserPassword=$MASTER_PASSWORD}" \ - --access-policies "$ACCESS_POLICY" \ - --tags "Key=Environment,Value=Tutorial" "Key=Purpose,Value=OpenSearchGettingStarted" 2>&1) - - # Check if domain creation was successful - if [[ $? -ne 0 ]]; then - echo "Failed to create OpenSearch domain:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation failed" - fi + # Create the domain using CloudFormation (handles the 15-20 min creation wait) + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + STACK_NAME="tutorial-opensearch-${RANDOM_ID}" + + echo "Creating domain $DOMAIN_NAME via CloudFormation..." + echo "This typically takes 15-20 minutes. CloudFormation will wait for completion." + aws cloudformation deploy \ + --template-file "$SCRIPT_DIR/cfn-opensearch-domain.yaml" \ + --stack-name "$STACK_NAME" \ + --parameter-overrides \ + DomainName="$DOMAIN_NAME" \ + MasterUserName="$MASTER_USER" \ + MasterUserPassword="$MASTER_PASSWORD" \ + --tags project=doc-smith tutorial=opensearch-service-gs \ + --no-fail-on-empty-changeset 2>&1 || handle_error "CloudFormation stack creation failed" @@ -171,3 +160,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Verify the domain was actually created by checking the output - if echo "$CREATE_OUTPUT" | grep -q "DomainStatus"; then - echo "Domain creation initiated successfully." @@ -175,49 +162 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Domain creation output:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation may have failed - no DomainStatus in response" - fi - - # Wait for domain to become active (improved logic) - echo "Waiting for domain to become active..." - RETRY_COUNT=0 - MAX_RETRIES=45 # 45 minutes with 60 second intervals - - while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do - echo "Checking domain status... (attempt $((RETRY_COUNT+1))/$MAX_RETRIES)" - - # Get domain status - DOMAIN_STATUS=$(aws opensearch describe-domain --domain-name "$DOMAIN_NAME" 2>&1) - - if [[ $? -ne 0 ]]; then - echo "Error checking domain status:" - echo "$DOMAIN_STATUS" - - # If domain not found after several attempts, it likely failed to create - if [[ $RETRY_COUNT -gt 5 ]] && echo "$DOMAIN_STATUS" | grep -q "ResourceNotFoundException"; then - handle_error "Domain not found after multiple attempts. Domain creation likely failed." - fi - - echo "Will retry in 60 seconds..." - else - # Check if domain is no longer processing - if echo "$DOMAIN_STATUS" | grep -q '"Processing": false'; then - DOMAIN_ACTIVE=true - echo "Domain is now active!" - break - else - echo "Domain is still being created. Checking again in 60 seconds..." - fi - fi - - sleep 60 - RETRY_COUNT=$((RETRY_COUNT+1)) - done - - # Verify domain is active - if [[ "$DOMAIN_ACTIVE" != "true" ]]; then - echo "Domain creation is taking longer than expected ($((MAX_RETRIES)) minutes)." - echo "You can check the status later using:" - echo "aws opensearch describe-domain --domain-name $DOMAIN_NAME" - handle_error "Domain did not become active within the expected time" - fi + echo "Domain created successfully via CloudFormation." @@ -225,3 +164,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get domain endpoint (matches tutorial) - echo "Retrieving domain endpoint..." - DOMAIN_ENDPOINT=$(aws opensearch describe-domain --domain-name "$DOMAIN_NAME" --query 'DomainStatus.Endpoint' --output text) + # Get domain endpoint from stack outputs + DOMAIN_ENDPOINT=$(aws cloudformation describe-stacks \ + --stack-name "$STACK_NAME" \ + --query 'Stacks[0].Outputs[?OutputKey==`DomainEndpoint`].OutputValue' \ + --output text) @@ -229,2 +170,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ $? -ne 0 ]] || [[ -z "$DOMAIN_ENDPOINT" ]] || [[ "$DOMAIN_ENDPOINT" == "None" ]]; then - handle_error "Failed to get domain endpoint" + if [[ -z "$DOMAIN_ENDPOINT" ]] || [[ "$DOMAIN_ENDPOINT" == "None" ]]; then + handle_error "Failed to get domain endpoint from CloudFormation outputs" @@ -235,5 +176,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Wait additional time for fine-grained access control to be fully ready - echo "Domain is active, but waiting additional time for fine-grained access control to be fully ready..." - echo "Fine-grained access control can take several minutes to initialize after domain becomes active." - echo "Waiting 8 minutes for full initialization..." - sleep 480 # Wait 8 minutes for fine-grained access control to be ready + # Wait for fine-grained access control to be fully ready + echo "Waiting for fine-grained access control to initialize..." + sleep 120 @@ -567,7 +506,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws opensearch delete-domain --domain-name "$DOMAIN_NAME" - echo "✓ Cleanup initiated. Domain deletion may take several minutes to complete." - echo "" - echo "You can check the deletion status using:" - echo "aws opensearch describe-domain --domain-name $DOMAIN_NAME" - echo "" - echo "When deletion is complete, you'll see a 'Domain not found' error." + if [ -n "${STACK_NAME:-}" ]; then + echo "Deleting CloudFormation stack $STACK_NAME..." + aws cloudformation delete-stack --stack-name "$STACK_NAME" + echo "✓ Stack deletion initiated. This may take several minutes." + echo " Monitor: aws cloudformation describe-stacks --stack-name $STACK_NAME" + else + aws opensearch delete-domain --domain-name "$DOMAIN_NAME" 2>/dev/null + echo "✓ Domain deletion initiated." + fi @@ -577,2 +518,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "To delete the domain later, use:" - echo "aws opensearch delete-domain --domain-name $DOMAIN_NAME" + echo "To delete later:" + echo " aws cloudformation delete-stack --stack-name ${STACK_NAME:-tutorial-opensearch-XXXX}" @@ -581 +521,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo " Estimated cost: ~$0.038/hour (~$0.91/day)"