AWS opensearch-service documentation change
Summary
Added 'Egress traffic from a VPC domain' error type and troubleshooting section
Security assessment
The change adds troubleshooting guidance for network connectivity issues related to VPC egress configuration. While network configuration impacts security posture, there's no evidence this addresses a specific vulnerability or security incident. The content focuses on routing, DNS resolution, and IP capacity issues without mentioning security controls or vulnerabilities.
Diff
diff --git a/opensearch-service/latest/developerguide/handling-errors.md b/opensearch-service/latest/developerguide/handling-errors.md index 1f1819121..54b413016 100644 --- a//opensearch-service/latest/developerguide/handling-errors.md +++ b//opensearch-service/latest/developerguide/handling-errors.md @@ -7 +7 @@ -Can't access OpenSearch DashboardsCan't access VPC domainCluster in read-only stateRed cluster statusYellow cluster statusClusterBlockExceptionError migrating to Multi-AZ with StandbyJVM OutOfMemoryErrorFailed cluster nodesExceeded maximum shard limitDomain stuck in processing stateLow EBS burst balanceEBS metric increases during volume resizingCan't enable audit logsCan't close indexClient license checksRequest throttlingCan't SSH into node"Not Valid for the Object's Storage Class" snapshot errorInvalid host headerInvalid M3 instance typeHot queries stop working after enabling UltraWarmCan't downgrade after upgradeNeed summary of domains for all AWS RegionsBrowser error when using OpenSearch DashboardsNode shard and storage skewIndex shard and storage skewUnauthorized operation after selecting VPC accessStuck at loading after creating VPC domainDenied requests to the OpenSearch APICan't connect from Alpine LinuxToo many requests for Search BackpressureCertificate error when using SDKCustom plugin installation fails due to version compatibility +Can't access OpenSearch DashboardsCan't access VPC domainEgress traffic from a VPC domainCluster in read-only stateRed cluster statusYellow cluster statusClusterBlockExceptionError migrating to Multi-AZ with StandbyJVM OutOfMemoryErrorFailed cluster nodesExceeded maximum shard limitDomain stuck in processing stateLow EBS burst balanceEBS metric increases during volume resizingCan't enable audit logsCan't close indexClient license checksRequest throttlingCan't SSH into node"Not Valid for the Object's Storage Class" snapshot errorInvalid host headerInvalid M3 instance typeHot queries stop working after enabling UltraWarmCan't downgrade after upgradeNeed summary of domains for all AWS RegionsBrowser error when using OpenSearch DashboardsNode shard and storage skewIndex shard and storage skewUnauthorized operation after selecting VPC accessStuck at loading after creating VPC domainDenied requests to the OpenSearch APICan't connect from Alpine LinuxToo many requests for Search BackpressureCertificate error when using SDKCustom plugin installation fails due to version compatibility @@ -25,0 +26,15 @@ See [About access policies on VPC domains](./vpc.html#vpc-security) and [Testing +## Egress traffic from a VPC domain + +If you enabled egress through your VPC on a domain and outbound integrations start failing, check the following: + + * An egress integration fails after you enable egress. Check your VPC routing to the destination and VPC resolver health. See [Troubleshooting](./vpc-egress.html#vpc-egress-troubleshoot). + + * Hostname resolution fails. Check your VPC DNS settings, private hosted zones, and Route 53 Resolver rules. + + * Not enough IP addresses in the subnet. Expand the subnet or use a dedicated subnet. See [Prerequisites](./vpc-egress.html#vpc-egress-prereqs). + + * The service-linked role is missing permissions. Recreate the service-linked role or attach the updated policy. See [Using service-linked roles for Amazon OpenSearch Service](./slr.html). + + + +