AWS opensearch-service documentation change
Summary
Added 'Egress traffic options' section and updated limitations for VPC domains
Security assessment
The change documents a networking feature (VPC egress routing) but doesn't present it as a security feature. The added content describes traffic routing behavior and architectural considerations without addressing vulnerabilities, access controls, or security policies. The note about VPC dependencies relates to operational reliability, not security mechanisms.
Diff
diff --git a/opensearch-service/latest/developerguide/vpc.md b/opensearch-service/latest/developerguide/vpc.md index a18f2b716..3ca1ddcaf 100644 --- a//opensearch-service/latest/developerguide/vpc.md +++ b//opensearch-service/latest/developerguide/vpc.md @@ -7 +7 @@ -VPC versus public domainsLimitationsArchitecture +VPC versus public domainsLimitationsArchitectureEgress traffic options @@ -47,0 +48,2 @@ Operating an OpenSearch Service domain within a VPC has the following limitation + * If you enable egress through your VPC, your domain's egress traffic depends on your VPC's DNS and network controls. Plan subnet IP capacity accordingly. See [Limits and considerations](./vpc-egress.html#vpc-egress-limits). + @@ -197,0 +200,4 @@ For full information on this role's permissions and how to delete it, see [Using +## Egress traffic options + +By default, a VPC domain accepts ingress from your VPC. Egress traffic from the domain, such as traffic to custom endpoints you configure on the domain, leaves over the public internet. If your workload requires that egress traffic flow through your own VPC instead, enable the egress option on your domain. For more information, see [Routing domain egress traffic through your VPC](./vpc-egress.html). + @@ -206 +212 @@ Configuring a multi-AZ domain -Creating index snapshots +Routing domain egress traffic through your VPC