AWS Security ChangesHomeSearch

AWS opensearch-service medium security documentation change

Service: opensearch-service · 2026-05-16 · Security-related medium

File: opensearch-service/latest/developerguide/configure-client-docdb.md

Summary

Added requirement that CIDR block must use /24 prefix length when attaching pipeline to VPC

Security assessment

Enforcing smaller subnet sizes (/24) enhances network segmentation security by default, preventing accidental over-provisioning of network access that could lead to exposure vulnerabilities.

Diff

diff --git a/opensearch-service/latest/developerguide/configure-client-docdb.md b/opensearch-service/latest/developerguide/configure-client-docdb.md
index 568a84043..d7aa7105d 100644
--- a//opensearch-service/latest/developerguide/configure-client-docdb.md
+++ b//opensearch-service/latest/developerguide/configure-client-docdb.md
@@ -210 +210 @@ You can use a preconfigured Amazon DocumentDB blueprint to create this pipeline.
-If you're using the AWS Management Console to create your pipeline, you must also attach your pipeline to your VPC in order to use Amazon DocumentDB as a source. To do so, find the **Source network options** section, select the **Attach to VPC** checkbox, and choose your CIDR from one of the provided default options. You can use any CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918).
+If you're using the AWS Management Console to create your pipeline, you must also attach your pipeline to your VPC in order to use Amazon DocumentDB as a source. To do so, find the **Source network options** section, select the **Attach to VPC** checkbox, and choose your CIDR from one of the provided default options. The CIDR block must use a /24 prefix length. You can use any /24 CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918).