AWS solutions high security documentation change
Summary
Updated publication date and added release notes for Migration Assistant versions 3.0.0 to 3.2.1 including new Solr migration support, memory optimizations, CDC pipelines, Kubernetes orchestration, security enhancements, and documentation refresh.
Security assessment
Explicit removal of insecure plaintext authentication and enforcement of TLS by default addresses a security weakness. The addition of mTLS authentication further enhances security. These changes mitigate risks of unauthorized access and data interception.
Diff
diff --git a/solutions/latest/migration-assistant-for-amazon-opensearch-service/revisions.md b/solutions/latest/migration-assistant-for-amazon-opensearch-service/revisions.md index 3370b015c..5a99e1eb7 100644 --- a//solutions/latest/migration-assistant-for-amazon-opensearch-service/revisions.md +++ b//solutions/latest/migration-assistant-for-amazon-opensearch-service/revisions.md @@ -9 +9,89 @@ -Publication date: _November 2023_ +Publication date: _May 15, 2026_ + +**Migration Assistant 3.0.0 to 3.2.1 — feature highlights** + +The following are the most impactful business-facing features introduced between Migration Assistant 3.0.0 and 3.2.1. + +**1\. Apache Solr migration support (new market)** + +You can now migrate from Apache Solr 6, 7, 8, and 9 to Amazon OpenSearch Service or Amazon OpenSearch Serverless — not just from Elasticsearch. Coverage includes: + + * Bulk data backfill from Solr snapshots, including multi-shard collections + + * Live query translation proxy so searches keep working during the migration + + * Full coverage of Solr query syntax: filters, facets, boosts, date math, fuzzy and wildcard queries, JSON request bodies, and delete operations + + + + +This opens Migration Assistant to an entirely new user base. Solr operators can now migrate to OpenSearch without rewriting their application layer. + +**2\. 9× memory reduction for large migrations (Reindex-from-Snapshot)** + +Reindex-from-Snapshot (RFS) now streams index data to disk instead of holding it in RAM. Previously, large indexes could exhaust worker memory and fail with out-of-memory errors. + +Migrations of indexes with 100 GB+ shards that previously failed now complete reliably without requiring oversized infrastructure. + +**3\. Zero-downtime change data capture (CDC) pipelines on Amazon EKS** + +Continuous data sync from source to target on a configurable schedule (down to 6-hour cycles), supporting Elasticsearch 5.x through 8.x with TLS, and Amazon OpenSearch Serverless. + +Customers can keep source and target in sync during the migration window, validate the target on production traffic, and cut over with confidence — without data loss. + +**4\. Kubernetes-native workflow orchestration (Migration Assistant 3.0 and later)** + +Migrations run as managed Argo Workflows on Amazon EKS with: + + * Automatic retries on transient failures + + * `workflow reset` and `workflow show` commands for safe lifecycle management + + * Pre-flight validation (credentials are checked before the workflow starts) + + * TLS by default on the workflow UI + + * Resilient three-broker Apache Kafka with anti-affinity scheduling + + + + +Production migrations are more reliable and observable. Operators can recover from transient failures without manual intervention. + +**5\. Secure-by-default networking** + + * The capture proxy defaults to TLS using cert-manager-issued self-signed certificates + + * Frontend mTLS (client-certificate) authentication is supported + + * The insecure plaintext authentication option has been removed entirely + + + + +Migration Assistant meets enterprise security requirements out of the box. TLS no longer requires opt-in configuration — it is on by default. + +**6\. Source reconstruction for indexes with`_source` disabled** + +If your source cluster stored indexes without the `_source` field (a common Elasticsearch storage optimization), Migration Assistant now reconstructs the source documents during migration. + +Indexes that previously could not be migrated at all are now supported. This unblocks customers who relied on the `_source` disabled optimization in Elasticsearch. + +**Migration Assistant 3.0 — May 2026 documentation refresh** + + * Aligned implementation guide with the latest Migration Assistant 3.0 documentation + + * Source matrix updated: Elasticsearch 1.x–2.x backfill-only, Apache Solr support expanded to versions 6.x–9.x, all sources can target Amazon OpenSearch Serverless + + * Self-contained Amazon EKS deployment instructions including bootstrap script flag reference, private/isolated network setup, and AWS Identity helpers + + * Dedicated Workflow CLI guide with sample target configurations for both Amazon OpenSearch Service and Amazon OpenSearch Serverless + + * Expanded troubleshooting coverage: pod startup, IRSA-based authentication, fine-grained access control role mapping (engine-specific API paths), Workflow CRD reset + + * Removed references to the GitHub wiki — the AWS implementation guide is now self-contained + + * Architecture refreshed with control-plane / data-plane framing, Workflow CLI, Argo Workflows, Strimzi-managed Apache Kafka, and Reindex-from-Snapshot + + + @@ -31,0 +120,2 @@ Visit [Releases](https://github.com/opensearch-project/opensearch-migrations/rel +Original publication date: _November 2023_ +