AWS opensearch-service high security documentation change
Summary
Added warning about manual Cognito App Client modifications being overwritten
Security assessment
Explicit security warning about authentication misconfiguration risks. Highlights that manual changes to identity providers could be overwritten during upgrades/modifications, potentially creating authentication gaps or unintended access.
Diff
diff --git a/opensearch-service/latest/developerguide/cognito-auth.md b/opensearch-service/latest/developerguide/cognito-auth.md index 8a23f09a4..f04149812 100644 --- a//opensearch-service/latest/developerguide/cognito-auth.md +++ b//opensearch-service/latest/developerguide/cognito-auth.md @@ -100,0 +101,4 @@ OpenSearch Service needs permissions to configure the Amazon Cognito user and id +###### Important + +Do not manually modify the Amazon Cognito App Client settings (such as adding additional identity providers) after enabling Amazon Cognito authentication for your domain. Amazon OpenSearch Service may overwrite manual App Client changes when you modify Amazon Cognito options on the domain or during Elasticsearch-to-OpenSearch upgrades. To preserve custom App Client configurations, apply them after each domain modification. +