AWS opensearch-service high security documentation change
Summary
Added documentation about enforcing HTTPS using aws:SecureTransport IAM condition key
Security assessment
The change explicitly adds security documentation about enforcing encrypted transport (HTTPS) to prevent man-in-the-middle attacks. The added condition key 'aws:SecureTransport' is a security control that mitigates data interception risks.
Diff
diff --git a/opensearch-service/latest/developerguide/serverless-data-access.md b/opensearch-service/latest/developerguide/serverless-data-access.md index e574e4597..6197d1d64 100644 --- a//opensearch-service/latest/developerguide/serverless-data-access.md +++ b//opensearch-service/latest/developerguide/serverless-data-access.md @@ -91 +91,4 @@ Being granted permissions within a data access policy is not sufficient to acces -Data access control for OpenSearch Serverless uses the following IAM permissions. You can specify IAM conditions to restrict users to specific access policy names. +Data access control for OpenSearch Serverless uses the following IAM permissions. You can specify IAM conditions to restrict users to specific access policy names. Amazon OpenSearch Service also supports global IAM condition keys in resource-based access policies, including `aws:SecureTransport`. You can use `aws:SecureTransport` to require that requests to your domain be made over HTTPS. For example: + + + "Condition": {"Bool": {"aws:SecureTransport": "true"}}