AWS opensearch-service documentation change
Summary
Updated OpenSearch Serverless tutorial with editorial changes, clarified security policy instructions, added UI configuration step during collection creation, and included note about Classic vs NextGen collection flows.
Security assessment
The changes are primarily editorial improvements and UI updates without addressing security vulnerabilities. Modifications emphasize existing security best practices like least privilege but don't introduce new security concepts. The added collection creation step relates to UI configuration, not security functionality.
Diff
diff --git a/opensearch-service/latest/developerguide/gsg-serverless.md b/opensearch-service/latest/developerguide/gsg-serverless.md index 524e51eda..336fc1d1e 100644 --- a//opensearch-service/latest/developerguide/gsg-serverless.md +++ b//opensearch-service/latest/developerguide/gsg-serverless.md @@ -11 +11 @@ Step 1: Configure permissionsStep 2: Create an encryption policyStep 3: Create a -This tutorial walks you through the basic steps to create and manage security policies using the Amazon OpenSearch Serverless console. +In this tutorial, you create and manage security policies using the Amazon OpenSearch Serverless console. @@ -13 +13 @@ This tutorial walks you through the basic steps to create and manage security po -You will complete the following steps in this tutorial: +You complete the following steps in this tutorial: @@ -30 +30 @@ You will complete the following steps in this tutorial: -This tutorial walks you through setting up a collection using the AWS Management Console. For the same steps using the AWS CLI, see [Tutorial: Getting started with security in Amazon OpenSearch Serverless (CLI)](./gsg-serverless-cli.html). +This tutorial shows you how to set up a collection using the AWS Management Console. For the same steps using the AWS CLI, see [Tutorial: Getting started with security in Amazon OpenSearch Serverless (CLI)](./gsg-serverless-cli.html). @@ -36 +36 @@ This tutorial walks you through setting up a collection using the AWS Management -You can skip this step if you're already using a more broad identity-based policy, such as `Action":"aoss:*"` or `Action":"*"`. In production environments, however, we recommend that you follow the principal of least privilege and only assign the minimum permissions necessary to complete a task. +You can skip this step if you're already using a more broad identity-based policy, such as `Action":"aoss:*"` or `Action":"*"`. In production environments, however, follow the principle of least privilege and only assign the minimum permissions necessary to complete a task. @@ -38 +38 @@ You can skip this step if you're already using a more broad identity-based polic -In order to complete this tutorial, you must have the correct IAM permissions. Your user or role must have an attached [identity-based policy](./security-iam-serverless.html#security-iam-serverless-id-based-policies) with the following minimum permissions: +To complete this tutorial, you must have the correct IAM permissions. Your user or role must have an attached [identity-based policy](./security-iam-serverless.html#security-iam-serverless-id-based-policies) with the following minimum permissions: @@ -73 +73 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M -[Encryption policies](./serverless-encryption.html) specify the AWS KMS key that OpenSearch Serverless will use to encrypt the collection. You can encrypt collections with an AWS managed key or a different key. For simplicity in this tutorial, we'll encrypt our collection with an AWS managed key. +[Encryption policies](./serverless-encryption.html) specify the AWS KMS key that OpenSearch Serverless uses to encrypt the collection. You can encrypt collections with an AWS managed key or a different key. For simplicity in this tutorial, you encrypt your collection with an AWS managed key. @@ -83 +83 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 4. Name the policy **books-policy**. For the description, enter **Encryption policy for books collection**. + 4. Name the policy `books-policy`. For the description, enter `Encryption policy for books collection`. @@ -85 +85 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 5. Under **Resources** , enter **books** , which is what you'll name your collection. If you wanted to be more broad, you could include an asterisk (`books*`) to make the policy apply to all collections beginning with the word "books". + 5. Under **Resources** , enter `books`, which is what you name your collection. If you want to be more broad, you can include an asterisk (`books*`) to make the policy apply to all collections beginning with the word "books". @@ -96 +96 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M -[Network policies](./serverless-network.html) determine whether your collection is accessible over the internet from public networks, or whether it must be accessed through OpenSearch Serverless–managed VPC endpoints. In this tutorial, we'll configure public access. +[Network policies](./serverless-network.html) determine whether your collection is accessible over the internet from public networks, or whether it must be accessed through OpenSearch Serverless–managed VPC endpoints. In this tutorial, you configure public access. @@ -102 +102 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 2. Name the policy **books-policy**. For the description, enter **Network policy for books collection**. + 2. Name the policy `books-policy`. For the description, enter `Network policy for books collection`. @@ -104 +104 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 3. Under **Rule 1** , name the rule **Public access for books collection**. + 3. Under **Rule 1** , name the rule `Public access for books collection`. @@ -106 +106 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 4. For simplicity in this tutorial, we'll configure public access for the _books_ collection. For the access type, select **Public**. + 4. For simplicity in this tutorial, configure public access for the _books_ collection. For the access type, select **Public**. @@ -108 +108 @@ For a full list of OpenSearch Serverless permissions, see [Identity and Access M - 5. We're going to access the collection from OpenSearch Dashboards. In order to do this, you need to configure network access for Dashboards _and_ the OpenSearch endpoint, otherwise Dashboards won't function. + 5. You access the collection from OpenSearch Dashboards. To do this, you need to configure network access for Dashboards _and_ the OpenSearch endpoint, otherwise Dashboards won't function. @@ -112 +112 @@ For the resource type, enable both **Access to OpenSearch endpoints** and **Acce - 6. In both input boxes, enter **Collection Name = books**. This setting scopes the policy down so that it only applies to a single collection (`books`). Your rule should look like this: + 6. In both input boxes, enter `Collection Name = books`. This setting scopes the policy down so that it only applies to a single collection (`books`). Your rule should look like this: @@ -123 +123 @@ For the resource type, enable both **Access to OpenSearch endpoints** and **Acce -Your collection data won't be accessible until you configure data access. [Data access policies](./serverless-data-access.html) are separate from the IAM identity-based policy that you configured in step 1. They allow users to access the actual data within a collection. +You can't access your collection data until you configure data access. [Data access policies](./serverless-data-access.html) are separate from the IAM identity-based policy that you configured in step 1. They allow users to access the actual data within a collection. @@ -125 +125 @@ Your collection data won't be accessible until you configure data access. [Data -In this tutorial, we'll provide a single user the permissions required to index data into the _books_ collection. +In this tutorial, you provide a single user the permissions required to index data into the _books_ collection. @@ -131 +131 @@ In this tutorial, we'll provide a single user the permissions required to index - 2. Name the policy **books-policy**. For the description, enter **Data access policy for books collection**. + 2. Name the policy `books-policy`. For the description, enter `Data access policy for books collection`. @@ -135 +135 @@ In this tutorial, we'll provide a single user the permissions required to index -Replace the principal ARN with the ARN of the account that you'll use to log in to OpenSearch Dashboards and index data. +Replace the principal ARN with the ARN of the account that you use to log in to OpenSearch Dashboards and index data. @@ -170 +170 @@ This policy provides a single user the minimum permissions required to create an -Now that you configured encryption and network policies, you can create a matching collection and the security settings will be automatically applied to it. +Now that you configured encryption and network policies, you can create a collection that matches them. OpenSearch Serverless automatically applies the security settings. @@ -176 +176 @@ Now that you configured encryption and network policies, you can create a matchi - 2. Name the collection **books**. + 2. In the **Serverless generation** field, choose **Switch to Classic** if not already on Classic. @@ -178 +178 @@ Now that you configured encryption and network policies, you can create a matchi - 3. For collection type, choose **Search**. + 3. For the collection name, enter `books`. @@ -180 +180 @@ Now that you configured encryption and network policies, you can create a matchi - 4. Under **Encryption** , OpenSearch Serverless informs you that the collection name matches the `books-policy` encryption policy. + 4. For collection type, choose **Search**. @@ -182 +182 @@ Now that you configured encryption and network policies, you can create a matchi - 5. Under **Network access settings** , OpenSearch Serverless informs you that the collection name matches the `books-policy` network policy. + 5. Under **Encryption** , OpenSearch Serverless informs you that the collection name matches the `books-policy` encryption policy. @@ -184 +184 @@ Now that you configured encryption and network policies, you can create a matchi - 6. Choose **Next**. + 6. Under **Network access settings** , OpenSearch Serverless informs you that the collection name matches the `books-policy` network policy. @@ -186 +186 @@ Now that you configured encryption and network policies, you can create a matchi - 7. Under **Data access policy options** , OpenSearch Serverless informs you that the collection name matches the `books-policy` data access policy. + 7. Choose **Next**. @@ -188 +188 @@ Now that you configured encryption and network policies, you can create a matchi - 8. Choose **Next**. + 8. Under **Data access policy options** , OpenSearch Serverless informs you that the collection name matches the `books-policy` data access policy. @@ -190 +190 @@ Now that you configured encryption and network policies, you can create a matchi - 9. Review the collection configuration and choose **Submit**. Collections typically take less than a minute to initialize. + 9. Choose **Next**. @@ -191,0 +192 @@ Now that you configured encryption and network policies, you can create a matchi + 10. Under **Configure OpenSearch UI** , configure the OpenSearch application and workspace for your collection. Choose **Select existing OpenSearch application** or **Create new OpenSearch application** , and select or create a workspace. Choose **Next**. @@ -192,0 +194 @@ Now that you configured encryption and network policies, you can create a matchi + 11. Review the collection configuration and choose **Submit**. Collections typically take less than a minute to initialize. @@ -194,0 +197,6 @@ Now that you configured encryption and network policies, you can create a matchi + + +###### Note + +This tutorial uses the Classic collection creation flow to demonstrate how pre-configured security policies are automatically matched during collection creation. For information about creating collections using the NextGen flow, see [Creating collections](./serverless-create.html). +