AWS solutions documentation change
Summary
Updated terminology to 'Amazon OpenSearch Serverless NextGen', expanded documentation on mTLS configuration and workflow reset commands, added clarification for Elasticsearch 6.x mapping issues, and updated target cluster references.
Security assessment
Added explicit documentation for mTLS configuration through 'traffic.proxies.<proxy>.proxyConfig.tls.clientAuth' and warnings about using 'authConfig.mtls' without proper implementation. This improves security documentation by clarifying proper certificate-based authentication setup.
Diff
diff --git a/solutions/latest/migration-assistant-for-amazon-opensearch-service/troubleshooting.md b/solutions/latest/migration-assistant-for-amazon-opensearch-service/troubleshooting.md index 98985caa4..c777c2181 100644 --- a//solutions/latest/migration-assistant-for-amazon-opensearch-service/troubleshooting.md +++ b//solutions/latest/migration-assistant-for-amazon-opensearch-service/troubleshooting.md @@ -66 +66 @@ Common causes: - * The Amazon OpenSearch Service domain or Amazon OpenSearch Serverless collection’s network configuration does not allow traffic from the Amazon EKS cluster. + * The Amazon OpenSearch Service domain or Amazon OpenSearch Serverless NextGen collection’s network configuration does not allow traffic from the Amazon EKS cluster. @@ -107 +107 @@ If the target is an Amazon OpenSearch Service domain with fine-grained access co -Use `es` as the SigV4 service name for Amazon OpenSearch Service domains and `aoss` for Amazon OpenSearch Serverless collections. +Use `es` as the SigV4 service name for Amazon OpenSearch Service domains and `aoss` for Amazon OpenSearch Serverless NextGen collections. @@ -162 +162,3 @@ Then scope the master user down again after the role mapping is set. -Do not plan around mTLS unless you have validated it in the exact version you are running. The workflow path is centered on basic authentication and SigV4. +Capture Proxy listener mTLS is supported through `traffic.proxies.<proxy>.proxyConfig.tls.clientAuth`. Use it when clients must present certificates to the proxy. See [TLS behavior](./reroute-to-proxy.html#reroute-tls). + +Do not confuse proxy listener mTLS with source or target cluster `authConfig.mtls`. The schema accepts `authConfig.mtls.caCert` and `authConfig.mtls.clientSecretName`, but the standard workflow templates do not mount and pass that client certificate secret through all migration phases. Reindex-from-Snapshot can receive CA certificate parameters, while the Traffic Replayer target-auth path derives request authentication for SigV4 and basic auth only. Use cluster `authConfig.mtls` only with custom wiring and after validating the exact phases you plan to run. @@ -176,2 +178,5 @@ Do not plan around mTLS unless you have validated it in the exact version you ar - workflow reset # interactive list and prompt - workflow reset --all # remove everything (capture proxies are protected) + workflow reset # lists migration custom resources + workflow reset --list # lists migration custom resources and exits + workflow reset migration-foo # delete a specific resource by name + workflow reset --all # delete everything (capture proxies are protected) + workflow reset --all --include-proxies --delete-storage # also remove capture proxies and Apache Kafka PVCs @@ -221 +226 @@ Common causes: - * Elasticsearch 6.x mapping-type cleanup issues — multi-type (multiple types per index) mappings from sources below Elasticsearch 7 are automatically resolved by the type-mapping sanitization transformer, which unions the types into a single mapping by default. To override the default behavior, configure the `TypeMappingSanitizationTransformerProvider` request transform (through its `regexMappings`/`featureFlags`). + * Elasticsearch 6.x mapping-type cleanup issues — multi-type (multiple types per index) mappings from sources below Elasticsearch 7 are automatically resolved by the type-mapping sanitization transformer, which unions the types into a single mapping by default. To rename merged output or drop routed data, configure `TypeMappingSanitizationTransformerProvider` consistently across the affected metadata, document backfill, and replay phases. See [Transform type mappings](./transform-type-mappings.html). @@ -223 +228 @@ Common causes: - * Target-side settings rejected by the newer version on Amazon OpenSearch Service or Amazon OpenSearch Serverless. + * Target-side settings rejected by the newer version on Amazon OpenSearch Service or Amazon OpenSearch Serverless NextGen. @@ -234 +239 @@ Check: - * Target cluster ingest capacity on Amazon OpenSearch Service or Amazon OpenSearch Serverless. + * Target cluster ingest capacity on Amazon OpenSearch Service or Amazon OpenSearch Serverless NextGen.