AWS opensearch-service documentation change
Summary
Updated domain creation workflow: Replaced 'Templates' with 'Use cases' selection, added engine mode permanence warning, incremented all subsequent step numbers, and added new authentication/admin management options.
Security assessment
The change adds documentation for security features (IAM Identity Center authentication and admin permission management) but shows no evidence of addressing a specific vulnerability. The engine mode permanence note relates to configuration immutability, not security remediation.
Diff
diff --git a/opensearch-service/latest/developerguide/createupdatedomains.md b/opensearch-service/latest/developerguide/createupdatedomains.md index 9b528e621..47a124622 100644 --- a//opensearch-service/latest/developerguide/createupdatedomains.md +++ b//opensearch-service/latest/developerguide/createupdatedomains.md @@ -43 +43,17 @@ Use the following procedure to create an OpenSearch Service domain by using the - 6. For **Templates** , choose the option that best matches the purpose of your domain: + 6. For **Use cases** , select a use case to configure your domain with recommended settings: + + * **Search** – Full-text search, e-commerce, and application search. + + * **Observability** – Log analytics, metrics, and distributed tracing. + + * **Vector search** – Store vector embeddings and run semantic and similarity searches. + + * **Custom** – Configure all settings manually. + +Each use case preconfigures your domain with recommended engine and storage settings. Choose **Custom** if you want to configure all settings yourself. + +###### Engine mode is permanent + +You cannot change the engine mode after you create the domain. + + 7. For **Templates** , choose the option that best matches the purpose of your domain: @@ -53 +69 @@ Different deployment types present different options on subsequent pages. These - 7. For **Deployment Option(s)** , choose **Domain with standby** to configure a 3-AZ domain, with nodes in one of the zones are reserved as standby. This option enforces a number of best practices, such as a specified data node count, master node count, instance type, replica count, and software update settings. + 8. For **Deployment Option(s)** , choose **Domain with standby** to configure a 3-AZ domain, with nodes in one of the zones are reserved as standby. This option enforces a number of best practices, such as a specified data node count, master node count, instance type, replica count, and software update settings. @@ -55 +71 @@ Different deployment types present different options on subsequent pages. These - 8. For **Version** , choose the version of OpenSearch or legacy Elasticsearch OSS to use. We recommend that you choose the latest version of OpenSearch. For more information, see [Supported versions of Elasticsearch and OpenSearch](./what-is.html#choosing-version). + 9. For **Version** , choose the version of OpenSearch or legacy Elasticsearch OSS to use. We recommend that you choose the latest version of OpenSearch. For more information, see [Supported versions of Elasticsearch and OpenSearch](./what-is.html#choosing-version). @@ -59 +75 @@ Different deployment types present different options on subsequent pages. These - 9. For **Instance type** , choose an instance type for your data nodes. For more information, see [Supported instance types in Amazon OpenSearch Service](./supported-instance-types.html). + 10. For **Instance type** , choose an instance type for your data nodes. For more information, see [Supported instance types in Amazon OpenSearch Service](./supported-instance-types.html). @@ -65 +81 @@ Not all Availability Zones support all instance types. If you choose Multi-AZ wi - 10. For **Number of nodes** , choose the number of data nodes. + 11. For **Number of nodes** , choose the number of data nodes. @@ -73 +89 @@ For maximum values, see [OpenSearch Service domain and instance quotas](https:// - 11. For **Storage type** , select Amazon EBS. The volume types available in the list depend on the instance type that you've chosen. For guidance on creating especially large domains, see [Petabyte scale in Amazon OpenSearch Service](./petabyte-scale.html). + 12. For **Storage type** , select Amazon EBS. The volume types available in the list depend on the instance type that you've chosen. For guidance on creating especially large domains, see [Petabyte scale in Amazon OpenSearch Service](./petabyte-scale.html). @@ -75 +91 @@ For maximum values, see [OpenSearch Service domain and instance quotas](https:// - 12. For **EBS** storage, configure the following additional settings. Some settings might not appear depending on the type of volume you choose. + 13. For **EBS** storage, configure the following additional settings. Some settings might not appear depending on the type of volume you choose. @@ -83 +99 @@ Setting | Description - 13. (Optional) If you selected a `gp3` volume type, expand **Advanced settings** and specify additional IOPS (up to 16,000 for every 3 TiB volume size provisioned per data node) and throughput (up to 1,000 MiB/s for every 3 TiB volume size provisioned per data node) beyond what is included with the price of storage, for an additional cost. For more information, see the [Amazon OpenSearch Service pricing](https://aws.amazon.com/opensearch-service/pricing/). + 14. (Optional) If you selected a `gp3` volume type, expand **Advanced settings** and specify additional IOPS (up to 16,000 for every 3 TiB volume size provisioned per data node) and throughput (up to 1,000 MiB/s for every 3 TiB volume size provisioned per data node) beyond what is included with the price of storage, for an additional cost. For more information, see the [Amazon OpenSearch Service pricing](https://aws.amazon.com/opensearch-service/pricing/). @@ -85 +101 @@ Setting | Description - 14. (Optional) To enable [UltraWarm storage](./ultrawarm.html), choose **Enable UltraWarm data nodes**. Each instance type has a [maximum amount of storage](./limits.html#limits-ultrawarm) that it can address. Multiply that amount by the number of warm data nodes for the total addressable warm storage. + 15. (Optional) To enable [UltraWarm storage](./ultrawarm.html), choose **Enable UltraWarm data nodes**. Each instance type has a [maximum amount of storage](./limits.html#limits-ultrawarm) that it can address. Multiply that amount by the number of warm data nodes for the total addressable warm storage. @@ -87 +103 @@ Setting | Description - 15. (Optional) To enable [cold storage](./cold-storage.html), choose **Enable cold storage**. You must enable UltraWarm to enable cold storage. + 16. (Optional) To enable [cold storage](./cold-storage.html), choose **Enable cold storage**. You must enable UltraWarm to enable cold storage. @@ -89 +105 @@ Setting | Description - 16. If you use Multi-AZ with Standby, three [dedicated master nodes](./managedomains-dedicatedmasternodes.html) are aleady enabled. Choose the type of master nodes that you want. If you chose a Multi-AZ without Standby domain, select **Enable dedicated master nodes** and choose the type and number of master nodes that you want. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. We recommend three dedicated master nodes for production domains. + 17. If you use Multi-AZ with Standby, three [dedicated master nodes](./managedomains-dedicatedmasternodes.html) are aleady enabled. Choose the type of master nodes that you want. If you chose a Multi-AZ without Standby domain, select **Enable dedicated master nodes** and choose the type and number of master nodes that you want. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. We recommend three dedicated master nodes for production domains. @@ -95 +111 @@ You can choose different instance types for your dedicated master nodes and data - 17. (Optional) For domains running OpenSearch or Elasticsearch 5.3 and later, the **Snapshot configuration** is irrelevant. For more information about automated snapshots, see [Creating index snapshots in Amazon OpenSearch Service](./managedomains-snapshots.html). + 18. (Optional) For domains running OpenSearch or Elasticsearch 5.3 and later, the **Snapshot configuration** is irrelevant. For more information about automated snapshots, see [Creating index snapshots in Amazon OpenSearch Service](./managedomains-snapshots.html). @@ -97 +113 @@ You can choose different instance types for your dedicated master nodes and data - 18. If you want to use a custom endpoint rather than the standard one of `https://search-`mydomain`-`1a2a3a4a5a6a7a8a9a0a9a8a7a`.`us-east-1`.es.amazonaws.com` , choose **Enable custom endpoint** and provide a name and certificate. For more information, see [Creating a custom endpoint for Amazon OpenSearch Service](./customendpoint.html). + 19. If you want to use a custom endpoint rather than the standard one of `https://search-`mydomain`-`1a2a3a4a5a6a7a8a9a0a9a8a7a`.`us-east-1`.es.amazonaws.com` , choose **Enable custom endpoint** and provide a name and certificate. For more information, see [Creating a custom endpoint for Amazon OpenSearch Service](./customendpoint.html). @@ -99 +115 @@ You can choose different instance types for your dedicated master nodes and data - 19. Under **Network** , choose either **VPC access** or **Public access**. If you choose **Public access** , skip to the next step. If you choose **VPC access** , make sure you meet the [prerequisites](./vpc.html#prerequisites-vpc-endpoints), then configure the following settings: + 20. Under **Network** , choose either **VPC access** or **Public access**. If you choose **Public access** , skip to the next step. If you choose **VPC access** , make sure you meet the [prerequisites](./vpc.html#prerequisites-vpc-endpoints), then configure the following settings: @@ -110 +126 @@ Setting | Description - 20. Enable or disable fine-grained access control: + 21. Enable or disable fine-grained access control: @@ -124 +140 @@ We _strongly_ recommend enabling fine-grained access control to protect the data - 21. (Optional) If you want to use SAML authentication for OpenSearch Dashboards, choose **Enable SAML authentication** and configure SAML options for the domain. For instructions, see [SAML authentication for OpenSearch Dashboards](./saml.html). + 22. (Optional) If you want to use SAML authentication for OpenSearch Dashboards, choose **Enable SAML authentication** and configure SAML options for the domain. For instructions, see [SAML authentication for OpenSearch Dashboards](./saml.html). @@ -126 +142 @@ We _strongly_ recommend enabling fine-grained access control to protect the data - 22. (Optional) If you want to use Amazon Cognito authentication for OpenSearch Dashboards, choose **Enable Amazon Cognito authentication**. Then choose the Amazon Cognito user pool and identity pool that you want to use for OpenSearch Dashboards authentication. For guidance on creating these resources, see [Configuring Amazon Cognito authentication for OpenSearch Dashboards](./cognito-auth.html). + 23. (Optional) If you want to use Amazon Cognito authentication for OpenSearch Dashboards, choose **Enable Amazon Cognito authentication**. Then choose the Amazon Cognito user pool and identity pool that you want to use for OpenSearch Dashboards authentication. For guidance on creating these resources, see [Configuring Amazon Cognito authentication for OpenSearch Dashboards](./cognito-auth.html). @@ -128 +144 @@ We _strongly_ recommend enabling fine-grained access control to protect the data - 23. (Optional) If you want to use IAM Identity Center (IDC) authentication to connect your existing identity source and give your AWS applications a common view of your users, choose **Enable API access authenticated with IAM Identity Center**. For more information, see [Trusted identity propagation overview](https://docs.aws.amazon.com/singlesignon/latest/userguide/trustedidentitypropagation-overview.html?icmpid=docs_console_unmapped) in the _IAM Identity Center User Guide._ + 24. (Optional) If you want to use IAM Identity Center (IDC) authentication to connect your existing identity source and give your AWS applications a common view of your users, choose **Enable API access authenticated with IAM Identity Center**. For more information, see [Trusted identity propagation overview](https://docs.aws.amazon.com/singlesignon/latest/userguide/trustedidentitypropagation-overview.html?icmpid=docs_console_unmapped) in the _IAM Identity Center User Guide._ @@ -130 +146 @@ We _strongly_ recommend enabling fine-grained access control to protect the data - 24. (Optional) In the **Advanced features** section, leave **Enable Natural Language Query Generation and Amazon Q Developer features** selected, if you want to use these features. + 25. (Optional) In the **Advanced features** section, leave **Enable Natural Language Query Generation and Amazon Q Developer features** selected, if you want to use these features. @@ -136 +152 @@ We _strongly_ recommend enabling fine-grained access control to protect the data - 25. For **Access policy** , choose an access policy or configure one of your own. If you choose to create a custom policy, you can configure it yourself or import one from another domain. For more information, see [Identity and Access Management in Amazon OpenSearch Service](./ac.html). + 26. For **Access policy** , choose an access policy or configure one of your own. If you choose to create a custom policy, you can configure it yourself or import one from another domain. For more information, see [Identity and Access Management in Amazon OpenSearch Service](./ac.html). @@ -142 +158 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 26. (Optional) To require that all requests to the domain arrive over HTTPS, select **Require HTTPS for all traffic to the domain**. To enable node-to-node encryption, select **Node-to-node encryption**. For more information, see [Node-to-node encryption for Amazon OpenSearch Service](./ntn.html). To enable encryption of data at rest, select **Enable encryption of data at rest**. These options are pre-selected if you chose the Multi-AZ with Standby deployment option. + 27. (Optional) To require that all requests to the domain arrive over HTTPS, select **Require HTTPS for all traffic to the domain**. To enable node-to-node encryption, select **Node-to-node encryption**. For more information, see [Node-to-node encryption for Amazon OpenSearch Service](./ntn.html). To enable encryption of data at rest, select **Enable encryption of data at rest**. These options are pre-selected if you chose the Multi-AZ with Standby deployment option. @@ -144 +160 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 27. (Optional) Select **Use AWS owned key** to have OpenSearch Service create an AWS KMS encryption key on your behalf (or use the one that it already created). Otherwise, choose your own KMS key. For more information, see [Encryption of data at rest for Amazon OpenSearch Service](./encryption-at-rest.html). + 28. (Optional) Select **Use AWS owned key** to have OpenSearch Service create an AWS KMS encryption key on your behalf (or use the one that it already created). Otherwise, choose your own KMS key. For more information, see [Encryption of data at rest for Amazon OpenSearch Service](./encryption-at-rest.html). @@ -146 +162 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 28. For **Off-peak window** , select a start time to schedule service software updates and Auto-Tune optimizations that require a blue/green deployment. Off-peak updates help to minimize strain on a cluster's dedicated master nodes during high traffic periods. + 29. For **Off-peak window** , select a start time to schedule service software updates and Auto-Tune optimizations that require a blue/green deployment. Off-peak updates help to minimize strain on a cluster's dedicated master nodes during high traffic periods. @@ -148 +164 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 29. For **Auto-Tune** , choose whether to allow OpenSearch Service to suggest memory-related configuration changes to your domain to improve speed and stability. For more information, see [Auto-Tune for Amazon OpenSearch Service](./auto-tune.html). + 30. For **Auto-Tune** , choose whether to allow OpenSearch Service to suggest memory-related configuration changes to your domain to improve speed and stability. For more information, see [Auto-Tune for Amazon OpenSearch Service](./auto-tune.html). @@ -152 +168,9 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 30. (Optional) Select **Automatic software update** to enable automatic software updates. + 31. (Optional) Select **Automatic software update** to enable automatic software updates. + + 32. (Optional) For **Single sign-on authentication** , select **Authenticate with IAM Identity Center** if you want to create a single sign-on experience or work with Security Assertion Markup Language (SAML)-authenticated applications. By default, the dashboard application is authenticated with IAM to manage permissions for AWS resource users. + + 33. (Optional) For **OpenSearch UI admins management** , configure administrator permissions for creating, editing, and deleting Workspaces in an OpenSearch application: + + * **Grant administrators' permission to specific user(s)** – Select specific IAM principals or IAM Identity Center users to grant administrator access. + + * **Grant administrators' permission to all users** – Grant all users administrator access. @@ -154 +178 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 31. (Optional) Add tags to describe your domain so you can categorize and filter on that information. For more information, see [Tagging Amazon OpenSearch Service domains](./managedomains-awsresourcetagging.html). + 34. (Optional) Add tags to describe your domain so you can categorize and filter on that information. For more information, see [Tagging Amazon OpenSearch Service domains](./managedomains-awsresourcetagging.html). @@ -156 +180 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 32. (Optional) Expand and configure **Advanced cluster settings**. For a summary of these options, see Advanced cluster settings. + 35. (Optional) Expand and configure **Advanced cluster settings**. For a summary of these options, see Advanced cluster settings. @@ -158 +182 @@ If you enabled VPC access, you can't use IP-based policies. Instead, you can use - 33. Choose **Create**. + 36. Choose **Create**.