AWS opensearch-service medium security documentation change
Summary
Added a section titled 'Manual snapshot IAM role limitation' stating that OpenSearch Service doesn't support aws:SourceArn and aws:SourceAccount condition keys in IAM trust policies for manual snapshots.
Security assessment
This change documents a security limitation where critical confused deputy prevention mechanisms (aws:SourceArn/aws:SourceAccount) are unsupported for manual snapshot roles, which could lead to privilege escalation risks if administrators assume these controls are available.
Diff
diff --git a/opensearch-service/latest/developerguide/cross-service-confused-deputy-prevention.md b/opensearch-service/latest/developerguide/cross-service-confused-deputy-prevention.md index feb429562..eef3ccdf3 100644 --- a//opensearch-service/latest/developerguide/cross-service-confused-deputy-prevention.md +++ b//opensearch-service/latest/developerguide/cross-service-confused-deputy-prevention.md @@ -14,0 +15,4 @@ The value of `aws:SourceArn` must be the ARN of the OpenSearch Service domain. +###### Manual snapshot IAM role limitation + +Amazon OpenSearch Service doesn't support the `aws:SourceArn` and `aws:SourceAccount` condition keys on the trust policy of the IAM role that you use for manual snapshots. +