AWS opensearch-service high security documentation change
Summary
Added critical configuration note about SAML sign-in endpoint selection and renumbered subsequent steps
Security assessment
The change explicitly warns that selecting 'with unique identifiers' causes authentication failures (AccessDenied errors) due to SAML:aud condition mismatch. This addresses a security-related misconfiguration that could prevent legitimate users from accessing resources.
Diff
diff --git a/opensearch-service/latest/developerguide/application-enable-SAML-identity-federation.md b/opensearch-service/latest/developerguide/application-enable-SAML-identity-federation.md index 6ea00a1f0..c48c86515 100644 --- a//opensearch-service/latest/developerguide/application-enable-SAML-identity-federation.md +++ b//opensearch-service/latest/developerguide/application-enable-SAML-identity-federation.md @@ -207 +207,5 @@ To create your AWS Identity and Access Management role, complete the following s - 7. Choose **Next**. + 7. ###### Note + +Under **Sign-in endpoints** , select **without unique identifiers**. If you select **with unique identifiers** , the `SAML:aud` condition in the trust policy will not match the SAML assertion audience, resulting in an `AccessDenied` error when users attempt to sign in. + + 8. Choose **Next**. @@ -209 +213 @@ To create your AWS Identity and Access Management role, complete the following s - 8. In the **Permissions policies** list, select the check boxes for policies that grant OpenSearch Service permissions, for example, AWS managed policy **AmazonOpenSearchServiceFullAccess**. + 9. In the **Permissions policies** list, select the check boxes for policies that grant OpenSearch Service permissions, for example, AWS managed policy **AmazonOpenSearchServiceFullAccess**. @@ -211 +215 @@ To create your AWS Identity and Access Management role, complete the following s - 9. Choose **Next**. + 10. Choose **Next**. @@ -213 +217 @@ To create your AWS Identity and Access Management role, complete the following s - 10. In the **Review** area, for **Role name** , enter the name of your role; for example, `oktarole`. + 11. In the **Review** area, for **Role name** , enter the name of your role; for example, `oktarole`. @@ -215 +219 @@ To create your AWS Identity and Access Management role, complete the following s - 11. (Optional) For **Description** , enter a brief description of the purpose of the role. + 12. (Optional) For **Description** , enter a brief description of the purpose of the role. @@ -217 +221 @@ To create your AWS Identity and Access Management role, complete the following s - 12. Choose **Create role**. + 13. Choose **Create role**. @@ -219 +223 @@ To create your AWS Identity and Access Management role, complete the following s - 13. Navigate to the role that you just created, choose the **Trust Relationships** tab, and then choose **Edit trust policy**. + 14. Navigate to the role that you just created, choose the **Trust Relationships** tab, and then choose **Edit trust policy**. @@ -221 +225 @@ To create your AWS Identity and Access Management role, complete the following s - 14. In the **Edit statement** pane, under **Add actions for STS** , select the box for **TagSession**. + 15. In the **Edit statement** pane, under **Add actions for STS** , select the box for **TagSession**. @@ -223 +227 @@ To create your AWS Identity and Access Management role, complete the following s - 15. Choose **Update policy**. + 16. Choose **Update policy**.