AWS opensearch-service: Add warning that disabling explicit index references breaks Dashboards
Summary
Adds an Important note for the `rest.action.multi.allow_explicit_index` domain property explaining that setting it to `false` breaks OpenSearch Dashboards (bulk, mget, msearch APIs), makes saved objects unreadable, and can block engine version upgrades, with links to advanced options and troubleshooting docs.
Security assessment
The note concerns `rest.action.multi.allow_explicit_index`, a setting that restricts bulk/mget/msearch from addressing explicit index names (a data-exposure/authorization hardening control). The added guidance warns operators not to disable it because it breaks Dashboards, rather than documenting a new security feature or resolving a vulnerability; no CVE or incident is referenced.
Evidence
+Setting this property to `false` breaks OpenSearch Dashboards. Dashboards depends on the bulk, mget, and msearch APIs. Saved objects such as index patterns, visualizations, and dashboards become unreadable. Dashboards might also fail to start after an engine version upgrade, which can prevent the upgrade from finishing. Dashboards isn't supported on domains where this property is `false`, so only set it if you don't need Dashboards on the domain. For more information, see [Advanced options and API considerations](./ac.html#ac-advanced) and [Dashboards fails to load or start because explicit indexes are disabled](./dashboards-troubleshooting.html#dashboards-troubleshooting-allow-explicit-index).
Diff
diff --git a/opensearch-service/latest/developerguide/createupdatedomains.md b/opensearch-service/latest/developerguide/createupdatedomains.md index 244ed3545..15fd355c4 100644 --- a//opensearch-service/latest/developerguide/createupdatedomains.md +++ b//opensearch-service/latest/developerguide/createupdatedomains.md @@ -406,0 +407,4 @@ Specifies whether explicit references to indexes are allowed inside the body of +###### Important + +Setting this property to `false` breaks OpenSearch Dashboards. Dashboards depends on the bulk, mget, and msearch APIs. Saved objects such as index patterns, visualizations, and dashboards become unreadable. Dashboards might also fail to start after an engine version upgrade, which can prevent the upgrade from finishing. Dashboards isn't supported on domains where this property is `false`, so only set it if you don't need Dashboards on the domain. For more information, see [Advanced options and API considerations](./ac.html#ac-advanced) and [Dashboards fails to load or start because explicit indexes are disabled](./dashboards-troubleshooting.html#dashboards-troubleshooting-allow-explicit-index). +