AWS opensearch-service: Update default for UseLatestServiceSoftwareForBlueGreen
Summary
Corrects documentation to state that the UseLatestServiceSoftwareForBlueGreen setting is now enabled by default, so blue/green deployments automatically apply the latest service software unless disabled.
Security assessment
The change documents a default behavior shift that causes service software (including security patches) to be applied automatically during blue/green deployments, which is security-adjacent hardening guidance but not tied to a specific vulnerability.
Evidence
+The `UseLatestServiceSoftwareForBlueGreen` setting is enabled by default. When enabled, any blue/green deployment on your domain automatically applies the latest available service software update along with the configuration change. To disable this setting, use the `UpdateDomainConfig` API or the AWS CLI.
Diff
diff --git a/opensearch-service/latest/developerguide/service-software.md b/opensearch-service/latest/developerguide/service-software.md index 5590722..2236ca6 100644 --- a//opensearch-service/latest/developerguide/service-software.md +++ b//opensearch-service/latest/developerguide/service-software.md @@ -42 +42 @@ Optional service software updates generally include enhancements and support for -Regardless of whether or not you schedule an update, if the `UseLatestServiceSoftwareForBlueGreen` setting is enabled and you make a change on the domain that causes a [blue/green deployment](./managedomains-configuration-changes.html), OpenSearch Service automatically updates your service software for you. If this setting is disabled, the service software is not automatically updated during a blue/green deployment. +By default, if you make a change on the domain that causes a [blue/green deployment](./managedomains-configuration-changes.html), OpenSearch Service automatically updates your service software for you. This behavior is controlled by the `UseLatestServiceSoftwareForBlueGreen` setting, which is enabled by default. If you disable this setting, the service software is not automatically updated during a blue/green deployment. @@ -77 +77 @@ Consider the following when deciding whether to update your domain: -The `UseLatestServiceSoftwareForBlueGreen` setting is disabled by default. When enabled, any blue/green deployment on your domain automatically applies the latest available service software update along with the configuration change. To enable this setting, use the `UpdateDomainConfig` API or the AWS CLI. +The `UseLatestServiceSoftwareForBlueGreen` setting is enabled by default. When enabled, any blue/green deployment on your domain automatically applies the latest available service software update along with the configuration change. To disable this setting, use the `UpdateDomainConfig` API or the AWS CLI. @@ -282 +282 @@ Your domain must meet all of the following conditions for a rollback to be avail - * The software update was applied during a blue/green deployment triggered by a configuration change. This includes cases where the `UseLatestServiceSoftwareForBlueGreen` setting is enabled, which bundles the latest software update with configuration changes. This setting is disabled by default. + * The software update was applied during a blue/green deployment triggered by a configuration change. This includes cases where the `UseLatestServiceSoftwareForBlueGreen` setting is enabled, which bundles the latest software update with configuration changes. This setting is enabled by default.