AWS opensearch-service: VPC endpoint policy example scoped to app ARN instead of opensearch:*
Summary
Rewrites the OpenSearch UI VPC endpoint policy examples to use the specific action opensearch:ApplicationAccessAll against an explicit application ARN (region/account/application ID) rather than the wildcard opensearch:* action on Resource "*" with an ApplicationId condition; also fixes the deny example to use Effect: Deny with the same scoped action/ARN.
Security assessment
The old example granted the wildcard action opensearch:* on Resource "*" gated only by a StringEquals ApplicationId condition; the new example grants a single action scoped to a specific application ARN, which is a least-privilege authorization change for VPC endpoint policies controlling access to the OpenSearch UI. No specific vulnerability or incident is cited, so it is documented hardening rather than a fix.
Evidence
+ "Action": "opensearch:ApplicationAccessAll",
Diff
diff --git a/opensearch-service/latest/developerguide/application-access-ui-from-vpc-endpoint.md b/opensearch-service/latest/developerguide/application-access-ui-from-vpc-endpoint.md index 1450116..825c176 100644 --- a//opensearch-service/latest/developerguide/application-access-ui-from-vpc-endpoint.md +++ b//opensearch-service/latest/developerguide/application-access-ui-from-vpc-endpoint.md @@ -72 +72 @@ Run the following command. Replace the `placeholder values` with your own inform -After you create the private connection, update the VPC endpoint policy to allow access to the OpenSearch UI application in the VPC endpoint policy by specifying the application ID. +After you create the private connection, update the VPC endpoint policy to allow access to the OpenSearch UI application in the VPC endpoint policy by specifying the application ARN. @@ -76 +76 @@ For information about updating a VPC endpoint policy, see [Update a VPC endpoint -Ensure that the VPC endpoint policy includes the following statement. Replace the `placeholder value` with your own information. +Ensure that the VPC endpoint policy includes the following statement. Replace the `placeholder values` with your own AWS Region, account ID, and application ID. @@ -79,0 +80 @@ Ensure that the VPC endpoint policy includes the following statement. Replace th + "Version": "2012-10-17", @@ -81 +81,0 @@ Ensure that the VPC endpoint policy includes the following statement. Replace th - "Action": ["opensearch:*"], @@ -84,6 +84,2 @@ Ensure that the VPC endpoint policy includes the following statement. Replace th - "Resource": "*", - "Condition": { - "StringEquals": { - "opensearch:ApplicationId": ["opensearch-ui-application-id"] - } - } + "Action": "opensearch:ApplicationAccessAll", + "Resource": "arn:aws:opensearch:region:account-id:application/application-id" @@ -99 +95 @@ For information about updating a VPC endpoint policy, see [Update a VPC endpoint -The following is an example of VPC endpoint policy that denies access to the UI applications from the VPC: +Alternatively, you can explicitly deny access. The following is an example of a VPC endpoint policy that denies access to an OpenSearch UI application from the VPC. Replace the `placeholder values` with your own AWS Region, account ID, and application ID. @@ -102,0 +99 @@ The following is an example of VPC endpoint policy that denies access to the UI + "Version": "2012-10-17", @@ -104,2 +101 @@ The following is an example of VPC endpoint policy that denies access to the UI - "Action": ["opensearch:*"], - "Effect": "Allow", + "Effect": "Deny", @@ -107,6 +103,2 @@ The following is an example of VPC endpoint policy that denies access to the UI - "Resource": "*", - "Condition": { - "StringEquals": { - "opensearch:ApplicationId": [""] - } - } + "Action": "opensearch:ApplicationAccessAll", + "Resource": "arn:aws:opensearch:region:account-id:application/application-id"