AWS opensearch-service: Replace placeholders in SQS/KMS/OSIS pipeline policy examples

Service: opensearch-service · 2026-10-08 · Documentation low

File: opensearch-service/latest/developerguide/configure-client-sqs.md

Summary

Multiple example ARNs and condition values (SQS queue, KMS key, OpenSearch domain, aws:SourceAccount, aws:SourceArn, role ARN) were updated from region/account-id placeholders to us-east-1/111122223333.

Security assessment

All edits are placeholder-to-sample-value substitutions in trust and permission policy snippets; the documented least-privilege structure and condition keys are unchanged.

Evidence

              "aws:SourceAccount": "111122223333"

Diff

diff --git a/opensearch-service/latest/developerguide/configure-client-sqs.md b/opensearch-service/latest/developerguide/configure-client-sqs.md
index 17d0f8c..ebffb7c 100644
--- a//opensearch-service/latest/developerguide/configure-client-sqs.md
+++ b//opensearch-service/latest/developerguide/configure-client-sqs.md
@@ -78 +78 @@ Add the following permissions to allow the pipeline to poll and manage messages
-          "Resource": "arn:aws:sqs:region:account-id:queue-name"
+          "Resource": "arn:aws:sqs:us-east-1:111122223333:queue-name"
@@ -95 +95 @@ If your Amazon SQS queue is encrypted with an AWS KMS customer managed key, add
-      "Resource": "arn:aws:kms:region:account-id:key/key-id"
+      "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-id"
@@ -111,2 +111,2 @@ Add the following permissions for writing to your OpenSearch domain or collectio
-        "arn:aws:es:region:account-id:domain/domain-name",
-        "arn:aws:es:region:account-id:domain/domain-name/*"
+        "arn:aws:es:us-east-1:111122223333:domain/domain-name",
+        "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"
@@ -132 +132 @@ The pipeline role must have a trust relationship with `osis-pipelines.amazonaws.
-              "aws:SourceAccount": "account-id"
+              "aws:SourceAccount": "111122223333"
@@ -135 +135 @@ The pipeline role must have a trust relationship with `osis-pipelines.amazonaws.
-              "aws:SourceArn": "arn:aws:osis:region:account-id:pipeline/*"
+              "aws:SourceArn": "arn:aws:osis:us-east-1:111122223333:pipeline/*"
@@ -152 +152 @@ If you're writing to an OpenSearch Service domain, configure the [domain access
-            "AWS": "arn:aws:iam::account-id:role/pipeline-role"
+            "AWS": "arn:aws:iam::111122223333:role/pipeline-role"
@@ -155 +155 @@ If you're writing to an OpenSearch Service domain, configure the [domain access
-          "Resource": "arn:aws:es:region:account-id:domain/domain-name/*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"