AWS opensearch-service: Replace placeholders in fine-grained access control policy examples

Service: opensearch-service · 2026-10-08 · Documentation low

File: opensearch-service/latest/developerguide/fgac.md

Summary

Root principal ARNs and domain resource ARNs in FGAC examples were updated from account-id/domain-arn placeholders to concrete us-east-1/111122223333 values.

Security assessment

Documentation-only placeholder standardization; the FGAC policy semantics and permissions are not altered.

Evidence

          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"

Diff

diff --git a/opensearch-service/latest/developerguide/fgac.md b/opensearch-service/latest/developerguide/fgac.md
index a0cc21d..28f4000 100644
--- a//opensearch-service/latest/developerguide/fgac.md
+++ b//opensearch-service/latest/developerguide/fgac.md
@@ -456 +456 @@ Use IAM credentials for calls to the OpenSearch APIs, and use [SAML authenticati
-            "AWS": "arn:aws:iam::account-id:root"
+            "AWS": "arn:aws:iam::111122223333:root"
@@ -459 +459 @@ Use IAM credentials for calls to the OpenSearch APIs, and use [SAML authenticati
-          "Resource": "domain-arn/*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"
@@ -473 +473 @@ Use IAM credentials or basic authentication for calls to the OpenSearch APIs. Ma
-            "AWS": "arn:aws:iam::account-id:root"
+            "AWS": "arn:aws:iam::111122223333:root"
@@ -476 +476 @@ Use IAM credentials or basic authentication for calls to the OpenSearch APIs. Ma
-          "Resource": "domain-arn/*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"
@@ -490 +490 @@ Use IAM credentials for calls to the OpenSearch APIs, and use Amazon Cognito to
-            "AWS": "arn:aws:iam::account-id:root"
+            "AWS": "arn:aws:iam::111122223333:root"
@@ -493 +493 @@ Use IAM credentials for calls to the OpenSearch APIs, and use Amazon Cognito to
-          "Resource": "domain-arn/*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"
@@ -507 +507 @@ Use IAM credentials for calls to the OpenSearch APIs, and block most access to D
-            "AWS": "arn:aws:iam::account-id:root"
+            "AWS": "arn:aws:iam::111122223333:root"
@@ -510 +510 @@ Use IAM credentials for calls to the OpenSearch APIs, and block most access to D
-          "Resource": "domain-arn/*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/*"
@@ -515 +515 @@ Use IAM credentials for calls to the OpenSearch APIs, and block most access to D
-            "AWS": "arn:aws:iam::account-id:root"
+            "AWS": "arn:aws:iam::111122223333:root"
@@ -518 +518 @@ Use IAM credentials for calls to the OpenSearch APIs, and block most access to D
-          "Resource": "domain-arn/_dashboards*"
+          "Resource": "arn:aws:es:us-east-1:111122223333:domain/domain-name/_dashboards*"