Tagging Amazon OpenSearch Serverless collections

Tags let you assign arbitrary information to an Amazon OpenSearch Serverless collection so you can categorize and filter on that information. A tag is a metadata label that you assign or that Amazon assigns to an Amazon resource.

Each tag consists of a key and a value. For tags that you assign, you define the key and value. For example, you might define the key as stage and the value for one resource as test.

With tags, you can identify and organize your Amazon resources. Many Amazon services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you could assign the same tag to an OpenSearch Serverless collection that you assign to an Amazon OpenSearch Service domain.

In OpenSearch Serverless, the primary resource is a collection. You can use the OpenSearch Service console, the Amazon CLI, the OpenSearch Serverless API operations, or the Amazon SDKs to add, manage, and remove tags from a collection.

Permissions required

OpenSearch Serverless uses the following Amazon Identity and Access Management (IAM) permissions for tagging collections:

Amazon CloudFormation and Amazon Cloud Control API call aoss:ListTagsForResource whenever they read a collection, such as when you create, update, or import a collection, detect drift, or call GetResource. If the IAM principal that performs the operation doesn't have this permission, the operation fails with an AccessDenied error. Deleting or listing collections doesn't require it.

When CloudFormation adds, changes, or removes tags, including tags that it propagates from the stack, the principal needs aoss:TagResource or aoss:UntagResource. CloudFormation updates tags in place, without replacing the collection. For more information, see AWS::OpenSearchServerless::Collection in the Amazon CloudFormation Template Reference Guide.