Managing data source associations and Virtual Private Cloud access permissions

To associate a data source with an OpenSearch UI application using the console

1. Sign in to the Amazon OpenSearch Service console at https://console.aws.amazon.com/aos/home.

2. Choose OpenSearch UI (Dashboards), and then choose the name of an OpenSearch UI application.

3. In the Associated data sources area, choose Manage data sources.

4. Choose from the OpenSearch domains and collections that you want to associate with the application.

   Tip

   If you are not finding the data sources you are looking for, contact your administrators to grant you the necessary permission. For more information, see Permissions to create an application that uses IAM Identity Center authentication (optional).

5. Choose Next, and then choose Save.

To configure a direct query data source

1. Launch your OpenSearch UI application.

2. In the left navigation pane, choose Data sources.

3. Choose Create data source connection.

4. Choose the source type: Amazon S3, Amazon CloudWatch Logs, or Amazon Security Lake.

5. Provide the connection details, such as the Amazon Glue database and the IAM role.

6. Test the connection, and then save it.

To configure the access to a VPC domain using the Amazon Web Services Management Console:

1. Sign in to the Amazon OpenSearch Service console at https://console.aws.amazon.com/aos/home.

2. In the left navigation pane, choose Domains, and the choose the name of the VPC domain.

   -or-

   Choose Create domain, and then configure the details for the domain.

3. Choose the VPC endpoints tab, and then choose Authorize principal.

4. In the Authorize principals dialog box, select Authorize Principals from other Amazon Services, and then choose OpenSearch applications (Dashboard) from the list.

5. Choose Authorize.

To revoke a VPC domain association using the console

When an association is no longer needed, the VPC domain owner can revoke access using the following procedure.

1. Sign in to the Amazon OpenSearch Service console at https://console.aws.amazon.com/aos/home.

2. In the left navigation pane, choose Domains, and the choose the name of the VPC domain.

3. Choose the VPC endpoints tab, and then select the button for the OpenSearch applications (Dashboard) row.

4. Choose Revoke access.

To configure access to OpenSearch Serverless collections in a VPC using the console

1. Sign in to the Amazon OpenSearch Service console at https://console.aws.amazon.com/aos/home.

2. In the left navigation, choose Network policies, choose the name of the network policy, and then choose Edit.

   -or-

   Choose Create network policy, and then configure the details for the policy.

3. In the Access type area, choose Private (recommended), and then select Amazon service private access.

4. In the search field, choose Service, and then choose application.opensearchservice.amazonaws.com.

5. In the Resource type area, select the Enable access to OpenSearch endpoint box.

6. For Search collection(s), or input specific prefix term(s), in the search field, select Collection Name, and then enter or select the name of the collections to associate with the network policy.

7. Choose Create for a new network policy or Update for an existing network policy.

To configure access to OpenSearch Serverless collections in a VPC using the Amazon CLI

1. Create a .json file similar to the following. Replace the placeholder values with your own information.

   {
       "Description" : "policy-description",
       "Rules": [{
          "ResourceType" : "collection",
           "Resource" : ["collection/collection_name"]
        }],
       "SourceServices" : [
             "application.opensearchservice.amazonaws.com"
         ],
         "AllowFromPublic" : false
   }

2. Create or update a network policy for a collection in a VPC to work with OpenSearch UI applications.

   Create a network policy

   Run the following command. Replace the placeholder values with your own information.

   aws opensearchserverless create-security-policy \
       --type network  \
       --region region \
       --endpoint-url endpoint-url \
       --name network-policy-name \
       --policy file:/path_to_network_policy_json_file

   The command returns information similar to the following:

   {
       "securityPolicyDetail": {
           "createdDate": ******,
           "lastModifiedDate": ******,
           "name": "network-policy-name",
           "policy": [
               {
                   "SourceVPCEs": [],
                   "AllowFromPublic": false,
                   "Description": "",
                   "Rules": [
                       {
                           "Resource": [
                               "collection/network-policy-name"
                           ],
                           "ResourceType": "collection"
                       }
                   ],
                   "SourceServices": [
                       "application.opensearchservice.amazonaws.com"
                   ]
               }
           ],
           "policyVersion": "******",
           "type": "network"
       }
   }

   Update a network policy

   Run the following command. Replace the placeholder values with your own information.

   aws opensearchserverless update-security-policy \
       --type network  \
       --region region \
       --endpoint-url endpoint-url \
       --name network-policy-name \
       --policy-version "policy_version_from_output_of_network_policy_creation" \
       --policy file:/path_to_network_policy_json_file

   The command returns information similar to the following:

   {
       "securityPolicyDetail": {
           "createdDate": ******,
           "lastModifiedDate": ******,
           "name": "network-policy-name",
           "policy": [
               {
                   "SourceVPCEs": [],
                   "AllowFromPublic": false,
                   "Description": "",
                   "Rules": [
                       {
                           "Resource": [
                               "collection/network-policy-name"
                           ],
                           "ResourceType": "collection"
                       }
                   ],
                   "SourceServices": [
                       "application.opensearchservice.amazonaws.com"
                   ]
               }
           ],
           "policyVersion": "******",
           "type": "network"
       }
   }