How do I set up an OpenSearch Serverless collection with an Amazon VPC endpoint and access the collection's dashboard?

Short description

To create a private connection between your Amazon VPC and your OpenSearch Serverless collection, set up an Amazon VPC with network access to your collection.

To view and manage your data, access OpenSearch Dashboards based on your authentication type.

Resolution

Set up an OpenSearch Serverless collection with Amazon VPC network access

To create an OpenSearch Serverless collection with Amazon VPC network access, complete the following steps.

Create an Amazon VPC, subnet, and related resources 

To create an Amazon VPC and associated resources, complete the following steps:

1. Open the Amazon VPC console.
2. Create an Amazon VPC. Use the following settings:
   For DNS Settings, select Enable DNS resolutionInfo and Enable DNS hostnamesInfo.
3. Create an internet gateway, and then attach it to your Amazon VPC.
4. In your Amazon VPC, create a subnet.
5. In the route table that's associated with your subnet, add a route for all traffic (0.0.0.0/0) to go through your internet gateway.
6. Create a security group for your Amazon VPC.
7. Add an ingress rule to your security group that allows all inbound traffic (0.0.0.0/0).
   Note: To allow only certain IP addresses or resources in your Amazon VPC, modify the inbound rules for your use case.

Create OpenSearch Serverless collection with an Amazon VPC endpoint

To create an OpenSearch Serverless collection, complete the following steps:

1. Open the Amazon OpenSearch console, and then choose Collections.
2. Choose Create collection.
3. Enter your Collection name, Description, and Collection type.
4. For Security, choose Standard Create.
5. For Network access settings, choose VPC (recommended).
6. Choose Create VPC endpoints, and then choose your Amazon VPC, subnet, and security group.
7. Under Resource type, select Enable access to OpenSearch endpoint and OpenSearch Dashboards.
8. Choose Next.
9. In Configure data access, grant permission to roles, users, and groups who can access the OpenSearch Serverless collection. For more information, see Creating data access policies (console).
10. Choose Next, and then provide a Name for your data access policy.
11. Review your configuration, and then choose Submit.

Grant IAM permissions

You must grant additional AWS Identity and Access Management (IAM) permissions to the principals that you granted permissions to in your collection's data access policy. The principals require these permissions to access the data plane APIs and OpenSearch Dashboards. Only IAM or SAML identities can access OpenSearch Dashboards.

The following sample policy lists the required permissions:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "aoss:APIAccessAll",
        "Resource": "arn:aws:aoss:region:account-id:collection/collection-id"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "aoss:DashboardsAccessAll",
        "Resource": "arn:aws:aoss:region:account-id:dashboards/default"
    }
    ]
}

You can also grant permissions for specific actions that are related to OpenSearch Dashboards. For more information, see Identity-based policy examples for OpenSearch Serverless.

If you use SAML authentication for OpenSearch Serverless, then you can use your existing identity provider for single sign-on (SSO) access to OpenSearch endpoints.

Access the collection's dashboard

To access the collection's dashboard, complete the following steps to create an Amazon Elastic Compute Cloud (Amazon EC2) instance in your Amazon VPC:

1. Create an EC2 instance in the same Amazon VPC that you used to create the endpoint for your collection.
2. In the AWS Management Console, navigate to VPC, and then choose Security Groups.
3. In the inbound rule of the security group that's associated with the endpoint, allow the security group that's attached to your Amazon EC2 instance.
4. Launch the EC2 instance.
5. In the instance, open a browser. Then, complete the following steps depending on your authentication type:
   For IAM authentication, sign in to the AWS Management Console as your IAM identity. Then, choose OpenSearch Dashboards URL from the Amazon OpenSearch console.
   -or-
   For SAML authentication, open the OpenSearch endpoint to be redirected to provide your authentication details.

Related information

Access Amazon OpenSearch Serverless collections using a VPC endpoint

Access Amazon OpenSearch Serverless using an interface endpoint (AWS PrivateLink)

Data access policies versus IAM policies