How do resource-based access policies interact with FGAC master users in Amazon OpenSearch Service?

Question

I’m configuring an Amazon OpenSearch Service domain and I’m trying to understand how the domain’s resource-based access policy interacts with Fine-Grained Access Control (FGAC).

* I know that if I choose an IAM principal as the FGAC master user, I must sign my requests with AWS Signature Version 4 using that IAM user/role.

* I also know that if I choose a username/password as the FGAC master user, requests use HTTP Basic Auth.

My understanding so far:

* If my resource-based access policy specifies IAM roles/users (not “*”), then any request must be signed with SigV4 by one of those IAM principals before it even reaches OpenSearch. In this case, Basic Auth credentials for an internal master user wouldn’t work at the domain edge, because the request isn’t signed.

* Therefore, to use a master username/password with FGAC, I must leave the resource-based access policy open (“*”) (or at least allow anonymous/IP-based access) so the request can pass through to FGAC and be authenticated there.

Is this understanding correct?
In other words:

* If I want to use FGAC with IAM master user, I can keep a restricted resource policy with IAM principals.

* If I want to use FGAC with username/password master user, I need an open access policy (Principal “*”).

Moreover, the Security Hub recommends that I should enable FGAC. But because I have used identity based and resourced based policy for OpenSearch Service, do I actually need FGAC, does it still warning as a secury finding?
And in case I still need FGAC, does this configuation work: Identiy based policy for user/role + Resource based policy for OpenSearch (not open) + FGAC with IAM master user?

I’ve read the following docs and blog posts, but I’d like clarification:
* [https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-types-identity](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-types-identity)
* [https://aws.amazon.com/blogs/security/get-started-with-fine-grained-access-control-in-amazon-elasticsearch-service/](https://aws.amazon.com/blogs/security/get-started-with-fine-grained-access-control-in-amazon-elasticsearch-service/)
* [https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-7](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-7)

Serge · Answer

Hello

Your understanding is right : the interaction between the resource-based access policy (domain access policy) and Fine-Grained Access Control (FGAC) in Amazon OpenSearch Service depends on how you configure your master user and the allowed principal types in your resource policy:

**to answer your question on security hub recommendations :**
Fine-Grained Access Control (FGAC) is still strongly recommended by AWS Security Hub and industry best practices, even if you already use identity-based (IAM) and resource-based (domain access) policies on your OpenSearch Service domain. The reason is that FGAC enables permissions at a much more granular level—down to indexes, documents, or even fields—within OpenSearch itself, rather than only at the API or domain level.

**Your Proposed Configuration will work :**
It will satisfy Security Hub’s FGAC requirement and maintain a secure, layered approach:  Even with strict IAM and resource-based policies, Security Hub expects FGAC to be enabled for full security coverage and to address its findings. Your described setup (restricted identity/resource policy + FGAC w/IAM master user) is recommended and will not trigger a Security Hub warning about missing FGAC

- Identity-based policy for user/role will control which IAM user/role can interact with OpenSearch.
- Resource-based (domain) policy (not open, i.e., not “*”): will enforces access control at the domain edge, only allowing requests from approved principals.
- FGAC enabled with IAM master user: this is a recommended configuration for high security. 
With this setup, requests to OpenSearch must:
              - Be signed with SigV4 by allowed IAM principals,
              - Pass the resource-based policy,
              - Be authenticated and authorized by FGAC with an IAM identity as the master user.

Best regards

Serge

How do resource-based access policies interact with FGAC master users in Amazon OpenSearch Service?

Add your answer

Relevant content