- Welcome, my name is Kevin Fallis.
I'm a Principal Analytics Specialist Solution Architect
and I work with the Amazon OpenSearch Service
to help customers such as yourself
understand the feature sets.
Today, we're gonna understand security
in the Amazon OpenSearch Service.
Now, the Amazon OpenSearch Service
is a fully managed service that makes it easy to deploy
and operate and scale OpenSearch clusters
and legacy Elasticsearch clusters on the AWS Cloud.
Now, what is OpenSearch?
OpenSearch is a community-driven,
open-source search and analytic suite,
which is derived from Apache 2.0 licensed,
Elasticsearch 7.10.2, and Kibana 7.10.2.
It consists of a search engine which is called OpenSearch,
and a visualization and user interface
which is called OpenSearch Dashboards,
as well as a series of functionality-adding tools
and plugins that make life easier,
such as the security plugin that I'm gonna discuss here
in the slides following on.
So, why Amazon OpenSearch Service security?
Well, first of all, you can confidently host
PCI DSS, HIPAA, FEDRAMP, and other sensitive workloads
on the Amazon OpenSearch Service.
You can protect sensitive data
using fine grained access control
and data masking mechanisms.
You can integrate with third party identity providers
for direct SAML integration for a single sign on experience.
You can secure your data at rest and in transit.
You can audit activities on both the control plane
and the data plane.
And finally, you can control programmatic access
from AWS services and processes
using AWS Identity and Access Management.
So, if we look at the transit layer for encryption,
effectively you have your leader nodes and your data nodes.
Between the leader nodes and data nodes,
we use TLS 1.2 to secure that data in flight.
Next, you want to go ahead
and enable node-to-node encryption
to enforce HTTPS at the edge
for a secure, all-around transit layer encryption setup.
Additionally, you can configure DNS
and bring your own search to the Amazon OpenSearch Service
from a DNS perspective should you choose to
use a portion of your DNS naming standards
for the Amazon OpenSearch Service,
so you can have a custom friendly domain name.
So to do this, you create or install a certificate
on the AWS Certificate Manager.
And once you've done that, you reference that certificate
and provide the friendly DNS name
that you want associated with
your Amazon OpenSearch Service cluster.
Then, your clients that are accessing either Dashboards
or programmatically accessing your data
will be able to securely reference that data over the wire,
in flight through the transit layer,
using the mechanisms that we've spoke about.
Now, from a rest layer perspective
we do support encryption at rest,
and this is enabled from versions 5.1 onwards.
So it uses the AWS Key Management Service, KMS,
to store and manage those keys.
It's AES 256 encrypted,
and you can either create those keys
and bring 'em to the service,
or AWS, the Amazon OpenSearch Service,
can provide a key for you if you don't want to create it.
Now, what it covers is the indices.
It encrypts the OpenSearch or the Elasticsearch logs.
It will encrypt the swap files, the automated snapshots,
and all of the data in the application directory
on the disk that supports the data nodes
that hold your data.
Now from an authentication perspective
there are multiple provider integrations,
and there's three of them.
The first one's basic auth, which most of us should know.
Basically it's a username and a password
in a configured local database
that gives you some level of security
above and beyond no authentication.
And the way it works is you put a user in
that basic auth database,
and then you can sign on to the Amazon OpenSearch Service
or programmatically use those credentials
to interact with the data that's on the service.
Next you have, IAM authentication.
Now this is typically leveraged with Cognito,
but you can also use it for Sigv4 request signing
you will request from your programmatic processes
that can then talk to the Amazon OpenSearch Service.
And the way this works is that AWS IAM,
a identity is defined.
It uses SDS to generate credentials and tokens,
and then Cognito will leverage that
to then forward it to the Amazon OpenSearch Service
where Sigv4 request signing is done,
and then that enables you to have a secure solution
using IAM authentication.
Finally, there's SAML authentication,
and this is that third integration I've talked about.
So it does use third party identity providers
such as Okta, Ping, Active Directory,
and other things that supports SAML 2.0 compliance.
Now the authentication's done at the provider
and the authorization in this case will then be done
at the Amazon OpenSearch Service,
and this is highly secure.
So the way it works is that
you configure your users into a provider.
You establish a certificate
with the Amazon OpenSearch Service,
and then once that's been set up,
then the Amazon OpenSearch Service
will work with your provider to then provide that
as an authentication mechanism.
Now, from a authorization perspective
we leverage the security plugin that I talked about earlier.
Now this supports multi-tenancy,
cluster level security, index level security,
document level security, field level security,
and it even supports field masking.
And the way this works basically is that
you either have an IAM role, a basic auth user,
or some SAML attributes that you provide for role mappings.
These role mappings are then associated with a role
that gives you the granular access of your choice.
And again, these things could be an index, or field level,
or document level, or even the masking that we talked about.
And so then when you access that data,
either through your client,
or through OpenSearch dashboards or Kibana,
you will see only the data that you've authorized
those users to leverage for their work.
So from an auditing perspective
we have control plane auditing
that's covered by AWS CloudTrail.
This will cover any command
that's done from the control plane,
such as resizing your cluster,
deleting your cluster, and whatnot.
Now, if you want deeper knowledge
of what requests have came in,
you can use the auditing on the data plane.
So the security plugin does provide
a mechanism for auditing every request
should you choose to enable that,
and you can see many details such as rest method,
the user that accessed it, the query that was performed,
any headers, any endpoints that they access,
and this all gets logged for you to assert
that you have the proper security for your particular users.
Now in summary, the Amazon OpenSearch service
supports the following,
encryption at rest,
IAM integration,
fine grained access control,
encryption in transit,
auditing at both the control plane and the data plane,
and also IDP integration
with your favorite provider for single sign-on activities.
So I really wanna thank you for your time today.
I know that your time is valuable
and we really appreciate your interest
in the Amazon OpenSearch Service.
Hopefully today this information has enabled you
with the details that you need to explore further.
Thank you.