- Welcome. My name is Kevin Fallis.
I'm a principal analytics specialist solutions architect
and I work with the Amazon OpenSearch Service
to help customers such as yourself
understand the feature sets.
Today we're gonna understand security
in the Amazon OpenSearch Service.
Now, the Amazon OpenSearch Service
is a fully managed service that makes it easy to deploy
and operate and scale OpenSearch clusters
and legacy elastic search clusters on the AWS cloud.
Now, what is OpenSearch?
OpenSearch is a community driven open-source
search and analytic suite, which is derived
from Apache 2.0 licensed Elasticsearch 7.10.2
and Kibana 7.10.2.
It consists of a search engine, which is called OpenSearch
and a visualization and user interface
which is called OpenSearch Dashboards
as well as a series of functionality adding tools
and plugins that make life easier, easier
such as the security plugin that I'm gonna discuss
here in the slides following on.
So why Amazon OpenSearch Service Security?
Well, first of all you can confidently host PCI DSS,
HIPAA, FEDRAMP and other sensitive workloads
on the Amazon OpenSearch Service.
You can protect sensitive data using fine grain
access control and data masking mechanisms.
You can integrate with third party identity providers
for direct SAML integration for a single sign-on experience.
You can secure your data at rest in a transit.
You can audit activities on both the control plane
and the data plane.
And finally, you can control programmatic access
from AWS services and processes using AWS identity
and access management.
So if we look at the transit layer for encryption,
effectively you have your leader nodes
and your data nodes.
Between the leader nodes and data nodes
we use TLS 1.2 to secure that data in flight.
Next, you want to go ahead and enable
node-to-node encryption to enforce HTPs at the edge
for a secure all around transit layer encryption setup.
Additionally, you can configure DNS
and bring your own search to the Amazon OpenSearch Service
from a DNS perspective, should you choose
to use a portion of your DNS naming standards
for the Amazon OpenSearch Service,
so you can have a custom friendly domain name.
So to do this, you basically create, or you create
or install a certificate on the AWS Certificate Manager.
And once you've done that, you reference that certificate
and provide the friendly DNS name that you wanna associate
with your Amazon OpenSearch Service cluster.
Then your clients that are accessing either dashboards
or programmatically accessing your data,
will be able to securely reference that data over the wire
in flight through the transit layer using the mechanisms
that we've spoke about.
Now, from a rest layer perspective, we do support
encryption at rest, and this is enabled
from versions 5.1 onwards.
So it uses the AWS Key Management Service, KMS,
to store and manage those keys.
It's AES 256 encrypted and you can either create those keys
and bring 'em to the service or AWS,
the Amazon OpenSearch Service, can provide a key for you
if you don't want to create it.
Now, what it covers is the indices.
It encrypts the OpenSearch or the elastic search logs.
It will encrypt the swap files, the automated snapshots
and all of the data in the application directory
on the disc that supports the data nodes
that hold your data.
Now, from an authentication perspective,
there are multiple provider integrations
and there's three of them.
The first one's basic auth, which most of us should know.
Basically, it's a username and a password
in a configured local database that gives you
some level of security above and beyond no authentication.
And the way it works is you put a user
in that basic auth database
and then you can sign onto the Amazon OpenSearch Service
or programmatically use those credentials
to interact with the data that's on the service.
Next, you have IAM authentication.
Now, this is typically leveraged with Cognito
but you can also use it for SIG V4
request signing your request
from your programmatic processes
that that can then talk to the Amazon OpenSearch Service.
And the way this works is that AWS IAM
a identity is defined.
It uses SDS to generate credentials and tokens
and then Cognito will leverage that
to then forward it to the Amazon OpenSearch Service
where SIG V4 request signing is done.
And then that enables you to have a secure
solution using IAM authentication.
Finally, there's SAML authentication
and this is that third integration I've talked about.
So it does use third party identity providers
such as Okta, Ping, Active Directory
and other things that support SAML 2.0 compliance.
Now, the authentication's done at the provider
and the authorization in this case
will then be done at the Amazon OpenSearch Service.
And this is highly secure.
So the way it works is that you, you configure your users
into provider, you establish a certificate
with the Amazon OpenSearch Service
and then once that's been set up
then the Amazon OpenSearch Service will work
with your provider to then provide
that as an authentication mechanism.
Now, from a authorization perspective
we leverage the security plugin that I talked about earlier.
Now, this supports multi-tenancy, cluster level security
index level security, document level security,
field level security, and it even supports field masking.
And the way this works basically is that you either have
an IAM role, a basic auth user or some SAML attributes
that you provide for role mappings.
These role mappings are then associated
with a role that gives you the granular access
of your choice.
And again, these things could be an index or field level
or document level, or even the masking that we talked about.
And so then when you access that data
either through your client or through OpenSearch dashboards
or Cabana, you will see only the data
that you've authorized those users
to leverage for their work.
So from auditing perspective we have control plan auditing
that's covered by AWS CloudTrail.
This will cover any command that's done
from the control plane, such as resizing your cluster,
deleting your cluster, and whatnot.
Now, if you want deeper knowledge
of what requests have came in,
you can use the auditing on the data plane.
So the security plugin does provide a mechanisms
for auditing every request should you choose to enable that.
And you can see many details such as REST method,
the user that accessed it, the query that was performed,
any headers, any endpoints that they access.
And this all gets logged for you to assert
that you have the proper security for your particular users.
Now, in summary, the Amazon OpenSearch Service
supports the following.
Encryption at rest, IAM integration,
fine grain access control, encryption in transit,
auditing at both the control plane and the data plane,
and also IDP integration with your favorite provider
for single sign-on activities.
So I really wanna thank you for your time today.
I know that your time is valuable,
and we really appreciate your interest
in the Amazon OpenSearch service.
Hopefully today this information has enabled you
with the details that you need to explore further.
Thank you.