JA EN
shiichan

OpenSearch UI Can Now Restrict Access by Network!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hey there, it's Shii-chan! I've got an AWS security update today that admins are going to love — let's dive in!

AWS What's New aws.amazon.com

What was announced?

AWS's What's New blog announced that Amazon OpenSearch Service now supports network access control for OpenSearch UI applications. OpenSearch UI is the fully managed web service that brings search, analytics, and observability together across your AWS data sources. With this update, you can now restrict OpenSearch UI access to approved networks only.

The story so far

AWS already offered network-based access control elsewhere in its ecosystem through IAM condition keys like aws:SourceVpce, aws:SourceVpc, and aws:SourceIp. But OpenSearch UI applications couldn't tap into that same mechanism. That meant you couldn't apply the "only allow access from this VPC or IP" pattern you were used to from other AWS services.

What changes

Now that OpenSearch UI supports the same IAM condition keys, you can build a more consistent data perimeter across your whole AWS environment. If you're a security lead who wants access limited to your corporate network or specific VPCs, this update should mean less manual configuration and fewer gaps to worry about.

Dive Deep

You can combine access controls at three levels:

  • Identity-based policies — restrict access for specific principals (users or roles)
  • VPC endpoint policies — control which applications are reachable through an endpoint
  • Resource control policies (RCPs) — enforce access consistently across every account in your organization

RCPs are the standout here: they let you block off-network users before authentication even happens, so people outside your corporate network or VPC can't reach the login page at all. Network access controls are available in every AWS Region where OpenSearch UI is available. For setup details, check "Restricting network access to OpenSearch UI applications" in the Amazon OpenSearch Service Developer Guide.

Wrap-up

  • OpenSearch UI applications now support network-level access control
  • You can use the aws:SourceVpce, aws:SourceVpc, and aws:SourceIp IAM condition keys
  • Three layers are available: identity-based policies, VPC endpoint policies, and RCPs — with RCPs blocking access even before authentication
  • Available in every Region where OpenSearch UI runs

If you're a security team that wants OpenSearch UI locked down to your corporate network or an organization-wide data perimeter, this update is for you!

Related posts