AccessPolicy

Source: src/AWS/OpenSearchServerless/AccessPolicy.ts

An Amazon OpenSearch Serverless data access policy. Data access policies grant IAM principals fine-grained permissions on collections and their indexes (create/read/write/delete documents, create indexes, etc.) — they are the data-plane authorization layer that complements the network and encryption security policies.

A Bedrock Knowledge Base backed by an OpenSearch Serverless collection requires a data access policy granting the Knowledge Base’s service role aoss:APIAccessAll on the collection and its indexes.

Creating Access Policies

import * as AWS from "alchemy/AWS";

const access = yield* AWS.OpenSearchServerless.AccessPolicy("Access", {
  policyName: "my-collection-access",
  policy: [
    {
      Rules: [
        {
          ResourceType: "collection",
          Resource: ["collection/my-collection"],
          Permission: ["aoss:*"],
        },
        {
          ResourceType: "index",
          Resource: ["index/my-collection/*"],
          Permission: ["aoss:*"],
        },
      ],
      Principal: ["arn:aws:iam::123456789012:role/my-role"],
    },
  ],
});