SecurityConfig

Source: src/AWS/OpenSearchServerless/SecurityConfig.ts

An Amazon OpenSearch Serverless security configuration. Security configurations federate OpenSearch Dashboards sign-in with SAML identity providers, AWS IAM Identity Center, or IAM federation, so human users can access collections without IAM credentials.

The configuration’s configId (format saml/{accountId}/{name}) is what a data AccessPolicy references as a Principal to grant the federated identities index- and collection-level permissions.

SAML Authentication

import * as AWS from "alchemy/AWS";

const saml = yield* AWS.OpenSearchServerless.SecurityConfig("Saml", {
  configName: "my-idp",
  type: "saml",
  samlOptions: {
    metadata: idpMetadataXml,
    groupAttribute: "groups",
    sessionTimeout: "4 hours",
  },
});
// Reference saml.configId as a Principal in a data access policy

IAM Federation

const federation = yield* AWS.OpenSearchServerless.SecurityConfig("Federation", {
  configName: "my-federation",
  type: "iamfederation",
  iamFederationOptions: {
    userAttribute: "user",
    groupAttribute: "groups",
  },
});