SecurityPolicy

Source: src/AWS/OpenSearchServerless/SecurityPolicy.ts

An Amazon OpenSearch Serverless security policy. Security policies govern encryption at rest (encryption) and network access (network) for one or more collections, matched by a resource pattern such as collection/my-collection.

An encryption policy is a prerequisite for every collection — a collection whose name is not covered by an encryption policy fails to create. A network policy controls whether the collection’s data and OpenSearch Dashboards endpoints are reachable from public networks or only from specific VPC endpoints.

Encryption Policies

import * as AWS from "alchemy/AWS";

const encryption = yield* AWS.OpenSearchServerless.SecurityPolicy("Encryption", {
  policyName: "my-collection-enc",
  type: "encryption",
  policy: {
    Rules: [{ ResourceType: "collection", Resource: ["collection/my-collection"] }],
    AWSOwnedKey: true,
  },
});

Network Policies

const network = yield* AWS.OpenSearchServerless.SecurityPolicy("Network", {
  policyName: "my-collection-net",
  type: "network",
  policy: [
    {
      Rules: [
        { ResourceType: "collection", Resource: ["collection/my-collection"] },
        { ResourceType: "dashboard", Resource: ["collection/my-collection"] },
      ],
      AllowFromPublic: true,
    },
  ],
});