View a markdown version of this page

Network access control configuration reference for OpenSearch UI applications - Amazon OpenSearch Service
Restrict a principal to a VPC endpointRestrict a principal to an IP rangeUse a VPC endpoint policyEnforce a VPC endpoint org-wideEnforce a VPC org-wideEnforce an IP range org-wide

Network access control configuration reference for OpenSearch UI applications

The following sections provide policy examples for each network access control that OpenSearch UI supports. Each example includes the AWS Command Line Interface (AWS CLI) commands to apply it. For an explanation of how OpenSearch UI evaluates these policies, and for a step by step walkthrough of the most common task, see Restricting network access to OpenSearch UI applications.

Choose an example based on the scope you want to protect and the network path your users connect through:

Scope Control Blocks the login page
A single principal Identity-based policy No
A single VPC endpoint VPC endpoint policy No
Every account in an organization Resource control policy (RCP) Yes
Note

Only a resource control policy that denies opensearch:ViewLoginPage blocks off-network users before they authenticate. Identity-based and VPC endpoint policies apply after a user signs in.

Restricting a principal to a VPC endpoint

The following identity-based policy denies a user or role access to OpenSearch UI applications unless the request arrives through the specified interface VPC endpoint. Attach it to the IAM principal that accesses the application. Replace the placeholder value with your own VPC endpoint ID.

To restrict a principal to a VPC endpoint

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOpenSearchUIAccessOutsideVpce",
            "Effect": "Deny",
            "Action": "opensearch:ApplicationAccessAll",
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "aws:SourceVpce": "vpc-endpoint-id"
                }
            }
        }
    ]
}

  2. Create the IAM policy.

    aws iam create-policy \
  --policy-name DenyOpenSearchUIOutsideVpce \
  --description "Denies OpenSearch UI access outside the approved VPC endpoint" \
  --policy-document file://policy.json

    The response includes the policy ARN. Note this value for the next step.

  3. Attach the policy to the IAM role or user that accesses the application.

    aws iam attach-role-policy \
  --role-name OpenSearchUIUserRole \
  --policy-arn arn:aws:iam::111122223333:policy/DenyOpenSearchUIOutsideVpce

After the policy takes effect, the principal receives a 403 forbidden response when accessing the application from outside the approved VPC endpoint. Access through the endpoint works normally.

Restricting a principal to an IP address range

The following identity-based policy denies access unless the request originates from an approved IP address range, for example your corporate network's public egress range. Replace the placeholder values with your own IP address ranges in CIDR notation.

To restrict a principal to an IP address range

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOpenSearchUIAccessOutsideCorpNetwork",
            "Effect": "Deny",
            "Action": "opensearch:ApplicationAccessAll",
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "203.0.113.0/24",
                        "198.51.100.0/24"
                    ]
                }
            }
        }
    ]
}

  2. Create the IAM policy.

    aws iam create-policy \
  --policy-name DenyOpenSearchUIExternalAccess \
  --description "Denies OpenSearch UI access from outside corporate IP ranges" \
  --policy-document file://policy.json

  3. Attach the policy to the IAM role or user that accesses the application.

    aws iam attach-role-policy \
  --role-name OpenSearchUIUserRole \
  --policy-arn arn:aws:iam::111122223333:policy/DenyOpenSearchUIExternalAccess
Note

When a request arrives through a VPC endpoint, aws:SourceIp is not present. If you use both private (VPC endpoint) and public (IP-restricted) access paths, account for both condition keys in your policy so that you don't unintentionally deny legitimate VPC endpoint traffic.

Restricting access with a VPC endpoint policy

An identity-based policy governs a specific principal. To control which applications users can reach through a VPC endpoint, regardless of which principal connects, attach a policy to the interface VPC endpoint itself. The following endpoint policy allows access only to a specific application. Replace the placeholder values with your own AWS Region, account ID, and application ID.

To restrict access with a VPC endpoint policy

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOpenSearchUIApplication",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "opensearch:ApplicationAccessAll",
            "Resource": "arn:aws:opensearch:region:account-id:application/application-id"
        }
    ]
}

  2. Apply the policy to the interface VPC endpoint.

    aws ec2 modify-vpc-endpoint \
  --vpc-endpoint-id vpce-1a2b3c4d5e6f7g8h9 \
  --policy-document file://policy.json

For more information about VPC endpoint policies for OpenSearch UI, see Managing access to the OpenSearch UI from a VPC endpoint.

Enforcing VPC endpoint access across an organization

An identity-based policy restricts a specific principal, and a VPC endpoint policy restricts a specific endpoint. To enforce network access uniformly across every account in your organization, and to block off-network users before they authenticate, attach a resource control policy (RCP) to your AWS organization.

The following resource control policy denies all access to OpenSearch UI applications in the organization unless the request arrives through the specified VPC endpoint. It denies both the pre-authentication login page (opensearch:ViewLoginPage) and authenticated access (opensearch:ApplicationAccessAll). Users outside the approved network can neither load the sign-in page nor access the application. Replace the placeholder value with your own VPC endpoint ID.

To enforce VPC endpoint access across an organization

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOpenSearchUIAccessOutsideVpce",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "opensearch:ViewLoginPage",
                "opensearch:ApplicationAccessAll"
            ],
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "aws:SourceVpce": "vpc-endpoint-id"
                }
            }
        }
    ]
}

  2. Create the resource control policy. Run this command from your organization's management account or from a delegated administrator account.

    aws organizations create-policy \
  --name DenyOpenSearchUIOutsideVpce \
  --description "Denies OpenSearch UI access outside the approved VPC endpoint" \
  --type RESOURCE_CONTROL_POLICY \
  --content file://policy.json

  3. Attach the policy to the organization root, an organizational unit, or an account, depending on the scope you want to protect.

    aws organizations attach-policy \
  --policy-id p-example12345 \
  --target-id 111122223333

    For more information, see Attaching and detaching resource control policies in the AWS Organizations User Guide.

After the policy takes effect, a user outside the approved VPC endpoint cannot access the application. Depending on the application's authentication type and the URL requested, the user either receives a 403 forbidden response instead of the login page, or is redirected to sign in and is then denied access to the application. If you connect through the VPC endpoint, you reach the login page and sign in normally.

Note

Changes to a resource control policy can take up to a minute to take effect. If you test immediately after you create, update, or attach a policy, you might still observe the previous behavior.

Enforcing VPC access across an organization

To approve every interface VPC endpoint in a VPC instead of naming one endpoint, use aws:SourceVpc. The following resource control policy denies access across the organization unless the request arrives through the specified VPC. Replace the placeholder value with your own VPC ID.

To enforce VPC access across an organization

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOpenSearchUIAccessOutsideVpc",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "opensearch:ViewLoginPage",
                "opensearch:ApplicationAccessAll"
            ],
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "aws:SourceVpc": "vpc-id"
                }
            }
        }
    ]
}

  2. Create and attach the resource control policy.

    aws organizations create-policy \
  --name DenyOpenSearchUIOutsideVpc \
  --description "Denies OpenSearch UI access outside the approved VPC" \
  --type RESOURCE_CONTROL_POLICY \
  --content file://policy.json

aws organizations attach-policy \
  --policy-id p-example12345 \
  --target-id 111122223333

Enforcing IP address range access across an organization

The following resource control policy denies access across the organization unless the request originates from an approved IP address range, for example your corporate network's public egress range. Replace the placeholder values with your own IP address ranges in CIDR notation.

To enforce IP address range access across an organization

  1. Save the following policy to a local file named policy.json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOpenSearchUIAccessOutsideCorpNetwork",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "opensearch:ViewLoginPage",
                "opensearch:ApplicationAccessAll"
            ],
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "203.0.113.0/24",
                        "198.51.100.0/24"
                    ]
                }
            }
        }
    ]
}

  2. Create and attach the resource control policy.

    aws organizations create-policy \
  --name DenyOpenSearchUIExternalAccess \
  --description "Denies OpenSearch UI access from outside corporate IP ranges" \
  --type RESOURCE_CONTROL_POLICY \
  --content file://policy.json

aws organizations attach-policy \
  --policy-id p-example12345 \
  --target-id 111122223333
Note

As with the identity-based IP example, aws:SourceIp is not present on requests that arrive through a VPC endpoint. If you use both private and public access paths, account for both condition keys so that you don't unintentionally deny legitimate VPC endpoint traffic.