OpenSearch Ingestion (OSI) is a fully managed, serverless pipeline service that delivers logs from sources like CloudWatch Logs, Fluent Bit, and HTTP into AOS/AOSS without managing infrastructure.
Both aws:SourceAccount and aws:SourceArn conditions are required to prevent the confused-deputy pattern: without aws:SourceArn, any OSIS pipeline in the same account could assume this role; the ArnLike condition narrows the trust to your OSIS pipelines only. For a single-pipeline trust, replace pipeline/* with the specific pipeline name.
Attach policies for CloudWatch Logs source and OpenSearch sink:
Tip — pipeline logging for debugging. OSI pipeline logs may carry sensitive data (document content, field values, query parameters), so create the log group with KMS encryption first, then attach it:
bash
# 1. Create the log group with a customer-managed KMS keyaws logs create-log-group \ --log-group-name /aws/vendedlogs/OpenSearchIngestion/my-log-pipeline \ --kms-key-id arn:aws:kms:<region>:<account>:key/<key-id>aws logs put-retention-policy \ --log-group-name /aws/vendedlogs/OpenSearchIngestion/my-log-pipeline \ --retention-in-days 30# 2. Attach it to the pipelineaws osis update-pipeline --pipeline-name my-log-pipeline \ --log-publishing-options 'CloudWatchLogDestination={LogGroup=/aws/vendedlogs/OpenSearchIngestion/my-log-pipeline},IsLoggingEnabled=true'
Apply least-privilege IAM policies: grant only the specific actions needed (e.g., es:ESHttpPost, es:ESHttpPut) scoped to the target domain/collection resource ARN.
All data in transit between OSI pipelines and OpenSearch is encrypted via TLS. Ensure domain or collection enforces HTTPS-only access.
Use dedicated IAM roles for pipeline execution rather than sharing roles across services.
Enable CloudTrail at the account level to audit all OSIS API calls (pipeline creation, modification, deletion) for compliance monitoring.