Search Bedrock Connectors

# Service principal: opensearchservice.amazonaws.com (AOS managed domains)
# For AOSS, use ml.opensearchservice.amazonaws.com instead (see AOSS-Specific Notes below)
# Both aws:SourceAccount and aws:SourceArn conditions are required to prevent
# confused-deputy: ArnLike narrows trust to a specific domain (or collection
# for AOSS — replace the resource pattern accordingly) so other domains in
# the same account can't assume this role.
aws iam create-role --role-name OpenSearchBedrockRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "opensearchservice.amazonaws.com"},
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {"aws:SourceAccount": "<account>"},
        "ArnLike":      {"aws:SourceArn":     "arn:aws:es:<region>:<account>:domain/<domain-name>"}
      }
    }]
  }'

aws iam put-role-policy --role-name OpenSearchBedrockRole \
  --policy-name BedrockInvokeModel \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": "arn:aws:bedrock:<region>::foundation-model/amazon.titan-embed-text-v2:0"}]
  }'

POST /_plugins/_ml/connectors/_create
{
  "name": "Amazon Bedrock Titan Embedding V2",
  "description": "Connector for Titan Text Embeddings V2",
  "version": 1,
  "protocol": "aws_sigv4",
  "parameters": {
    "region": "<region>",
    "service_name": "bedrock",
    "model": "amazon.titan-embed-text-v2:0"
  },
  "credential": {
    "roleArn": "arn:aws:iam::<account>:role/OpenSearchBedrockRole"
  },
  "actions": [{
    "action_type": "predict",
    "method": "POST",
    "url": "https://bedrock-runtime.<region>.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke",
    "headers": {"content-type": "application/json"},
    "request_body": "{\"inputText\": \"${parameters.inputText}\"}",
    "pre_process_function": "connector.pre_process.bedrock.embedding",
    "post_process_function": "connector.post_process.bedrock.embedding"
  }]
}

POST /_plugins/_ml/models/_register
{
  "name": "Bedrock Titan Embedding",
  "function_name": "remote",
  "connector_id": "<connector_id>"
}

POST /_plugins/_ml/models/<model_id>/_deploy