aws-opensearch-index-document-data-plane

OpenSearch indexes store arbitrary JSON documents and are commonly used for logs containing credentials or sensitive fields.

awscritical service: aws:opensearch emits CanReadData

Where it sits

locationOpenSearch _search/_mget response _source fields
location kinddata_record
data kindscredential password api_key bearer_token customer_data pii sensitive_data
emits edgeCanReadData
serviceOpenSearch (aws:opensearch)

Collection recipe

access modedata_plane
operationHTTP GET/POST /<index>/_search
response pathhits.hits[]._source
encodingjson
params{"DomainEndpoint": "\u003cendpoint\u003e", "Index": "\u003cindex\u003e", "Query": "\u003cquery\u003e"}

Required permissions

es:ESHttpGet
es:ESHttpPost

References

move · open · esc close