aws-opensearch-saml-idp-metadata
SAML IdP metadata is stored plaintext and can reveal internal identity-provider endpoints, entity IDs, and signing certificates.
Where it sits
| location | DescribeDomainConfig.DomainConfig.AdvancedSecurityOptions.Options.SAMLOptions.Idp.MetadataContent |
|---|---|
| location kind | config_field |
| data kinds | certificate pii sensitive_data |
| emits edge | ContainsSecret |
| service | OpenSearch (aws:opensearch) |
Collection recipe
| access mode | read_api |
|---|---|
| operation | DescribeDomainConfig |
| response path | DomainConfig.AdvancedSecurityOptions.Options.SAMLOptions.Idp.MetadataContent |
| encoding | xml |
| params | {"DomainName": "\u003cdomain-name\u003e"} |
Required permissions
es:DescribeDomainConfig