aws-opensearch-read-data-via-http-get
Principal with es:ESHttpGet / es:ESHttpHead on the domain reads indexed data via the OpenSearch REST API.
match (effective permission)
{
"action": [
"es:ESHttpGet",
"es:ESHttpHead"
],
"resource_type": "AWS::OpenSearchService::Domain"
}
where
domain access policy does not explicitly deny the action for this principal
emit
| source type | Identity |
|---|---|
| target type | SearchService |
| source | <principal> |
| target | <OpenSearch domain (SearchService)> |
| permissions | es:ESHttpGet es:ESHttpHead |
| conditions | iam_permission resource_policy network_reachability |
| state logic | ACTIVE when the principal's effective IAM permissions include es:ESHttpGet or es:ESHttpHead on the domain ARN AND the domain access policy grants the action (or is open) AND network reach is confirmed. For VPC-only domains (VPCOptions set), this is CONDITIONAL(network_reachability) unless the caller is confirmed to have in-VPC reach (e.g., a compute resource in the same VPC or peered VPC, or with a Private Endpoint connection). For public domains, ACTIVE when the caller can reach the public endpoint via the internet or IAM SigV4 (always possible for any principal in the account). CONDITIONAL(condition_expression) when the domain access policy has an aws:SourceIp or VPC condition restricting access. BLOCKED if either the domain access policy or the principal's IAM policy explicitly denies the action. If FGAC is enabled, scope of readable data is limited to the principal's FGAC role mapping — still CanReadData but potentially partial. |
Narrative
{principal.name} can read indexed data from OpenSearch domain {domain.name} (es:ESHttpGet / es:ESHttpHead); with FGAC disabled all indices are accessible, or with FGAC enabled access is limited to the principal's role-mapped indices.
Raw rule rules/derived/aws/opensearch.yaml
id: aws-opensearch-read-data-via-http-get
emits: CanReadData
description: Principal with es:ESHttpGet / es:ESHttpHead on the domain reads indexed data via the OpenSearch
REST API.
match_effective_permission:
action:
- es:ESHttpGet
- es:ESHttpHead
resource_type: AWS::OpenSearchService::Domain
where:
- domain access policy does not explicitly deny the action for this principal
emit:
source_type: Identity
target_type: SearchService
source: <principal>
target: <OpenSearch domain (SearchService)>
permissions:
- es:ESHttpGet
- es:ESHttpHead
conditions:
- iam_permission
- resource_policy
- network_reachability
state_logic: "ACTIVE when the principal's effective IAM permissions include es:ESHttpGet or es:ESHttpHead\
\ on the domain ARN AND the domain access policy grants the action (or is open) AND network reach\
\ is confirmed. For VPC-only domains (VPCOptions set), this is CONDITIONAL(network_reachability) unless\
\ the caller is confirmed to have in-VPC reach (e.g., a compute resource in the same VPC or peered\
\ VPC, or with a Private Endpoint connection). For public domains, ACTIVE when the caller can reach\
\ the public endpoint via the internet or IAM SigV4 (always possible for any principal in the account).\
\ CONDITIONAL(condition_expression) when the domain access policy has an aws:SourceIp or VPC condition\
\ restricting access. BLOCKED if either the domain access policy or the principal's IAM policy explicitly\
\ denies the action. If FGAC is enabled, scope of readable data is limited to the principal's FGAC\
\ role mapping \u2014 still CanReadData but potentially partial."
false_positive_note: "Do not emit ACTIVE for VPC-only domains when the caller is not confirmed to have\
\ network reach to the VPC endpoint. Do not conflate es:ESHttpGet (data-plane read) with cluster admin\
\ \u2014 this yields index data access only, not control-plane control. If FGAC is enabled and the\
\ principal has no FGAC role mapping, the domain access policy grant is effectively blocked at the\
\ FGAC layer; emit CONDITIONAL(condition_expression) in that case."
narrative: '{principal.name} can read indexed data from OpenSearch domain {domain.name} (es:ESHttpGet
/ es:ESHttpHead); with FGAC disabled all indices are accessible, or with FGAC enabled access is limited
to the principal''s role-mapped indices.'