aws-opensearch-write-data-via-http-put-post
Principal with es:ESHttpPost / es:ESHttpPut on the domain can index or update documents via the OpenSearch REST API.
match (effective permission)
{
"action": [
"es:ESHttpPost",
"es:ESHttpPut"
],
"resource_type": "AWS::OpenSearchService::Domain"
}
where
domain access policy does not explicitly deny the action for this principal
emit
| source type | Identity |
|---|---|
| target type | SearchService |
| source | <principal> |
| target | <OpenSearch domain (SearchService)> |
| permissions | es:ESHttpPost es:ESHttpPut |
| conditions | iam_permission resource_policy network_reachability |
| state logic | ACTIVE when the principal has effective es:ESHttpPost or es:ESHttpPut on the domain ARN AND the domain access policy grants it AND network reach is confirmed. For VPC-only domains (VPCOptions set), this is CONDITIONAL(network_reachability) unless the caller is confirmed to have in-VPC reach (e.g., a compute resource in the same VPC or peered VPC, or with a Private Endpoint connection). For public domains, ACTIVE when the caller can reach the public endpoint via the internet or IAM SigV4 (always possible for any principal in the account). CONDITIONAL(condition_expression) for IP-restricted public domains. BLOCKED if either policy explicitly denies the action. |
Narrative
{principal.name} can index or update documents in OpenSearch domain {domain.name} (es:ESHttpPost / es:ESHttpPut), enabling data poisoning or bulk overwrite of search indices.
Raw rule rules/derived/aws/opensearch.yaml
id: aws-opensearch-write-data-via-http-put-post
emits: CanWriteData
description: Principal with es:ESHttpPost / es:ESHttpPut on the domain can index or update documents via
the OpenSearch REST API.
match_effective_permission:
action:
- es:ESHttpPost
- es:ESHttpPut
resource_type: AWS::OpenSearchService::Domain
where:
- domain access policy does not explicitly deny the action for this principal
emit:
source_type: Identity
target_type: SearchService
source: <principal>
target: <OpenSearch domain (SearchService)>
permissions:
- es:ESHttpPost
- es:ESHttpPut
conditions:
- iam_permission
- resource_policy
- network_reachability
state_logic: ACTIVE when the principal has effective es:ESHttpPost or es:ESHttpPut on the domain ARN
AND the domain access policy grants it AND network reach is confirmed. For VPC-only domains (VPCOptions
set), this is CONDITIONAL(network_reachability) unless the caller is confirmed to have in-VPC reach
(e.g., a compute resource in the same VPC or peered VPC, or with a Private Endpoint connection). For
public domains, ACTIVE when the caller can reach the public endpoint via the internet or IAM SigV4
(always possible for any principal in the account). CONDITIONAL(condition_expression) for IP-restricted
public domains. BLOCKED if either policy explicitly denies the action.
false_positive_note: "FGAC role mappings may restrict which indices a principal can write to; emit ACTIVE\
\ with a note that the write scope depends on the FGAC configuration when FGAC is enabled. es:ESHttpPost\
\ also covers _search (with a request body) which is a read operation; only emit CanWriteData when\
\ the action is used to index/create/update documents (the same permission covers both, so CanWriteData\
\ is conservative \u2014 the principal can write)."
narrative: '{principal.name} can index or update documents in OpenSearch domain {domain.name} (es:ESHttpPost
/ es:ESHttpPut), enabling data poisoning or bulk overwrite of search indices.'