SearchService
OpenSearch/Cognitive Search.
class: Data
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:opensearch:domain |
regional | es:ListDomainNames |
es:ListDomainNames |
azure azure
| resource | scope | enumerate | required permissions |
|---|---|---|---|
azure:search:service |
global | arg:microsoft.search/searchservices |
Microsoft.Search/searchservices/read |
As edge source
As edge target
AuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeleteDataCanExfiltrateCanModifyCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReadDataCanReplaceCanTakeOwnershipCanWriteCanWriteDataContainsContainsResourceReferenceControlsCredentialsForHasPermissionPrivateReachabilityExposure sites
aws-accessanalyzer-finding-details-metadataaws-appflow-flow-data-destinationaws-athena-query-result-rowsaws-backup-recovery-point-restored-contentaws-bedrock-runtime-prompt-response-payloadaws-cloudfront-key-value-store-valueaws-cloudtrail-event-data-store-query-resultsaws-cloudtrail-event-request-response-payload
Rules that touch SearchService 11
A foreign-account principal allowed by the domain access policy reads OpenSearch data cross-account.
aws
CanReadDataPrincipal with es:ESHttpDelete on the domain can delete documents and indices (destructive impact, not escalation).
aws
CanDeleteDataA principal with data-plane read access to an internet-exposed or reachable OpenSearch domain can exfiltrate search indices.
aws
CanExfiltrateA principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant all IAM-permitted principals cluster-admin data access.
aws
CanEscalateToOpenSearch domain with a public endpoint and Principal:* access policy is reachable from the internet; unauthenticated if FGAC is also disabled.
Principal with es:ESHttpGet / es:ESHttpHead on the domain reads indexed data via the OpenSearch REST API.
aws
CanReadDataPrincipal with es:ESHttpPost / es:ESHttpPut on the domain can index or update documents via the OpenSearch REST API.
aws
CanWriteDataThe search service exposes its primary and secondary admin API keys (discoverable via listAdminKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Admin keys grant full data-plane control of the search service (all indexes, indexers, data sources, and queries).
azure
ExposesCredentialThe search service exposes one or more query API keys (discoverable via listQueryKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only data-plane access (search, suggest, autocomplete queries against all indexes).
azure
ExposesCredentialA principal that can obtain an admin or query key (via ExposesCredential) can issue search, suggest, and autocomplete queries against all indexes in the service, reading the full content of matching indexed documents.
azure
CanReadDataA principal with Search Index Data Reader or Search Index Data Contributor RBAC (Entra role) can query the search service indexes via Entra-authenticated access, without requiring API keys. This path bypasses the disableLocalAuth gate and credential extraction entirely.
azure
CanReadData