AWS API Changes

2026/03/09 - Amazon OpenSearch Service - 6 updated api methods

Changes This change enables cross-account and cross-region access for DataSources. Customers can now define access policies on their datasources to allow other AWS accounts to access and query their data.

AddDirectQueryDataSource (updated)

Link ¶
Changes (request)

{'DataSourceAccessPolicy': 'string'}

Adds a new data source in Amazon OpenSearch Service so that you can perform direct queries on external data.

See also: AWS API Documentation

Request Syntax

client.add_direct_query_data_source(
    DataSourceName='string',
    DataSourceType={
        'CloudWatchLog': {
            'RoleArn': 'string'
        },
        'SecurityLake': {
            'RoleArn': 'string'
        }
    },
    Description='string',
    OpenSearchArns=[
        'string',
    ],
    DataSourceAccessPolicy='string',
    TagList=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ]
)

type DataSourceName:

string

param DataSourceName:

[REQUIRED]

A unique, user-defined label to identify the data source within your OpenSearch Service environment.

type DataSourceType:

dict

param DataSourceType:

[REQUIRED]

The supported Amazon Web Services service that you want to use as the source for direct queries in OpenSearch Service.

CloudWatchLog (dict) --

Specifies CloudWatch Logs as a type of data source for direct queries.
- RoleArn (string) -- [REQUIRED]
  
  The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
SecurityLake (dict) --

Specifies Security Lake as a type of data source for direct queries.
- RoleArn (string) -- [REQUIRED]
  
  The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.

type Description:

string

param Description:

An optional text field for providing additional context and details about the data source.

type OpenSearchArns:

list

param OpenSearchArns:

[REQUIRED]

A list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source.

(string) --

The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.

type DataSourceAccessPolicy:

string

param DataSourceAccessPolicy:

An optional IAM access policy document that defines the permissions for accessing the data source. The policy document must be in valid JSON format and follow IAM policy syntax.

type TagList:

list

param TagList:

A list of tags attached to a domain.

(dict) --

A tag (key-value pair) for an Amazon OpenSearch Service resource.
- Key (string) -- [REQUIRED]
  
  The tag key. Tag keys must be unique for the domain to which they are attached.
- Value (string) -- [REQUIRED]
  
  The value assigned to the corresponding tag key. Tag values can be null and don't have to be unique in a tag set. For example, you can have a key value pair in a tag set of project : Trinity and cost-center : Trinity

rtype:

dict

returns:

Response Syntax

{
    'DataSourceArn': 'string'
}

Response Structure

(dict) --
- DataSourceArn (string) --
  
  The unique, system-generated identifier that represents the data source.

CreateApplication (updated)

Link ¶
Changes (both)

{'dataSources': {'iamRoleForDataSourceArn': 'string'}}

Creates an OpenSearch UI application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.

See also: AWS API Documentation

Request Syntax

client.create_application(
    clientToken='string',
    name='string',
    dataSources=[
        {
            'dataSourceArn': 'string',
            'dataSourceDescription': 'string',
            'iamRoleForDataSourceArn': 'string'
        },
    ],
    iamIdentityCenterOptions={
        'enabled': True|False,
        'iamIdentityCenterInstanceArn': 'string',
        'iamRoleForIdentityCenterApplicationArn': 'string'
    },
    appConfigs=[
        {
            'key': 'opensearchDashboards.dashboardAdmin.users'|'opensearchDashboards.dashboardAdmin.groups',
            'value': 'string'
        },
    ],
    tagList=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    kmsKeyArn='string'
)

type clientToken:

string

param clientToken:

Unique, case-sensitive identifier to ensure idempotency of the request.

This field is autopopulated if not provided.

type name:

string

param name:

[REQUIRED]

The unique name of the OpenSearch application. Names must be unique within an Amazon Web Services Region for each account.

type dataSources:

list

param dataSources:

The data sources to link to the OpenSearch application.

(dict) --

Data sources that are associated with an OpenSearch application.
- dataSourceArn (string) --
  
  The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- dataSourceDescription (string) --
  
  Detailed description of a data source.
- iamRoleForDataSourceArn (string) --
  
  The ARN of the IAM role to be used for cross account/region data source association.

type iamIdentityCenterOptions:

dict

param iamIdentityCenterOptions:

Configuration settings for integrating Amazon Web Services IAM Identity Center with the OpenSearch application.

enabled (boolean) --

Specifies whether IAM Identity Center is enabled or disabled.
iamIdentityCenterInstanceArn (string) --

The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
iamRoleForIdentityCenterApplicationArn (string) --

The ARN of the IAM role associated with the IAM Identity Center application.

type appConfigs:

list

param appConfigs:

Configuration settings for the OpenSearch application, including administrative options.

(dict) --

Configuration settings for an OpenSearch application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.
- key (string) --
  
  The configuration item to set, such as the admin role for the OpenSearch application.
- value (string) --
  
  The value assigned to the configuration key, such as an IAM user ARN.

type tagList:

list

param tagList:

A list of tags attached to a domain.

(dict) --

A tag (key-value pair) for an Amazon OpenSearch Service resource.
- Key (string) -- [REQUIRED]
  
  The tag key. Tag keys must be unique for the domain to which they are attached.
- Value (string) -- [REQUIRED]
  
  The value assigned to the corresponding tag key. Tag values can be null and don't have to be unique in a tag set. For example, you can have a key value pair in a tag set of project : Trinity and cost-center : Trinity

type kmsKeyArn:

string

param kmsKeyArn:

The Amazon Resource Name (ARN) of the KMS key used to encrypt the application's data at rest. If provided, the application uses your customer-managed key for encryption. If omitted, the application uses an AWS-managed key. The KMS key must be in the same region as the application.

rtype:

dict

returns:

Response Syntax

{
    'id': 'string',
    'name': 'string',
    'arn': 'string',
    'dataSources': [
        {
            'dataSourceArn': 'string',
            'dataSourceDescription': 'string',
            'iamRoleForDataSourceArn': 'string'
        },
    ],
    'iamIdentityCenterOptions': {
        'enabled': True|False,
        'iamIdentityCenterInstanceArn': 'string',
        'iamRoleForIdentityCenterApplicationArn': 'string',
        'iamIdentityCenterApplicationArn': 'string'
    },
    'appConfigs': [
        {
            'key': 'opensearchDashboards.dashboardAdmin.users'|'opensearchDashboards.dashboardAdmin.groups',
            'value': 'string'
        },
    ],
    'tagList': [
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'kmsKeyArn': 'string'
}

Response Structure

(dict) --
- id (string) --
  
  The unique identifier assigned to the OpenSearch application.
- name (string) --
  
  The name of the OpenSearch application.
- arn (string) --
  
  The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- dataSources (list) --
  
  The data sources linked to the OpenSearch application.
  - (dict) --
    
    Data sources that are associated with an OpenSearch application.
    - dataSourceArn (string) --
      
      The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
    - dataSourceDescription (string) --
      
      Detailed description of a data source.
    - iamRoleForDataSourceArn (string) --
      
      The ARN of the IAM role to be used for cross account/region data source association.
- iamIdentityCenterOptions (dict) --
  
  The IAM Identity Center settings configured for the OpenSearch application.
  - enabled (boolean) --
    
    Indicates whether IAM Identity Center is enabled for the OpenSearch application.
  - iamIdentityCenterInstanceArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
  - iamRoleForIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the IAM role assigned to the IAM Identity Center application for the OpenSearch application.
  - iamIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- appConfigs (list) --
  
  Configuration settings for the OpenSearch application, including administrative options.
  - (dict) --
    
    Configuration settings for an OpenSearch application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.
    - key (string) --
      
      The configuration item to set, such as the admin role for the OpenSearch application.
    - value (string) --
      
      The value assigned to the configuration key, such as an IAM user ARN.
- tagList (list) --
  
  A list of tags attached to a domain.
  - (dict) --
    
    A tag (key-value pair) for an Amazon OpenSearch Service resource.
    - Key (string) --
      
      The tag key. Tag keys must be unique for the domain to which they are attached.
    - Value (string) --
      
      The value assigned to the corresponding tag key. Tag values can be null and don't have to be unique in a tag set. For example, you can have a key value pair in a tag set of project : Trinity and cost-center : Trinity
- createdAt (datetime) --
  
  The timestamp indicating when the OpenSearch application was created.
- kmsKeyArn (string) --
  
  The Amazon Resource Name (ARN) of the KMS key used to encrypt the application's data at rest.

GetApplication (updated)

Link ¶
Changes (response)

{'dataSources': {'iamRoleForDataSourceArn': 'string'}}

Retrieves the configuration and status of an existing OpenSearch application.

See also: AWS API Documentation

Request Syntax

client.get_application(
    id='string'
)

type id:

string

param id:

[REQUIRED]

The unique identifier of the OpenSearch application to retrieve.

rtype:

dict

returns:

Response Syntax

{
    'id': 'string',
    'arn': 'string',
    'name': 'string',
    'endpoint': 'string',
    'status': 'CREATING'|'UPDATING'|'DELETING'|'ACTIVE'|'FAILED',
    'iamIdentityCenterOptions': {
        'enabled': True|False,
        'iamIdentityCenterInstanceArn': 'string',
        'iamRoleForIdentityCenterApplicationArn': 'string',
        'iamIdentityCenterApplicationArn': 'string'
    },
    'dataSources': [
        {
            'dataSourceArn': 'string',
            'dataSourceDescription': 'string',
            'iamRoleForDataSourceArn': 'string'
        },
    ],
    'appConfigs': [
        {
            'key': 'opensearchDashboards.dashboardAdmin.users'|'opensearchDashboards.dashboardAdmin.groups',
            'value': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'lastUpdatedAt': datetime(2015, 1, 1),
    'kmsKeyArn': 'string'
}

Response Structure

(dict) --
- id (string) --
  
  The unique identifier of the OpenSearch application.
- arn (string) --
  
  The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- name (string) --
  
  The name of the OpenSearch application.
- endpoint (string) --
  
  The endpoint URL of the OpenSearch application.
- status (string) --
  
  The current status of the OpenSearch application. Possible values: CREATING, UPDATING, DELETING, FAILED, ACTIVE, and DELETED.
- iamIdentityCenterOptions (dict) --
  
  The IAM Identity Center settings configured for the OpenSearch application.
  - enabled (boolean) --
    
    Indicates whether IAM Identity Center is enabled for the OpenSearch application.
  - iamIdentityCenterInstanceArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
  - iamRoleForIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the IAM role assigned to the IAM Identity Center application for the OpenSearch application.
  - iamIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- dataSources (list) --
  
  The data sources associated with the OpenSearch application.
  - (dict) --
    
    Data sources that are associated with an OpenSearch application.
    - dataSourceArn (string) --
      
      The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
    - dataSourceDescription (string) --
      
      Detailed description of a data source.
    - iamRoleForDataSourceArn (string) --
      
      The ARN of the IAM role to be used for cross account/region data source association.
- appConfigs (list) --
  
  The configuration settings of the OpenSearch application.
  - (dict) --
    
    Configuration settings for an OpenSearch application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.
    - key (string) --
      
      The configuration item to set, such as the admin role for the OpenSearch application.
    - value (string) --
      
      The value assigned to the configuration key, such as an IAM user ARN.
- createdAt (datetime) --
  
  The timestamp when the OpenSearch application was created.
- lastUpdatedAt (datetime) --
  
  The timestamp of the last update to the OpenSearch application.
- kmsKeyArn (string) --
  
  The Amazon Resource Name (ARN) of the KMS key used to encrypt the application's data at rest.

GetDirectQueryDataSource (updated)

Link ¶
Changes (response)

{'DataSourceAccessPolicy': 'string'}

Returns detailed configuration information for a specific direct query data source in Amazon OpenSearch Service.

See also: AWS API Documentation

Request Syntax

client.get_direct_query_data_source(
    DataSourceName='string'
)

type DataSourceName:

string

param DataSourceName:

[REQUIRED]

A unique, user-defined label that identifies the data source within your OpenSearch Service environment.

rtype:

dict

returns:

Response Syntax

{
    'DataSourceName': 'string',
    'DataSourceType': {
        'CloudWatchLog': {
            'RoleArn': 'string'
        },
        'SecurityLake': {
            'RoleArn': 'string'
        }
    },
    'Description': 'string',
    'OpenSearchArns': [
        'string',
    ],
    'DataSourceAccessPolicy': 'string',
    'DataSourceArn': 'string'
}

Response Structure

(dict) --
- DataSourceName (string) --
  
  A unique, user-defined label to identify the data source within your OpenSearch Service environment.
- DataSourceType (dict) --
  
  The supported Amazon Web Services service that is used as the source for direct queries in OpenSearch Service.
  Note
  
  This is a Tagged Union structure. Only one of the following top level keys will be set: CloudWatchLog, SecurityLake. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
```
'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
```
  - CloudWatchLog (dict) --
    
    Specifies CloudWatch Logs as a type of data source for direct queries.
    - RoleArn (string) --
      
      The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
  - SecurityLake (dict) --
    
    Specifies Security Lake as a type of data source for direct queries.
    - RoleArn (string) --
      
      The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
- Description (string) --
  
  A description that provides additional context and details about the data source.
- OpenSearchArns (list) --
  
  A list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source.
  - (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- DataSourceAccessPolicy (string) --
  
  The IAM access policy document that defines the permissions for accessing the direct query data source. Returns the current policy configuration in JSON format, or null if no custom policy is configured.
- DataSourceArn (string) --
  
  The unique, system-generated identifier that represents the data source.

UpdateApplication (updated)

Link ¶
Changes (both)

{'dataSources': {'iamRoleForDataSourceArn': 'string'}}

Updates the configuration and settings of an existing OpenSearch application.

See also: AWS API Documentation

Request Syntax

client.update_application(
    id='string',
    dataSources=[
        {
            'dataSourceArn': 'string',
            'dataSourceDescription': 'string',
            'iamRoleForDataSourceArn': 'string'
        },
    ],
    appConfigs=[
        {
            'key': 'opensearchDashboards.dashboardAdmin.users'|'opensearchDashboards.dashboardAdmin.groups',
            'value': 'string'
        },
    ]
)

type id:

string

param id:

[REQUIRED]

The unique identifier for the OpenSearch application to be updated.

type dataSources:

list

param dataSources:

The data sources to associate with the OpenSearch application.

(dict) --

Data sources that are associated with an OpenSearch application.
- dataSourceArn (string) --
  
  The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- dataSourceDescription (string) --
  
  Detailed description of a data source.
- iamRoleForDataSourceArn (string) --
  
  The ARN of the IAM role to be used for cross account/region data source association.

type appConfigs:

list

param appConfigs:

The configuration settings to modify for the OpenSearch application.

(dict) --

Configuration settings for an OpenSearch application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.
- key (string) --
  
  The configuration item to set, such as the admin role for the OpenSearch application.
- value (string) --
  
  The value assigned to the configuration key, such as an IAM user ARN.

rtype:

dict

returns:

Response Syntax

{
    'id': 'string',
    'name': 'string',
    'arn': 'string',
    'dataSources': [
        {
            'dataSourceArn': 'string',
            'dataSourceDescription': 'string',
            'iamRoleForDataSourceArn': 'string'
        },
    ],
    'iamIdentityCenterOptions': {
        'enabled': True|False,
        'iamIdentityCenterInstanceArn': 'string',
        'iamRoleForIdentityCenterApplicationArn': 'string',
        'iamIdentityCenterApplicationArn': 'string'
    },
    'appConfigs': [
        {
            'key': 'opensearchDashboards.dashboardAdmin.users'|'opensearchDashboards.dashboardAdmin.groups',
            'value': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'lastUpdatedAt': datetime(2015, 1, 1)
}

Response Structure

(dict) --
- id (string) --
  
  The unique identifier of the updated OpenSearch application.
- name (string) --
  
  The name of the updated OpenSearch application.
- arn (string) --
  
  The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- dataSources (list) --
  
  The data sources associated with the updated OpenSearch application.
  - (dict) --
    
    Data sources that are associated with an OpenSearch application.
    - dataSourceArn (string) --
      
      The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
    - dataSourceDescription (string) --
      
      Detailed description of a data source.
    - iamRoleForDataSourceArn (string) --
      
      The ARN of the IAM role to be used for cross account/region data source association.
- iamIdentityCenterOptions (dict) --
  
  The IAM Identity Center configuration for the updated OpenSearch application.
  - enabled (boolean) --
    
    Indicates whether IAM Identity Center is enabled for the OpenSearch application.
  - iamIdentityCenterInstanceArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
  - iamRoleForIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the IAM role assigned to the IAM Identity Center application for the OpenSearch application.
  - iamIdentityCenterApplicationArn (string) --
    
    The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.
- appConfigs (list) --
  
  The configuration settings for the updated OpenSearch application.
  - (dict) --
    
    Configuration settings for an OpenSearch application. For more information, see Using the OpenSearch user interface in Amazon OpenSearch Service.
    - key (string) --
      
      The configuration item to set, such as the admin role for the OpenSearch application.
    - value (string) --
      
      The value assigned to the configuration key, such as an IAM user ARN.
- createdAt (datetime) --
  
  The timestamp when the OpenSearch application was originally created.
- lastUpdatedAt (datetime) --
  
  The timestamp when the OpenSearch application was last updated.

UpdateDirectQueryDataSource (updated)

Link ¶
Changes (request)

{'DataSourceAccessPolicy': 'string'}

Updates the configuration or properties of an existing direct query data source in Amazon OpenSearch Service.

See also: AWS API Documentation

Request Syntax

client.update_direct_query_data_source(
    DataSourceName='string',
    DataSourceType={
        'CloudWatchLog': {
            'RoleArn': 'string'
        },
        'SecurityLake': {
            'RoleArn': 'string'
        }
    },
    Description='string',
    OpenSearchArns=[
        'string',
    ],
    DataSourceAccessPolicy='string'
)

type DataSourceName:

string

param DataSourceName:

[REQUIRED]

A unique, user-defined label to identify the data source within your OpenSearch Service environment.

type DataSourceType:

dict

param DataSourceType:

[REQUIRED]

The supported Amazon Web Services service that you want to use as the source for direct queries in OpenSearch Service.

CloudWatchLog (dict) --

Specifies CloudWatch Logs as a type of data source for direct queries.
- RoleArn (string) -- [REQUIRED]
  
  The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
SecurityLake (dict) --

Specifies Security Lake as a type of data source for direct queries.
- RoleArn (string) -- [REQUIRED]
  
  The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.

type Description:

string

param Description:

An optional text field for providing additional context and details about the data source.

type OpenSearchArns:

list

param OpenSearchArns:

[REQUIRED]

A list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source.

(string) --

The Amazon Resource Name (ARN) of the domain. See Identifiers for IAM Entities in Using Amazon Web Services Identity and Access Management for more information.

type DataSourceAccessPolicy:

string

param DataSourceAccessPolicy:

An optional IAM access policy document that defines the updated permissions for accessing the direct query data source. The policy document must be in valid JSON format and follow IAM policy syntax. If not specified, the existing access policy if present remains unchanged.

rtype:

dict

returns:

Response Syntax

{
    'DataSourceArn': 'string'
}

Response Structure

(dict) --
- DataSourceArn (string) --
  
  The unique, system-generated identifier that represents the data source.