AWS OpenSearch

1. In Polytomic, go to Connections → Add connection → AWS OpenSearch.

2. Enter the following information:

• Endpoint(s): your OpenSearch domain endpoint, including https:// (for example, https://search-my-domain-abc123.us-east-1.es.amazonaws.com). You can find this on the domain's page in the Amazon OpenSearch Service console. Separate multiple endpoints with commas.
• AWS access key ID and AWS secret access key: credentials for an IAM user with the permissions below. Polytomic connects to OpenSearch with access keys only. IAM role authentication isn't supported.
• Region: the AWS region of your domain (e.g. us-west-1).

📘

OpenSearch Serverless

Polytomic supports Amazon OpenSearch Service domains. OpenSearch Serverless collections aren't supported.

3. Click Save.

IAM permissions

Polytomic signs requests to your domain with the IAM user's credentials. Search and scroll requests use POST and DELETE, so reading from OpenSearch requires the following IAM actions:

• es:ESHttpGet
• es:ESHttpHead
• es:ESHttpPost
• es:ESHttpDelete

When writing to OpenSearch, Polytomic also creates indexes and updates their mappings and settings. Writing requires one more action:

• es:ESHttpPut

For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "es:ESHttpGet",
        "es:ESHttpHead",
        "es:ESHttpPost",
        "es:ESHttpPut",
        "es:ESHttpDelete"
      ],
      "Resource": "arn:aws:es:us-east-1:111122223333:domain/my-domain/*"
    }
  ]
}

If your domain uses fine-grained access control, you must also map the IAM user's ARN to an OpenSearch role. The role needs read access to the indexes you sync from, and write access (including index creation) to the indexes you sync to.