Configure SAML federation for Amazon OpenSearch Serverless with AWS IAM Identity Center

Amazon OpenSearch Serverless is a serverless option of Amazon OpenSearch Service that makes it easy for you to run large-scale search and analytics workloads without having to configure, manage, or scale OpenSearch clusters. It automatically provisions and scales the underlying resources to deliver fast data ingestion and query responses for even the most demanding and unpredictable workloads. With OpenSearch Serverless, you can configure SAML to enable users to access data through OpenSearch Dashboards using an external SAML identity provider (IdP).

AWS IAM Identity Center (Successor to AWS Single Sign-On) helps you securely create or connect your workforce identities and manage their access centrally across AWS accounts and applications, OpenSearch Dashboards being one of them.

In this post, we show you how to configure SAML authentication for OpenSearch Dashboards using IAM Identity Center as its IdP.

Solution overview

The following diagram illustrates how the solution allows users or groups to authenticate into OpenSearch Dashboards using single sign-on (SSO) with IAM Identity Center using its built-in directory as the identity source.

The workflow steps are as follows:

1. A user accesses the OpenSearch Dashboard URL in their browser and chooses the SAML provider.
2. OpenSearch Serverless redirects the login to the specified IdP.
3. The IdP provides a login form for the user to specify the credentials for authentication.
4. After the user is authenticated successfully, a SAML assertion is sent back to OpenSearch Serverless.

OpenSearch Serverless validates the SAML assertion, and the user logs in to OpenSearch Dashboards.

Prerequisites

To get started, you must have an active OpenSearch Serverless collection. Refer to Creating and managing Amazon OpenSearch Serverless collections to learn more about creating a collection. Furthermore, you must have the correct AWS Identity and Access Management (IAM) permissions for configuring SAML authentication along with relevant IAM permissions for configuring the data access policy.

IAM Identity Center should be enabled, and you should have the relevant IAM permissions to create an application in IAM Identity Center and create and manage users and groups.

Create and configure the application in IAM Identity Center

To set up your application in IAM Identity Center, complete the following steps:

1. On the IAM Identity Center dashboard, choose Applications in the navigation pane.
2. Choose Add application
   
3. For Custom application, select Add custom SAML 2.0 application.
4. Choose Next.
   
5. Under Configure application, enter a name and description for the application.
6. Under IAM Identity Center metadata, choose Download under IAM Identity Center SAML metadata file.
   

We use this metadata file to create a SAML provider under OpenSearch Serverless. It contains the public certificate used to verify the signature of the IAM Identity Center SAML assertions.

7. Under Application properties, leave Application start URL and Relay state blank.
8. For Session duration, choose 1 hour (the default value).
   

Note that the session duration you configure in this step takes precedence over the OpenSearch Dashboards timeout setting specified in the configuration of the SAML provider details on the OpenSearch Serverless end.

9. Under Application metadata, select Manually type your metadata values.
10. For Application ACS URL, enter your URL using the format https://collection.<REGION>.aoss.amazonaws.com/_saml/acs. For example, we enter https://collection.us-east-1.aoss.amazonaws.com/_saml/acs for this post.
11. For Application SAML audience, enter your service provider in the format aws:opensearch:<aws account id>.
    
12. Choose Submit.

Now you modify the attribute settings. The attribute mappings you configure here become part of the SAML assertion that is sent to the application.

13. On the Actions menu, choose Edit attribute mappings.
    
14. Configure Subject to map to ${user:email}, with the format unspecified.

Using ${user:email} here ensures that the email address for the user in IAM Identity Center is passed in the <NameId> tag of the SAML response.

15. Choose Save changes.
    

Now we assign a user to the application.

16. Create a user in IAM Identity Center to use to log in to OpenSearch Dashboards.

Alternatively, you can use an existing user.

17. On the IAM Identity Center console, navigate to your application and choose Assign Users and select the user(s) you would like to assign.
    

You have now created a custom SAML application. Next, you will configure the SAML provider in OpenSearch Serverless.

Create a SAML provider

The SAML provider you create in this step can be assigned to any collection in the same Region. Complete the following steps:

1. On the OpenSearch Service console, under Serverless in the navigation pane, choose SAML authentication under Security.
2. Choose Create SAML provider.
   
3. Enter a name and description for your SAML provider.
4. Enter the metadata from your IdP that you downloaded earlier.
   
5. Under Additional settings, you can optionally add custom user ID and group attributes. We leave these settings blank for now.
6. Choose Create a SAML provider.
   

You have now configured a SAML provider for OpenSearch Serverless. Next, we walk you through configuring the data access policy for accessing collections.

Create the data access policy

In this section, you set up data access policies for OpenSearch Serverless and allow access to the users. Complete the following steps:

1. On the OpenSearch Service console, under Serverless in the navigation pane, choose Data access policies under Security.
2. Choose Create access policy.
   
3. Enter a name and description for your access policy.
4. For Policy definition method, select Visual Editor.
5. In the Rules section, enter a rule name.
6. Under Select principals, for Add principals, choose SAML users and groups.
   
7. For SAML provider name, choose the SAML provider you created earlier.
   
8. Specify the user in the format user/<email> (for example, user/test@example.com).

The value of the email address should match the email address in IAM Identity Center.

9. Choose Save.
10. Choose Grant and specify the permissions.

You can configure what access you want to provide for the specific user at the collection level and specific indexes at the index pattern level.

You should select the access the user needs based on the least privilege model. Refer to Supported policy permissions and Supported OpenSearch API operations and permissions to set up more granular access for your users.

11. Choose Save and configure any additional rules, if required.
    

You can now review and edit your configuration if needed.

12. Choose Create to create the data access policy.
    

Now you have the data access policy that will allow the users to perform the allowed actions on OpenSearch Dashboards.

Access OpenSearch Dashboards

To sign in to OpenSearch Dashboards, complete the following steps:

1. On the OpenSearch Service dashboard, under Serverless in the navigation pane, choose Dashboard.
2. Locate your dashboard and copy the OpenSearch Dashboards URL (in the format <collection-endpoint>/_dashboards).
   
3. Enter this URL into a new browser tab.
4. On the OpenSearch login page, choose your IdP and specify your SSO credentials.
5. Choose Login.
   

Configure SAML authentication using groups in IAM Identity Center

Groups can help you organize your users and permissions in a coherent way. With groups, you can add multiple users from the IdP, and then use groupid as the identifier in the data access policy. For more information, refer to Add groups and Add users to groups.

To configure group access to OpenSearch Dashboards, complete the following steps:

1. On the IAM Identity Center console, navigate to your application.
2. In the Attribute mappings section, add an additional user as group and map it to ${user:groups}, with the format unspecified.
3. Choose Save changes.
   
4. For the SAML provider in OpenSearch Serverless, under Additional settings, for Group attribute, enter group.
   
5. For the data access policy, create a new rule or add an additional principal in the previous rule.
6. Choose the SAML provider name and enter group/<GroupId>.
   

You can fetch the value for the group ID by navigating to the Group section on the IAM Identity Center console.

Clean up

If you don’t want to continue using the solution, be sure to delete the resources you created:

1. On the IAM Identity Center console, remove the application.
2. On OpenSearch Dashboards, delete the following resources:
   1. Delete your collection.
   2. Delete the data access policy.
   3. Delete the SAML provider.

Conclusion

In this post, you learned how to set up IAM Identity Center as an IdP to access OpenSearch Dashboards using SAML as SSO. You also learned on how to set up users and groups within IAM Identity Center and control the access of users and groups for OpenSearch Dashboards. For more details, refer to SAML authentication for Amazon OpenSearch Serverless.

Stay tuned for a series of posts focusing on the various options available for you to build effective log analytics and search solutions using OpenSearch Serverless. You can also refer to the Getting started with Amazon OpenSearch Serverless workshop to know more about OpenSearch Serverless.

If you have feedback about this post, submit it in the comments section. If you have questions about this post, start a new thread on the OpenSearch Service forum or contact AWS Support.

About the Authors

Utkarsh Agarwal is a Cloud Support Engineer in the Support Engineering team at Amazon Web Services. He specializes in Amazon OpenSearch Service. He provides guidance and technical assistance to customers thus enabling them to build scalable, highly available and secure solutions in AWS Cloud. In his free time, he enjoys watching movies, TV series and of course cricket! Lately, he his also attempting to master the art of cooking in his free time – The taste buds are excited, but the kitchen might disagree.

Ravi Bhatane is a software engineer with Amazon OpenSearch Serverless Service. He is passionate about security, distributed systems, and building scalable services. When he’s not coding, Ravi enjoys photography and exploring new hiking trails with his friends.

Prashant Agrawal is a Sr. Search Specialist Solutions Architect with Amazon OpenSearch Service. He works closely with customers to help them migrate their workloads to the cloud and helps existing customers fine-tune their clusters to achieve better performance and save on cost. Before joining AWS, he helped various customers use OpenSearch and Elasticsearch for their search and log analytics use cases. When not working, you can find him traveling and exploring new places. In short, he likes doing Eat → Travel → Repeat.