Connect OpenSearch with AWS IAM (SigV4) – StackOne Hub

Check the endpoint hostname:

• AWS OpenSearch Service (Managed domain) — host ends in .es.amazonaws.com, e.g. search-mydomain-abc123.us-east-1.es.amazonaws.com. Signing service: es.
• AWS OpenSearch Serverless (Collection) — host ends in .aoss.amazonaws.com, e.g. abcd1234.us-east-1.aoss.amazonaws.com. Signing service: aoss.
• Reference: Making and signing OpenSearch Service requests.

Sign in to the AWS IAM Console as an administrator, then:

• Go to Users > Create user.
• Enter a User name (e.g. stackone-opensearch) and click Next.
• On Set permissions, attach the policy that matches your product (next step below), then click Next, review, and click Create user.
• Reference: Create an IAM user in your AWS account.

Which IAM policy the user needs depends on whether you’re connecting to a Managed domain or a Serverless collection.

• OpenSearch Service (Managed) — attach AmazonOpenSearchServiceFullAccess (broad) or a scoped policy allowing es:ESHttp* on your domain ARN. Also ensure the domain access policy references the IAM user’s ARN — under Amazon OpenSearch Service > select domain > Actions > Edit security configuration, edit the resource-based access policy to allow the principal. Reference: Fine-grained access control.
• OpenSearch Serverless — the user needs BOTH IAM permissions (aoss:APIAccessAll and aoss:DashboardsAccessAll on the collection ARN) AND a data-access policy granting collection/index permissions. Without both, requests return 403. Reference: Data access control for Amazon OpenSearch Serverless.

Data access policies are separate from IAM permissions and required for every Serverless collection.

• Open the Amazon OpenSearch Service console. In the left nav pane, expand Serverless and under Security choose Data access policies.
• Choose Create access policy. Provide a name and description, then a rule name (e.g. stackone-integration).
• Choose Add principals and select the IAM user’s ARN.
• Choose Grant and select the collection and index permissions the connector needs (for read-only datasync: aoss:DescribeCollectionItems, aoss:ReadDocument, aoss:DescribeIndex).
• Choose Create. Enforcement may lag up to a minute.

In the IAM Console:

• Open the user you just created, go to the Security credentials tab, and in the Access keys panel choose Create access key.
• On the Access key best practices & alternatives screen, pick a use-case (Third-party service is appropriate for StackOne), acknowledge the recommendation checkbox, and click Next.
• Add an optional description tag (e.g. stackone-integration) and click Create access key.
• Copy the Access key (Access Key ID, format AKIAIOSFODNN7EXAMPLE) and the Secret access key (format wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) immediately — the secret can only be retrieved at creation time. If you lose it, delete the key and create a new one.
• Reference: Manage access keys for IAM users.

For higher-security setups, use short-lived STS credentials from an assume-role or federated session.

• Call sts:AssumeRole (or your identity federation flow) to obtain a temporary access key pair plus a Session Token.
• Paste all three values into the corresponding StackOne fields (Access Key ID, Secret Access Key, AWS Session Token) — StackOne signs each request with all three.
• Refresh the credentials before the STS expiry and update the connection — StackOne does not renew STS credentials automatically.

Two convenient options:

• curl (7.75+): curl --aws-sigv4 'aws:amz:{region}:{service}' -u '{accessKeyId}:{secretAccessKey}' https://{coreBaseUrl}/_cluster/health — set {service} to es or aoss to match your product.
• awscurl: awscurl --service {service} --region {region} https://{coreBaseUrl}/_cluster/health.
• 403 Forbidden on Serverless — you likely have IAM permissions but not a matching data-access policy. Re-check the data-access policy principals.
• 403 Forbidden on Managed — the domain access policy does not reference this IAM principal. Edit the domain’s access policy to grant es:ESHttp* for this user.
• Signature does not match — usually a wrong region or awsService value in the connection fields.

Copy each value from the IAM Console and the AWS OpenSearch console.

• OpenSearch Endpoint URL — the HTTPS endpoint from step 1.
• AWS Access Key ID — the Access Key ID from step 3.
• AWS Secret Access Key — the Secret Access Key from step 3.
• AWS Session Token — only for temporary STS credentials; leave blank for long-term IAM user access keys.
• AWS Region — the region hosting the endpoint (e.g. us-east-1, eu-west-2).
• AWS Service — es for AWS OpenSearch Service (Managed domain), aoss for AWS OpenSearch Serverless. This value is used as the SigV4 signing service and must match your endpoint host suffix.
• OpenSearch Dashboards URL — optional. For Managed domains, the Dashboards URL is {coreBaseUrl}/_dashboards. For Serverless, the Dashboards URL is https://dashboards.{region}.aoss.amazonaws.com/_login/?collectionId={collection-id} (found on the collection’s detail page). Required only for dashboards_* actions.