Using the OpenSearch user interface in Amazon OpenSearch Service

​The OpenSearch user interface (UI) is a web-based application for Amazon OpenSearch Service that lets you visualize and interact with data stored in more than one OpenSearch resources. It contains customizable dashboards, advanced data exploration, and support for multiple query languages. You can use the OpenSearch UI to manage multiple OpenSearch clusters, OpenSearch Serverless collections, and other integrated data sources from a unified interface.

Unlike OpenSearch Dashboards, which runs within individual domains or collections and supports only one data source, the OpenSearch UI runs in the AWS Cloud. It connects to multiple data sources to provide a unified view of your data. For information about OpenSearch Dashboards, see Using OpenSearch Dashboards with Amazon OpenSearch Service.

The OpenSearch UI has the following features:

After you create an OpenSearch UI application, associate it with data sources to analyze, query, and visualize data across your infrastructure. Then, configure workspaces within the application, which provide tailored experiences for observability, security analytics, and team collaboration. Each workspace has its own data sources, collaborators, and access controls, which makes it easy to manage permissions.

Creating an OpenSearch UI application

Create an application by providing a name, authentication method, and administrators.

aws opensearchservice create-application \
  --name myapplication \
  --iam-identity-center-options '{
      "enabled": true,
      "iamIdentityCenterInstanceArn": "arn:aws:sso:::instance/ssoins-xxxxxxxxx",
      "iamRoleForIdentityCenterApplicationArn": "arn:aws:iam::123456789012:role/xxxxxxxx"
  }'

Configuring single sign-on authentication

You can control access to an OpenSearch application using AWS Identity and Access Management (IAM) or IAM Identity Center.

To enable IAM Identity Center, select Authenticate with IAM Identity Center when you create an application, and choose an IAM role.

The role must have the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IdentityStoreOpenSearchDomainConnectivity",
            "Effect": "Allow",
            "Action": [
                "identitystore:DescribeUser",
                "identitystore:ListGroupMembershipsForMember",
                "identitystore:DescribeGroup"
            ],
            "Resource": "*",
            "Condition": { 
                "ForAnyValue:StringEquals": {
                    "aws:CalledViaLast": "es.amazonaws.com"
                }
            }
        },
        {
            "Sid": "OpenSearchDomain", 
            "Effect": "Allow",
            "Action": [
                "es:ESHttp*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "OpenSearchServerless", // If users need to access OpenSearch Serverless collections
            "Effect": "Allow",
            "Action": [
                "aoss:APIAccessAll"
            ],
            "Resource": "*"
        }
    ]
}

The role must have the following trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "application.opensearchservice.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetContext"
            ],
            "Condition": {
                "ForAllValues:ArnEquals": {
                    "sts:RequestContextProviders": "arn:aws:iam::aws:contextProvider/IdentityCenter"
                }
            }
        }
    ]
}

Associating data sources with your application

After you create an OpenSearch application, associate it with one or more data sources to analyze, query and visualize data across your infrastructure. An application can connect to multiple data sources, including OpenSearch Service domains and OpenSearch Serverless collections. It also supports external sources like Amazon Security Lake and Amazon CloudWatch Logs.

aws opensearch update-application \
  --name myapplication \
  --data-sources "[{\"dataSourceArn\": \"arn:aws:es:us-east-1:123456789012:domain/domain-name\"}]"

Integrating applications with OpenSearch domains in a VPC

To use a VPC-based domain as a data source for a UI application, you must first grant access to the domain.

aws opensearch authorize-vpc-endpoint-access \
  --domain-name domain-name \
  --service application.opensearchservice.amazonaws.com

Integrating applications with OpenSearch Serverless collections in a VPC

To use an OpenSearch Serverless collection within a VPC as a data source for an application, you must first grant access to the collection by creating and attaching a network policy to it.

[{
    "Description" : "Network policy statement",
    "Rules": [{
       "ResourceType" : "collection",
        "Resource" : ["collection/collection-name"]
     }],
    "SourceServices" : [
          "application.opensearchservice.amazonaws.com"
      ],
      "AllowFromPublic" : false
}]

Setting up workspaces

After you create an OpenSearch application with associated data sources and user permissions, the next step is to launch the application and create workspaces. Choose Launch application or use the application URL. The homepage displays all existing workspaces, categorized by use case.

For instructions to create a workspace, see Create a workspace in the OpenSearch documentation.

You can choose from the following workspace types, each taylored to specific use cases.