Amazon OpenSearch Serverless
Arpio replicates OpenSearch Serverless (AOSS) collections and the policies that govern them to your recovery environment.
Collection
During backup, Arpio captures the structure of each collection's indexes — their mappings and settings — and stores it with the recovery point. When you fail over, those indexes are recreated in the recovered collection with the mappings they had at backup.
The documents inside an index are not backed up so Arpio never reads or replicates them. By default every index in the collection is captured; you can narrow that with the arpio-config:opensearch-indexes tag on the collection.
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
KMS key ARN |
A customer-managed key belongs to one account, so the recovered collection is encrypted with the mirrored key on the recovery site. If the key cannot be translated, the collection falls back to an AWS-owned key. |
The following resources are automatically selected when a Collection is selected:
- The collection group the collection belongs to (NextGen collections only)
- The KMS key used for encryption-at-rest, when the collection does not use an AWS-owned key
- Every encryption and network security policy whose rules select the collection by name
- Every data access policy whose rules select the collection by name
- Every lifecycle policy whose rules select the collection by name
Collection Group
Arpio replicates selected collection groups to the recovery environment unchanged.
Security Policy
AOSS security policies come in two types, encryption and network. Arpio replicates both.
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
KMS key ARN (encryption policies) |
The KmsARN naming the customer-managed key is switched to the matching key on the recovery site. If the key cannot be translated, it is removed and the policy falls back to an AWS-owned key. |
|
Source VPC endpoints (network policies) |
The endpoint ids listed in SourceVPCEs are switched to the ids of the recovered endpoints — an OpenSearch Serverless-managed endpoint for a Classic collection, or an EC2 interface endpoint for a NextGen one. An id with no recovered counterpart is dropped. |
The following resources are automatically selected when a Security Policy is selected:
- The KMS key named by KmsARN, for an encryption policy that uses a customer-managed key
- The VPC endpoints named in SourceVPCEs, for a network policy
Data Access Policy
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
Principals |
The IAM role and user ARNs in each block's Principal list are switched to their counterparts on the recovery site. If a source principal carries the arpio-config:recovery-principal-arn tag, the ARN in that tag is used instead. Wildcards and other non-ARN principals are left unchanged. A principal with no counterpart on the recovery site is replaced with an unassumable placeholder role rather than dropped, so the policy stays valid without granting the source account access to recovered data. |
The following resources are automatically selected when a Data Access Policy is selected:
- IAM roles and users named as principals in the policy
Lifecycle Policy
Arpio replicates selected lifecycle policies to the recovery environment unchanged.
VPC Endpoint
An OpenSearch Serverless VPC endpoint is what makes a private collection reachable. It is recovered at standby, ahead of the network policies that name it.
|
Attribute |
Translation |
|---|---|
|
VPC ID |
The VPC ID is translated to the corresponding recovery VPC. |
|
Subnets |
The subnet IDs are translated to the corresponding recovery subnets. |
|
Security Groups |
The security group IDs are translated to the corresponding recovery security groups. |
The following resources are automatically selected when a VPC Endpoint is selected:
- The VPC the endpoint is created in
- The subnets the endpoint is attached to
- The security groups attached to the endpoint