# AWS OpenSearch

This article outlines the integration with the AWS OpenSearch connector, enabling metadata management through features such as crawling, querying with data preview for supported objects. It also ensures secure authentication via Credential Manager.

<figure><img src="/files/lL0e8LrL3IRFfbykKDMJ" alt=""><figcaption></figcaption></figure>

### Overview

#### Connector Details

| Connector Category                                                                 | Application Connector                                        |
| ---------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| OvalEdge Releases Supported                                                        | 8.1                                                          |
| <p>Connectivity</p><p>\[How the connection is established with AWS OpenSearch]</p> | OpenSearch REST API over HTTPS with SigV4 signed requests \| |

#### Connector Features

| Crawling                                     |  ✅  |
| -------------------------------------------- | :-: |
| Delta Crawling                               |  ❌  |
| Profiling                                    |  ❌  |
| Query Sheet                                  |  ✅  |
| Data Preview                                 |  ✅  |
| Auto Lineage                                 |  ❌  |
| Manual Lineage                               |  ❌  |
| Secure Authentication via Credential Manager |  ✅  |
| Data Quality                                 |  ❌  |
| DAM (Data Access Management)                 |  ❌  |
| Bridge                                       |  ✅  |

#### Metadata Mapping

The following objects are crawled from AWS OpenSearch and mapped to the corresponding UI assets.

<table><thead><tr><th width="213">AWS OpenSearch Object</th><th width="226.39996337890625">AWS OpenSearch Attribute</th><th width="171.199951171875">OvalEdge Attribute</th><th width="178.4000244140625">OvalEdge Category</th><th width="152.2000732421875">OvalEdge Type</th></tr></thead><tbody><tr><td>Indexes</td><td>Index Name</td><td>Entity Identifier </td><td>Table / Entity</td><td>Entity </td></tr><tr><td>Index Fields</td><td>Mapping Property (including nested properties)</td><td>Column Name and Type</td><td>Column</td><td>Column</td></tr><tr><td>Aliases</td><td>Alias Name</td><td>Entity Identifier</td><td>View</td><td>Entity</td></tr><tr><td>Alias Details</td><td>Alias-to-Index Reference (when available)</td><td>Entity Comment / Description</td><td>View</td><td>Entity</td></tr></tbody></table>

### Set up a Connection

#### Prerequisites

The following are the prerequisites to establish a connection:

**Network and API access**

The connector sends **HTTPS** requests to your OpenSearch endpoint. Ensure your OvalEdge environment can reach the endpoint host and any required network egress rules allow access to the OpenSearch API. If you use corporate proxies, ensure they permit HTTPS traffic to the OpenSearch endpoint.

**Service Account User Permissions**

{% hint style="warning" %}
It is recommended to use a separate service account to establish the connection to the data source, configured with the following minimum set of permissions.
{% endhint %}

{% hint style="info" %}
👨‍💻 Who can provide these permissions? These permissions are typically granted by the AWS Opensearch administrator, as users may not have the required access to assign them independently.
{% endhint %}

| Operation                  | Objects             | System Tables                  | Access Permission                                                 |
| -------------------------- | ------------------- | ------------------------------ | ----------------------------------------------------------------- |
| Connection Validation      | OpenSearch Endpoint | GET/                           | Ability to authenticate and read the OpenSearch endpoint response |
| Crawling                   | Indexes             | GET /\_cat/indices?format=json | Ability to list index names                                       |
| Crawling                   | Aliases             | GET /\_cat/aliases?format=json | Ability to list alias names                                       |
| Field Discovery            | Indexes             | GET /{index}/\_mapping         | Ability to read index mappings (Field definitions)                |
| Query Sheet / Data Preview | Indexes             | POST /{index}/\_search         | Ability to search and read document \`\_source\` fields           |

#### Connection Configuration Steps

{% hint style="warning" %}
Users are required to have the Connector Creator role in order to configure a new connection.<br>
{% endhint %}

1. Log into OvalEdge, go to **Administration > Connectors**, click **+ (New Connector),** search for **AWS OpenSearch**, and complete the required parameters.

{% hint style="info" %}
Fields marked with an asterisk (\*) are mandatory for establishing a connection.
{% endhint %}

<table><thead><tr><th width="219.60003662109375">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Connector Type</td><td>By default, "<strong>AWS OpenSearch</strong>" is displayed as the selected connector type.</td></tr><tr><td>Credential Manager*</td><td><p>Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on your selection.</p><p>Supported Credential Managers:</p><ul><li>OE Credential Manager</li><li>AWS Secrets Manager</li><li>HashiCorp Vault</li><li>Azure Key Vault</li></ul></td></tr><tr><td>Connector Name*</td><td><p>Enter a unique name for the AWS OpenSearch connection              </p><p>(<strong>Example</strong>: "AWS_OpenSearch").</p></td></tr><tr><td>Connector description</td><td>Enter a brief description of the connector.</td></tr><tr><td>Endpoint*</td><td><p>Enter the OpenSearch HTTPS endpoint (without a trailing slash). </p><p><strong>Example</strong>: https://search-my-domain-xxxx.us-east-1.es.amazonaws.com</p></td></tr><tr><td>AWS Region*</td><td><p>Enter the AWS region used for request signing. </p><p><strong>Example</strong>: us-east-1</p></td></tr><tr><td>AWS Access Key Id*</td><td>Enter the AWS IAM access key ID used to sign OpenSearch requests</td></tr><tr><td>AWS Secret Access Key*</td><td>Enter the AWS IAM secret access key used for signing (masked).</td></tr><tr><td>AWS Session Token</td><td>Enter the session token if using temporary credentials (optional, masked) </td></tr><tr><td>SigV4 Service Name</td><td>Enter the service name for signing: use es for OpenSearch Service and aoss for OpenSearch Serverless</td></tr><tr><td>Index Include Pattern</td><td>Enter a wildcard pattern to include specific indices (optional). <strong>Example</strong>: logs-*. Leave blank to include all indices</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="257.199951171875"></th><th></th></tr></thead><tbody><tr><td><strong>Default Governance Roles</strong></td><td></td></tr><tr><td>Default Governance Roles*</td><td>Select the appropriate users or teams for each governance role from the drop-down list. All users and teams configured in OvalEdge Security are displayed for selection.</td></tr><tr><td><strong>Admin Roles</strong></td><td></td></tr><tr><td>Admin Roles*</td><td>Select one or more users from the dropdown list for Integration Admin and Security &#x26; Governance Admin. All users configured in OvalEdge Security are available for selection.</td></tr><tr><td><strong>No of Archive Objects</strong></td><td></td></tr><tr><td>No Of Archive Objects*</td><td><p>This shows the number of recent metadata changes to a dataset at the source. By default, it is off. To enable it, toggle the Archive button and specify the number of objects to archive.</p><p>Example: Setting it to 4 retrieves the last four changes, displayed in the 'Version' column of the 'Metadata Changes' module.</p></td></tr><tr><td><strong>Bridge</strong></td><td></td></tr><tr><td>Select Bridge*</td><td><p>If applicable, select the bridge from the drop-down list.</p><p>The drop-down list displays all active bridges configured in OvalEdge. These bridges enable communication between data sources and OvalEdge without altering firewall rules.</p></td></tr></tbody></table>

2. After entering all connection details, the following actions can be performed:
   1. Click **Validate** to verify the connection.
   2. Click **Save** to store the connection for future use.
   3. Click **Save & Configure** to apply additional settings before saving.
3. The saved connection will appear on the Connectors home page.

### Manage Connector Operations

#### Crawl/Profile

{% hint style="warning" %}
To perform crawl operations, users must be assigned the Integration Admin role.\
For AWS OpenSearch, the connector exposes a container representing your OpenSearch endpoint, and crawling discovers indices and aliases available under that endpoint.
{% endhint %}

The **Crawl/Profile** button allows users to select one or more containers for crawling.&#x20;

1. Navigate to the **Connectors** page and click **Crawl/Profile**.
2. Select the **OpenSearch** endpoint container to **crawl**.
3. The **Crawl** option is selected by default.&#x20;
4. Click **Run** to collect metadata from the connected source and load it into the OvalEdge **Data Catalog**.
5. After a **successful crawl**, the information appears in the **Data Catalog > Databases/Tables/Reports/Files/APIs** tab.

The **Schedule** checkbox allows automated **crawling** at defined intervals, from a minute to a year.

1. Click the **Schedule** checkbox to enable the Select **Period drop-down**.
2. Select a **time period** for the operation from the drop-down menu.
3. Click **Schedule** to initiate metadata collection from the connected source.
4. The system will automatically execute the crawl operation at the scheduled time.

#### Other Operations

The **Connectors** page in OvalEdge provides a centralized view of all configured connectors, including their health status.

**Managing connectors includes:**

* **Connectors Health:** Displays the current status of each connector using a green icon for active connections and a red icon for inactive connections, helping to monitor the connectivity with data sources.
* **Viewing:** Click the Eye icon next to the connector name to view connector details, including databases, tables, columns, and codes.

**Nine Dots Menu Options:**

To view, edit, validate, configure, or delete connectors, click on the Nine Dots menu.

* **Edit Connector:** Update and revalidate the data source.
* **Validate Connector:** Check the connection's integrity.
* **Settings:** Modify connector settings.
  * **Crawler:** Configure data extraction.
  * **Query Policies:** Define query execution rules based on roles.
  * **Access Instructions:** Add notes on how data can be accessed.
  * **Business Glossary Settings:** Manage term associations at the connector level.
* **Delete Connector:** Remove a connector with confirmation.

#### Connectivity Troubleshooting

If incorrect parameters are entered, error messages may appear. Ensure all inputs are accurate to resolve these issues. If issues persist, contact the assigned support team.

<table><thead><tr><th width="85.79998779296875">S.No.</th><th width="258.99993896484375">Error Message(s)</th><th>Error Description &#x26; Resolution</th></tr></thead><tbody><tr><td>1</td><td>Invalid connection config</td><td><p><strong>Error Description:</strong> </p><ul><li>The connector validation ran without a complete connection configuration.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Ensure all required fields are provided in the connector settings and validate again.</li></ul></td></tr><tr><td>2</td><td>Missing OpenSearch endpoint</td><td><p><strong>Error Description:</strong> </p><ul><li>The OpenSearch endpoint is not provided.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Enter a valid Endpoint (including https://) and retry validation.</li></ul></td></tr><tr><td>3</td><td>Missing AWS region</td><td><p><strong>Error Description:</strong> </p><ul><li>The AWS region required for request signing is missing.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Provide a valid AWS Region and retry validation.</li></ul></td></tr><tr><td>4</td><td>Missing AWS access key id</td><td><p><strong>Error Description:</strong> </p><ul><li>The AWS access key ID is missing.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Enter a valid AWS Access Key ID and retry validation.</li></ul></td></tr><tr><td>5</td><td><p>Missing AWS secret access key</p><p><br></p></td><td><p><strong>Error Description:</strong> </p><ul><li>The AWS secret access key is missing.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Enter a valid AWS Secret Access Key and retry validation.</li></ul></td></tr><tr><td>6</td><td>Connection validation failed</td><td><p><strong>Error Description:</strong> </p><ul><li>The system failed to connect or authenticate with the OpenSearch endpoint.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Verify the endpoint, AWS region, and credentials. Check network connectivity to the OpenSearch endpoint and retry validation.</li></ul></td></tr><tr><td>7</td><td>Query execution failed</td><td><p><strong>Error Description:</strong> </p><ul><li>The query or data preview request failed during execution.</li></ul><p><strong>Resolution:</strong> </p><ul><li>Verify that the index exists, check that the index include pattern, and retry after successful validation.</li></ul></td></tr></tbody></table>

***

Copyright © 2026, OvalEdge LLC, Peachtree Corners GA USA


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.ovaledge.com/release8.1/connectors/connector-repositories/application/aws-opensearch.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.