/amazon-opensearch-service

Bedrock Connector Setup for AOS/AOSS

Creating a Bedrock Connector

Step 1: Create IAM Role for Connector

# Service principal: opensearchservice.amazonaws.com (AOS managed domains)
# For AOSS, use ml.opensearchservice.amazonaws.com instead (see AOSS-Specific Notes below)
# Both aws:SourceAccount and aws:SourceArn conditions are required to prevent
# confused-deputy: ArnLike narrows trust to a specific domain (or collection
# for AOSS — replace the resource pattern accordingly) so other domains in
# the same account can't assume this role.
aws iam create-role --role-name OpenSearchBedrockRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "opensearchservice.amazonaws.com"},
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {"aws:SourceAccount": "<account>"},
        "ArnLike":      {"aws:SourceArn":     "arn:aws:es:<region>:<account>:domain/<domain-name>"}
      }
    }]
  }'

Attach Bedrock access (least-privilege inline policy):

aws iam put-role-policy --role-name OpenSearchBedrockRole \
  --policy-name BedrockInvokeModel \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": "arn:aws:bedrock:<region>::foundation-model/amazon.titan-embed-text-v2:0"}]
  }'

Step 2: Create Connector

For Titan Embeddings V2 (1024 dimensions):

Use awscurl to call the OpenSearch API directly:

POST /_plugins/_ml/connectors/_create
{
  "name": "Amazon Bedrock Titan Embedding V2",
  "description": "Connector for Titan Text Embeddings V2",
  "version": 1,
  "protocol": "aws_sigv4",
  "parameters": {
    "region": "<region>",
    "service_name": "bedrock",
    "model": "amazon.titan-embed-text-v2:0"
  },
  "credential": {
    "roleArn": "arn:aws:iam::<account>:role/OpenSearchBedrockRole"
  },
  "actions": [{
    "action_type": "predict",
    "method": "POST",
    "url": "https://bedrock-runtime.<region>.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke",
    "headers": {"content-type": "application/json"},
    "request_body": "{\"inputText\": \"${parameters.inputText}\"}",
    "pre_process_function": "connector.pre_process.bedrock.embedding",
    "post_process_function": "connector.post_process.bedrock.embedding"
  }]
}

For Cohere Embed English V3 (1024 dimensions):

Replace model references with cohere.embed-english-v3 and update URL and request body accordingly.

Step 3: Register and Deploy Model

POST /_plugins/_ml/models/_register
{
  "name": "Bedrock Titan Embedding",
  "function_name": "remote",
  "connector_id": "<connector_id>"
}

Then deploy:

POST /_plugins/_ml/models/<model_id>/_deploy

Monitoring: Enable CloudTrail to audit bedrock:InvokeModel calls. Set up CloudWatch alarms on invocation latency and errors. Encryption: Ensure the OpenSearch domain/collection has encryption at rest enabled (KMS) before deploying the model and ingesting embeddings.

Supported Models

AOSS-Specific Notes

• Trust policy: On AOSS, the connector role must use ml.opensearchservice.amazonaws.com as service principal
• On AOSS, connector creation uses the same API but authentication flows through the collection endpoint
• Data access policies must grant the connector role aoss:ReadDocument, aoss:WriteDocument, and aoss:CreateIndex permissions on the collection
• Model deployment status can be checked via GET /_plugins/_ml/models/<model_id>