Configure OpenSearch SSO with AWS IAM Identity Center

ClusterNest Managed OpenSearch can delegate Dashboards login to AWS IAM Identity Center via SAML. Identity Center's customer-managed application catalog is SAML 2.0 only - there's no generic OIDC app registration like Okta/Azure/Keycloak offer, so auth_type = "saml" is the only option here.

You'll need your cluster's OpenSearch Dashboards hostname before registering the app. Set opensearch_dashboards_custom_hostname so you know it upfront, or create the cluster first with auth_type = "internal" and note the generated opensearch_dashboards_url output before switching it over.

SAML

1. In the IAM Identity Center console, go to Applications > Customer managed > Add application. Under Setup preference choose I have an application I want to set up, Application type: SAML 2.0.
2. Under IAM Identity Center metadata, download the IAM Identity Center SAML metadata file. Unlike the other identity providers in this guide, Identity Center doesn't expose a fetchable metadata URL - only a downloadable XML file. Host it somewhere reachable over HTTPS (e.g. a public S3 object) and use that URL as idp_metadata_url.
3. Under Application metadata, choose Manually type your metadata values and enter:
   • Application ACS URL: https://<dashboards-hostname>/_opendistro/_security/saml/acs
   • Application SAML audience: the value you'll use as sp_entity_id below
4. Submit, then open the application's details page - it shows an IAM Identity Center Issuer value; use it as idp_entity_id.
5. Under the application's Assigned users tab, assign the users/groups who should have access - nothing is reachable until assigned.
6. For role mapping, add a mapping on the application's Attribute mappings tab (e.g. map a group attribute to a custom SAML attribute), and set roles_key to that attribute's name.

Console

In the ClusterNest console, open the cluster's create/edit form and set Authentication Type to SAML, then fill in:

• IDP Metadata URL: wherever you hosted the downloaded metadata file from step 2
• IDP Entity ID: the IAM Identity Center Issuer value from step 4
• SP Entity ID: opensearch-dashboards
• Roles Key: only if you added an attribute mapping in step 6

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_type       = "saml"
  saml_config = {
    idp_metadata_url = "https://my-idc-metadata.s3.amazonaws.com/opensearch-metadata.xml"
    idp_entity_id     = "https://identitycenter.amazonaws.com/ssoins-abcdef01234"
    sp_entity_id      = "opensearch-dashboards"
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

See the Terraform resource reference for the full field list.