Data Source Connection

Data source connection issues can occur when associating OpenSearch domains or serverless collections with your application, or when an existing connection becomes unhealthy. This guide covers the most common failure scenarios and their resolutions.

When you view your application's data sources, each one shows a health status:

Symptoms: When calling update-application, you get an error indicating the domain doesn't exist.

Common causes:

1. Wrong region — The domain is in a different region than the application

   Copy

   # Check which region the domain is in
   aws opensearch list-domain-names --region us-east-1
   aws opensearch list-domain-names --region us-west-2

2. Wrong account — The domain is in a different AWS account

   • For cross-account access, see Cross-Account Access

3. Domain name typo — The ARN contains an incorrect domain name

   Copy

   # List all domains to verify the name
   aws opensearch list-domain-names --region us-east-1

4. Domain was deleted — The domain no longer exists

   Copy

   aws opensearch describe-domain --domain-name my-domain --region us-east-1

Symptoms: The update-application call fails with an access denied error.

Diagnosis:

1. Check your IAM permissions:

   Copy

   aws sts get-caller-identity

2. Verify the required permissions exist:

   Copy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "es:UpdateApplication",
           "es:DescribeDomain",
           "es:DescribeDomains"
         ],
         "Resource": "*"
       }
     ]
   }

3. Check the domain's access policy:

   Copy

   aws opensearch describe-domain-config \
       --domain-name my-domain \
       --query 'DomainConfig.AccessPolicies' \
       --region us-east-1

Solution:

The domain's access policy must allow the OpenSearch UI service:

Symptoms: The API rejects the data source ARN format.

Common ARN format issues:

Note that serverless collections use aoss (not es) and use the collection ID (not name):

The inbound cross-cluster connection hasn't been accepted.

Accept the connection:

1. Verify the cross-cluster connection is Active:

   Copy

   aws opensearch describe-outbound-connections \
       --filters '[{"Name": "connection-status", "Values": ["ACTIVE"]}]' \
       --region us-west-2

2. Check the remote domain's access policy includes the source account

3. For VPC domains, verify VPC endpoint authorization includes the source account:

   Copy

   aws opensearch authorize-vpc-endpoint-access \
       --domain-name remote-domain \
       --service application.opensearchservice.amazonaws.com \
       --account 123456789012 \
       --region us-west-2

An unhealthy data source means the application can connect but the domain itself has issues.

Check the domain's cluster health:

Check CloudWatch metrics for the domain:

Disk space full:

High memory pressure:

• Scale up the instance type in the domain configuration
• Reduce concurrent query load

Too many shards:

• Use Index State Management (ISM) policies to automatically delete or rollover old indices
• Merge small indices

1. Verify the collection exists and is Active:

   Copy

   aws opensearchserverless list-collections --region us-east-1

2. Check that the collection is in the same region as the application

3. Verify your IAM permissions include aoss:BatchGetCollection

Serverless collections require both a network policy and a data access policy:

Network policy (allows the service to connect):

Data access policy (allows the service to read data):

Check existing policies:

1. Verify the Glue database and table exist:

   Copy

   aws glue get-table \
       --database-name my_database \
       --name my_table \
       --region us-east-1

2. Check the IAM role used for direct query has permissions:

   Copy

   {
     "Effect": "Allow",
     "Action": [
       "glue:GetTable",
       "glue:GetDatabase",
       "s3:GetObject",
       "s3:ListBucket"
     ],
     "Resource": "*"
   }

3. Verify the OpenSearch domain version is 2.13 or later (direct query requires it)

1. Ensure the CloudWatch log group exists and has data
2. Verify the IAM role has logs:GetLogEvents and logs:DescribeLogGroups permissions
3. Check that the direct query data source is configured correctly in the OpenSearch UI

If a previously working data source becomes unavailable:

1. Check domain status — The domain may be undergoing a configuration change
2. Check access policy — Someone may have modified the domain's access policy
3. Check VPC authorization — The authorization may have been revoked
4. Check security groups — Rules may have been modified
5. Check for service events — AWS may be experiencing issues in the region

There's no explicit "reconnect" action. To force the application to re-establish the connection:

1. Remove the data source:

   Copy

   aws opensearch update-application \
       --id app-abc123def456 \
       --data-sources '[]' \
       --region us-east-1

2. Wait 2-3 minutes

3. Re-add the data source:

   Copy

   aws opensearch update-application \
       --id app-abc123def456 \
       --data-sources '[{
         "dataSourceArn": "arn:aws:es:us-east-1:123456789012:domain/my-domain",
         "dataSourceDescription": "My domain"
       }]' \
       --region us-east-1

Quick reference for common diagnostic commands:

If you've exhausted this guide:

1. Collect the application ID, domain name, and region
2. Run the diagnostic commands above and save the output
3. Check CloudTrail for any error events in the last hour
4. Open a support case with AWS Support including all collected information