AWS Big Data • Salman Ahmed • Sep 3, 2026 blog
- OpenSearch Serverless now uses standard AWS PrivateLink for private access instead of complex custom DNS setups.
- Per-collection endpoints use hostnames like collectionId .aoss. region .on.aws to reach specific data sets directly.
- Per-account regional endpoints allow reaching any collection in an account via a single hostname and connection pool.
- Requests target specific collections using the x-amz-aoss-collection-name header, which AWS SDKs sign automatically with SigV4.
- Standard VPC endpoints are created via the console or EC2 API using the service name com.amazonaws. region .aoss-data.
- Private DNS resolution maps collection hostnames to private ENI IPs within each consumer s local Route 53 Resolver.
- On-premises access requires a Route 53 Resolver inbound endpoint in the VPC to forward queries from external resolvers.
- Cross-account patterns let spoke accounts create their own endpoints while the central account manages network policies.
- Centralized shared endpoints reduce endpoint count but require AWS Route 53 Profiles or manual DNS zone management.
- Cross-Region access requires independent collections per Region since no built-in cross-Region replication exists.
- Costs vary by pattern, with local endpoints being cheapest for most cases while transit gateways add processing fees.
- OpenSearch Serverless now uses standard AWS PrivateLink for private access instead of complex custom DNS setups.
- Per-collection endpoints use hostnames like collectionId .aoss. region .on.aws to reach specific data sets directly.
- Per-account regional endpoints allow reaching any collection in an account via a single hostname and connection pool.
- Requests target specific collections using the x-amz-aoss-collection-name header, which AWS SDKs sign automatically with SigV4.
- Standard VPC endpoints are created via the console or EC2 API using the service name com.amazonaws. region .aoss-data.
- Private DNS resolution maps collection hostnames to private ENI IPs within each consumer s local Route 53 Resolver.
- On-premises access requires a Route 53 Resolver inbound endpoint in the VPC to forward queries from external resolvers.
- Cross-account patterns let spoke accounts create their own endpoints while the central account manages network policies.
- Centralized shared endpoints reduce endpoint count but require AWS Route 53 Profiles or manual DNS zone management.
- Cross-Region access requires independent collections per Region since no built-in cross-Region replication exists.
- Costs vary by pattern, with local endpoints being cheapest for most cases while transit gateways add processing fees.