What's New

Amazon OpenSearch Service has introduced a VPC egress option that enables VPC-based OpenSearch domains to establish private outbound network connections to resources within a customer's VPC — including ML models, AWS services, and custom applications — without routing traffic over the public internet. This feature is configurable via the AWS Management Console, AWS CLI, and the CreateDomain and UpdateDomainConfig API operations. It is available globally across all AWS Regions where Amazon OpenSearch Service is offered.

How It Works

• When VPC egress is enabled on an OpenSearch Service domain, the service provisions elastic network interfaces (ENIs) directly into the subnets associated with the domain.
• These ENIs serve as the egress path for outbound traffic originating from the OpenSearch domain, routing it into the customer's VPC rather than through the public internet.
• This means that any outbound calls — such as those made during ML inference pipelines, connector-based integrations with external services, or custom plugin callbacks — traverse the private VPC network fabric.
• Customers can apply standard VPC constructs such as security groups, network ACLs, VPC endpoints, and route tables to control and inspect this egress traffic.
• The feature can be toggled on or off dynamically using the UpdateDomainConfig API, allowing for flexible configuration without requiring domain recreation.

Why It's Important

• Prior to this feature, OpenSearch Service domains deployed within a VPC could receive traffic privately, but outbound calls from the domain (e.g., to remote ML model endpoints or external data sources via connectors) could potentially traverse the public internet, introducing security and compliance risks.
• VPC egress closes this gap by ensuring end-to-end private connectivity for both ingress and egress traffic, which is critical for organizations operating under strict data residency, regulatory, or zero-trust network security requirements.
• This is particularly significant for AI/ML workloads where OpenSearch's neural search and semantic search capabilities rely on calling external model inference endpoints — now those calls can remain entirely within the private network boundary.

How It's Different

• Previously, OpenSearch Service VPC domains were "VPC-ingress only" in practice — traffic into the domain was private, but outbound traffic from the domain to external resources (such as SageMaker inference endpoints, custom HTTP connectors, or third-party services) would exit through AWS-managed infrastructure without guaranteed private routing through the customer's VPC.
• Customers had limited ability to apply their own network controls (security groups, NACLs, VPC flow logs) to this egress traffic.
• The new VPC egress option fundamentally changes this by injecting ENIs into customer-managed subnets, giving customers full visibility and control over outbound traffic using native VPC tooling — a capability that was not previously available for OpenSearch Service domains.

When to Prefer It

• VPC egress should be enabled whenever an OpenSearch domain needs to make outbound calls to resources that are accessible only within a private network, such as SageMaker endpoints deployed in a VPC, Amazon Bedrock VPC endpoints, internal microservices, or on-premises systems connected via AWS Direct Connect or VPN.
• It is especially important in regulated industries (finance, healthcare, government) where data must not traverse the public internet and where network traffic must be auditable via VPC Flow Logs.
• Teams building semantic search, RAG (Retrieval-Augmented Generation) pipelines, or ML-augmented search using OpenSearch's connector framework should enable VPC egress to ensure that model inference calls remain private.
• If your OpenSearch domain operates in isolation without any outbound connectivity requirements, the feature is optional but still recommended as a defense-in-depth measure.

Availability

• VPC egress for Amazon OpenSearch Service is generally available (GA) as of May 7, 2026, and is supported in all AWS Regions where Amazon OpenSearch Service is available.
• The feature applies specifically to VPC-based OpenSearch domains; public-access domains are not applicable.
• Configuration is supported through the AWS Console, AWS CLI, and the CreateDomain / UpdateDomainConfig API operations, allowing both new domain creation and updates to existing domains.
• Customers should ensure that the subnets selected for the domain have sufficient available IP addresses to accommodate the additional ENIs provisioned by the service.
• Refer to the AWS documentation on "Routing domain egress traffic through your VPC" for detailed setup guidance and subnet sizing considerations.