Designing centralized and distributed network connectivity patterns for Amazon OpenSearch Serverless – Part 1

This article explains two network connectivity patterns for Amazon OpenSearch Serverless that enable secure, private access from on-premises and multiple AWS accounts using centralized infrastructure.

• Pattern 1: On-premises access through centralized VPC endpoint and Route 53 Profiles
• Pattern 2: Multi-account access from spoke VPCs using shared Route 53 Profiles
• Single interface VPC endpoint handles multiple OpenSearch Serverless collections per region
• Route 53 Profiles shared via AWS RAM eliminate per-account VPC endpoints and manual DNS configuration
• Custom AWS RAM permissions required for OpenSearch account to associate resources with Profiles
• DNS resolution uses visible and hidden private hosted zones for collection endpoint resolution
• Data traffic routed through AWS PrivateLink, Transit Gateway, or Cloud WAN
• Separates networking, application, and collection management responsibilities across teams
• Part 2 will cover distributed ownership model with collections across multiple accounts

This architecture provides scalable, enterprise-grade hybrid connectivity with clear separation of responsibilities between networking and application teams.