Amazon OpenSearch Serverless Demo is a boilerplate Next.js application that demonstrates full-text recipe search powered by Amazon OpenSearch Serverless, with AWS SigV4 authentication handled through Vercel OIDC so no static AWS keys are stored in the project.
What is Amazon OpenSearch Serverless Demo?
This demo template from Vercel pairs Next.js with Amazon OpenSearch Serverless to build a searchable recipe interface. It takes a recipe dataset, seeds it into an OpenSearch Serverless Search collection with npm run seed, and renders search results with facets, highlighting, and autocomplete. The application runs on Node.js 18 and relies on the AWS SDK's fromWebToken method to exchange a Vercel OIDC token for temporary AWS credentials, eliminating the need for hard-coded access keys.
Key Features
- SigV4 authentication without static keys — The app uses the
@vercel/oidcpackage to read Vercel's short-lived OIDC token and exchanges it for AWS credentials via STSAssumeRoleWithWebIdentity, implemented withfromWebTokenin the AWS SDK. - Full-text recipe search with facets — Search results support faceted filtering, match highlighting, and autocomplete suggestions, providing a complete search UI out of the box.
- Vercel OIDC integration — On Vercel,
VERCEL_OIDC_TOKENis injected automatically; locally,vercel env pullwrites one valid for roughly 12 hours, so local development mirrors production auth. - Seeding script —
npm run seedpopulates the OpenSearch Serverless index with recipe data, making the search interface functional immediately after setup. - IAM role trust policy example — The repository includes a sample trust policy that allows Vercel's OIDC issuer (
https://oidc.vercel.com/team-slug) to assume a role, along with the requiredaoss:APIAccessAllpermission on the collection. - Environment variable configuration —
OPENSEARCH_ENDPOINT,AWS_REGION,AWS_ROLE_ARN, andVERCEL_OIDC_TOKENare provisioned automatically when installing the Vercel AWS OpenSearch integration and can be pulled locally withvercel env pull.
Who is it for?
- Developers building search UIs — They can use this template as a reference implementation for integrating Amazon OpenSearch Serverless into a Next.js application with secure AWS authentication.
- Vercel users managing AWS resources — Teams deploying on Vercel who want to connect to OpenSearch Serverless without storing long-lived AWS credentials can adopt the OIDC token exchange pattern shown here.
- Developers learning OpenSearch — The demo provides a working example of OpenSearch Query DSL for full-text search, facets, highlighting, and autocomplete.
How does it work?
The application authenticates by reading the Vercel OIDC token, which is injected into the environment on Vercel and generated locally via vercel env pull. It then calls STS AssumeRoleWithWebIdentity using the AWS SDK's fromWebToken helper to receive temporary credentials scoped by the IAM role. After the index is seeded, the Next.js development server (npm run dev) serves the search interface at localhost:3000.
Use Cases
- Search feature prototypes: Product teams can clone this template to quickly stand up a faceted, highlighted search experience backed by OpenSearch Serverless.
- Serverless search architecture reference: Developers can reuse the OIDC authentication flow to secure any AWS SDK call from a Vercel app without embedding secret keys.
- Recipe or catalog search demos: The included recipe dataset and seeding script make it easy to test full-text search behaviors like autocomplete and facets.
