@aws-sdk/client-opensearch UpdateDomainConfigCommand with JWTOptions does not update the public key

[anthony-tarr]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I'm trying to update the JWT public key in my OpenSearch cluster through the SDK.

await opensearchClient.send(
      new UpdateDomainConfigCommand({
        DomainName: <domain-name>,
        AdvancedSecurityOptions: {
          JWTOptions: {
            PublicKey: publicKey,
          },
        },
      })
    );

The metadata of the call returns 200 with no apparent errors:

    "$metadata": {
        "httpStatusCode": 200,
        "requestId": "a50a5ec1-3345-4ad6-b50e-a7b03bd7dd55",
        "attempts": 1,
        "totalRetryDelay": 0
    },

However the returned config is not updated:

        "AdvancedSecurityOptions": {
            "Options": {
                "AnonymousAuthEnabled": false,
                "Enabled": true,
                "InternalUserDatabaseEnabled": false,
                "JWTOptions": {
                    "Enabled": true,
                    "PublicKey": "<old public key>",
                    "RolesKey": "roles", // default
                    "SubjectKey": "sub" // default
                }
            },
            "Status": {
                "CreationDate": "2025-03-18T21:48:56.833Z",
                "PendingDeletion": false,
                "State": "Active",
                "UpdateDate": "2025-05-06T16:56:34.722Z", // this value is not updated either
                "UpdateVersion": 135
            }
        },

The public key is not updated when looking through the console itself, as well.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/client-opensearch@3.787.0

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

nodejs22.x (from AWS Lambda)

Reproduction Steps

1. Create an OpenSearch cluster, and enable JWT authentication with a public key.
2. Attempt to update only the public key through the AWS-SDK.

Observed Behavior

The public key was not updated despite receiving a 200 response from the call.

Expected Behavior

The cluster will be updated with the new public key.

Possible Solution

No response

Additional Information/Context

No response

[anthony-tarr]

Did some further testing by trying to update RolesKey and SubjectKey - those update successfully, however PublicKey still does not update.

[aBurmeseDev]

Hey @anthony-tarr - thanks for reaching out.

I need to confirm with service team but according to their docs, you may have to use AWS Console to configure JWT authentication. Are you able to configure this in AWS Console?

[anthony-tarr]

Yes, I can configure this through the console manually. I don't believe our RSA key is large enough to cause issues, but it would be good to know regardless if updating the public key through code is not supported at this time.

[aBurmeseDev]

That would be something you could directly reach out to Opensearch team via AWS Support or I can pass your question to service team internally.