Skip to content

Commit 800c8d0

Browse files
bryantbiggsbryantbiggs
committed
feat: Update complete example
1 parent e3385b8 commit 800c8d0

File tree

7 files changed

+240
-15
lines changed

7 files changed

+240
-15
lines changed

‎README.md

Lines changed: 114 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,118 @@ See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-opensear
1212
module "opensearch" {
1313
source = "terraform-aws-modules/opensearch/aws"
1414
15+
16+
# Domain
17+
advanced_options = {
18+
"rest.action.multi.allow_explicit_index" = "true"
19+
}
20+
21+
advanced_security_options = {
22+
enabled = false
23+
anonymous_auth_enabled = true
24+
internal_user_database_enabled = true
25+
26+
master_user_options = {
27+
master_user_name = "example"
28+
master_user_password = "Barbarbarbar1!"
29+
}
30+
}
31+
32+
auto_tune_options = {
33+
desired_state = "ENABLED"
34+
35+
maintenance_schedule = [
36+
{
37+
start_at = "2028-05-13T07:44:12Z"
38+
cron_expression_for_recurrence = "cron(0 0 ? * 1 *)"
39+
duration = {
40+
value = "2"
41+
unit = "HOURS"
42+
}
43+
}
44+
]
45+
46+
rollback_on_disable = "NO_ROLLBACK"
47+
}
48+
49+
cluster_config = {
50+
instance_count = 3
51+
dedicated_master_enabled = true
52+
dedicated_master_type = "c6g.large.search"
53+
instance_type = "r6g.large.search"
54+
55+
zone_awareness_config = {
56+
availability_zone_count = 3
57+
}
58+
59+
zone_awareness_enabled = true
60+
}
61+
62+
domain_endpoint_options = {
63+
enforce_https = true
64+
tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
65+
}
66+
67+
domain_name = local.name
68+
69+
ebs_options = {
70+
ebs_enabled = true
71+
iops = 3000
72+
throughput = 125
73+
volume_type = "gp3"
74+
volume_size = 20
75+
}
76+
77+
encrypt_at_rest = {
78+
enabled = true
79+
}
80+
81+
engine_version = "OpenSearch_2.11"
82+
83+
log_publishing_options = [
84+
{ log_type = "INDEX_SLOW_LOGS" },
85+
{ log_type = "SEARCH_SLOW_LOGS" },
86+
]
87+
88+
node_to_node_encryption = {
89+
enabled = true
90+
}
91+
92+
software_update_options = {
93+
auto_software_update_enabled = true
94+
}
95+
96+
vpc_options = {
97+
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
98+
}
99+
100+
# VPC endpoint
101+
vpc_endpoints = {
102+
one = {
103+
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
104+
}
105+
}
106+
107+
# Access policy
108+
access_policy_statements = [
109+
{
110+
effect = "Allow"
111+
112+
principals = [{
113+
type = "*"
114+
identifiers = ["*"]
115+
}]
116+
117+
actions = ["es:*"]
118+
119+
condition = [{
120+
test = "IpAddress"
121+
variable = "aws:SourceIp"
122+
values = ["127.0.0.1/32"]
123+
}]
124+
}
125+
]
126+
15127
tags = {
16128
Terraform = "true"
17129
Environment = "dev"
@@ -24,7 +136,7 @@ module "opensearch" {
24136
Examples codified under the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!
25137

26138
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/complete)
27-
- [Serverless](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/serverless)
139+
- [Serverless](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/collection)
28140

29141
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
30142
## Requirements
@@ -95,7 +207,7 @@ No modules.
95207
| <a name="input_enable_access_policy"></a> [enable\_access\_policy](#input\_enable\_access\_policy) | Determines whether an access policy will be applied to the domain | `bool` | `true` | no |
96208
| <a name="input_encrypt_at_rest"></a> [encrypt\_at\_rest](#input\_encrypt\_at\_rest) | Configuration block for encrypting at rest | `any` | <pre>{<br> "enabled": true<br>}</pre> | no |
97209
| <a name="input_engine_version"></a> [engine\_version](#input\_engine\_version) | Version of the OpenSearch engine to use | `string` | `null` | no |
98-
| <a name="input_log_publishing_options"></a> [log\_publishing\_options](#input\_log\_publishing\_options) | Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log\_type, within the same resource | `any` | <pre>[<br> {<br> "log_type": "INDEX_SLOW_LOGS"<br> },<br> {<br> "log_type": "SEARCH_SLOW_LOGS"<br> },<br> {<br> "log_type": "AUDIT_LOGS"<br> }<br>]</pre> | no |
210+
| <a name="input_log_publishing_options"></a> [log\_publishing\_options](#input\_log\_publishing\_options) | Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log\_type, within the same resource | `any` | <pre>[<br> {<br> "log_type": "INDEX_SLOW_LOGS"<br> },<br> {<br> "log_type": "SEARCH_SLOW_LOGS"<br> }<br>]</pre> | no |
99211
| <a name="input_node_to_node_encryption"></a> [node\_to\_node\_encryption](#input\_node\_to\_node\_encryption) | Configuration block for node-to-node encryption options | `any` | <pre>{<br> "enabled": true<br>}</pre> | no |
100212
| <a name="input_off_peak_window_options"></a> [off\_peak\_window\_options](#input\_off\_peak\_window\_options) | Configuration to add Off Peak update options | `any` | <pre>{<br> "enabled": true,<br> "off_peak_window": {<br> "hours": 7<br> }<br>}</pre> | no |
101213
| <a name="input_outbound_connections"></a> [outbound\_connections](#input\_outbound\_connections) | Map of AWS OpenSearch outbound connections to create | `any` | `{}` | no |

‎examples/README.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1-
# Terraform AWS Opensearch Examples
1+
# Examples
22

3-
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/complete)
3+
Please note - the examples provided serve two primary means:
4+
5+
1. Show users working examples of the various ways in which the module can be configured and features supported
6+
2. A means of testing/validating module changes
7+
8+
Please do not mistake the examples provided as "best practices". It is up to users to consult the AWS service documentation for best practices, usage recommendations, etc.

‎examples/complete/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ Configuration in this directory creates an AWS OpenSEarch domain and resources
44

55
## Usage
66

7+
Ensure you have a service-linked role for OpenSearch before deploying the example. You can use the following command to create one:
8+
9+
```bash
10+
aws iam create-service-linked-role --aws-service-name es.amazonaws.com
11+
```
12+
713
To run this example you need to execute:
814

915
```bash

‎examples/complete/main.tf

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,116 @@ locals {
2525
module "opensearch" {
2626
source = "../.."
2727

28+
# Domain
29+
advanced_options = {
30+
"rest.action.multi.allow_explicit_index" = "true"
31+
}
32+
33+
advanced_security_options = {
34+
enabled = false
35+
anonymous_auth_enabled = true
36+
internal_user_database_enabled = true
37+
38+
master_user_options = {
39+
master_user_name = "example"
40+
master_user_password = "Barbarbarbar1!"
41+
}
42+
}
43+
44+
auto_tune_options = {
45+
desired_state = "ENABLED"
46+
47+
maintenance_schedule = [
48+
{
49+
start_at = "2028-05-13T07:44:12Z"
50+
cron_expression_for_recurrence = "cron(0 0 ? * 1 *)"
51+
duration = {
52+
value = "2"
53+
unit = "HOURS"
54+
}
55+
}
56+
]
57+
58+
rollback_on_disable = "NO_ROLLBACK"
59+
}
60+
61+
cluster_config = {
62+
instance_count = 3
63+
dedicated_master_enabled = true
64+
dedicated_master_type = "c6g.large.search"
65+
instance_type = "r6g.large.search"
66+
67+
zone_awareness_config = {
68+
availability_zone_count = 3
69+
}
70+
71+
zone_awareness_enabled = true
72+
}
73+
74+
domain_endpoint_options = {
75+
enforce_https = true
76+
tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
77+
}
78+
79+
domain_name = local.name
80+
81+
ebs_options = {
82+
ebs_enabled = true
83+
iops = 3000
84+
throughput = 125
85+
volume_type = "gp3"
86+
volume_size = 20
87+
}
88+
89+
encrypt_at_rest = {
90+
enabled = true
91+
}
92+
93+
engine_version = "OpenSearch_2.11"
94+
95+
log_publishing_options = [
96+
{ log_type = "INDEX_SLOW_LOGS" },
97+
{ log_type = "SEARCH_SLOW_LOGS" },
98+
]
99+
100+
node_to_node_encryption = {
101+
enabled = true
102+
}
103+
104+
software_update_options = {
105+
auto_software_update_enabled = true
106+
}
107+
108+
vpc_options = {
109+
subnet_ids = module.vpc.private_subnets
110+
}
111+
112+
# VPC endpoint
113+
vpc_endpoints = {
114+
one = {
115+
subnet_ids = module.vpc.private_subnets
116+
}
117+
}
118+
119+
# Access policy
120+
access_policy_statements = [
121+
{
122+
effect = "Allow"
123+
124+
principals = [{
125+
type = "*"
126+
identifiers = ["*"]
127+
}]
128+
129+
actions = ["es:*"]
130+
131+
condition = [{
132+
test = "IpAddress"
133+
variable = "aws:SourceIp"
134+
values = ["127.0.0.1/32"]
135+
}]
136+
}
137+
]
28138

29139
tags = local.tags
30140
}

‎main.tf

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ data "aws_caller_identity" "current" {
99
}
1010
data "aws_iam_session_context" "current" {
1111
count = var.create ? 1 : 0
12-
13-
arn = data.aws_caller_identity.current[0].arn
12+
arn = data.aws_caller_identity.current[0].arn
1413
}
1514

1615
locals {
@@ -210,7 +209,7 @@ resource "aws_opensearch_domain" "this" {
210209
for_each = length(var.software_update_options) > 0 ? [var.software_update_options] : []
211210

212211
content {
213-
auto_software_update_enabled = try(software_update_options.value.auto_software_update_enabled, try)
212+
auto_software_update_enabled = try(software_update_options.value.auto_software_update_enabled, true)
214213
}
215214
}
216215

@@ -224,11 +223,6 @@ resource "aws_opensearch_domain" "this" {
224223
}
225224

226225
tags = local.tags
227-
228-
depends_on = [
229-
# https://github.com/hashicorp/terraform-provider-aws/issues/14497
230-
aws_opensearch_domain_policy.this,
231-
]
232226
}
233227

234228
################################################################################
@@ -287,7 +281,7 @@ data "aws_iam_policy_document" "this" {
287281
not_actions = try(statement.value.not_actions, null)
288282
effect = try(statement.value.effect, null)
289283
resources = try(statement.value.resources,
290-
[for path in try(statement.value.resource_paths, ["*"]) : "${local.static_domain_arn}/${path}"]
284+
[for path in try(statement.value.resource_paths, ["*"]) : "${aws_opensearch_domain.this[0].arn}/${path}"]
291285
)
292286
not_resources = try(statement.value.not_resources, null)
293287

‎variables.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,6 @@ variable "log_publishing_options" {
9797
default = [
9898
{ log_type = "INDEX_SLOW_LOGS" },
9999
{ log_type = "SEARCH_SLOW_LOGS" },
100-
{ log_type = "AUDIT_LOGS" }
101100
]
102101
}
103102

‎wrappers/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ module "wrapper" {
4747
log_publishing_options = try(each.value.log_publishing_options, var.defaults.log_publishing_options, [
4848
{ log_type = "INDEX_SLOW_LOGS" },
4949
{ log_type = "SEARCH_SLOW_LOGS" },
50-
{ log_type = "AUDIT_LOGS" }
5150
])
5251
node_to_node_encryption = try(each.value.node_to_node_encryption, var.defaults.node_to_node_encryption, {
5352
enabled = true

0 commit comments

Comments
 (0)