Tamr AWS OpenSearch Terraform Module

This terraform module creates an OpenSearch domain on AWS.

Prerequisite

This module requires an IAM service linked role for OpenSearch on the AWS account.

To create an OpenSearch service role in terraform:

resource "aws_iam_service_linked_role" "opensearch-service-role" {
  aws_service_name = "opensearchservice.amazonaws.com"
}

OpenSearch Service automatically creates a new OpenSearch service-linked role the first time you create an OpenSearch domain if you have permissions for the iam:CreateServiceLinkedRole action and the legacy Elasticsearch role doesn't exist in your account.

There can be only one service linked role for per AWS account.

You may run into an error like this when trying to remove the service linked role if there is still an OpenSearch domain in the account:

Error: Error waiting for role (arn:aws:iam::000000000000:role/aws-service-role/es.amazonaws.com/AWSServiceRoleForAmazonElasticsearchService) to be deleted: unexpected state 'FAILED', wanted target 'SUCCEEDED'.

You will need to ensure all the domains are completely removed before attempting to remove the service linked service role. If it appears like all the domains have already been removed, you can try again.

Examples

Minimal

Smallest complete fully working example. This example might require extra resources to run the example.

• Minimal

Resources Created

This module creates:

• a new OpenSearch domain in AWS

Requirements

Name	Version
terraform	>= 0.13
aws	>= 3.36, !=4.0.0, !=4.1.0, !=4.2.0, !=4.3.0, !=4.4.0, !=4.5.0, !=4.6.0, !=4.7.0, !=4.8.0

Providers

No provider.

Inputs

Name	Description	Type	Default	Required
domain_name	The name to give to the OpenSearch domain	string	n/a	yes
subnet_ids	List of subnet IDs for the OpenSearch domain to be created in	list(string)	n/a	yes
arn_partition	The partition in which the resource is located. A partition is a group of AWS Regions. Each AWS account is scoped to one partition. The following are the supported partitions: aws -AWS Regions aws-cn - China Regions aws-us-gov - AWS GovCloud (US) Regions	string	"aws"	no
ebs_enabled	Whether EBS volumes are attached to data nodes	bool	true	no
ebs_iops	The baseline I/O performance of EBS volumes attached to nodes. Iops is only valid when volume type is io1	number	null	no
ebs_volume_size	The size of EBS volumes attached to data nodes (in GB)	number	100	no
ebs_volume_type	The type of EBS volumes attached to data nodes	string	"gp2"	no
enforce_https	Whether or not to require HTTPS on the domain endpoint	bool	true	no
es_tags	[DEPRECATED: Use tags instead] Additional tags to be attached to the OpenSearch domain and associated resources.	map(string)	{}	no
es_version	Version of OpenSearch to deploy	string	"6.8"	no
instance_count	Number of instances to launch in the OpenSearch domain	number	2	no
instance_type	Instance type of data nodes in the domain	string	"c5.large.elasticsearch"	no
kms_key_id	The KMS key id to encrypt the OpenSearch domain with. If not specified then it defaults to using the aws/es service KMS key	string	null	no
log_group_name	The name of an existent CloudWatch Log Group that OpenSearch will publish logs to	string	""	no
log_types	A list of log types that will be published to CloudWatch. Valid values are SEARCH_SLOW_LOGS, INDEX_SLOW_LOGS, ES_APPLICATION_LOGS and AUDIT_LOGS.	list(string)	[ "ES_APPLICATION_LOGS", "SEARCH_SLOW_LOGS", "INDEX_SLOW_LOGS" ]	no
node_to_node_encryption_enabled	Whether to enable node-to-node encryption	bool	true	no
security_group_ids	List of security group IDs to be applied to the OpenSearch domain	list(string)	[]	no
snapshot_start_hour	Hour when an automated daily snapshot of the indices is taken	number	0	no
tags	A map of tags to add to all resources. Replaces es_tags.	map(string)	{}	no
tls_security_policy	The name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values: Policy-Min-TLS-1-0-2019-07 and Policy-Min-TLS-1-2-2019-07.	string	"Policy-Min-TLS-1-2-2019-07"	no

Outputs

Name	Description
tamr_es_domain_endpoint	Endpoint of OpenSearch domain created
tamr_es_domain_id	ID of the OpenSearch domain created

References

This repo is based on:

• terraform standard module structure
• templated terraform module

Development

Generating Docs

Run make terraform/docs to generate the section of docs around terraform inputs, outputs and requirements.

Checkstyles

Run make lint, this will run terraform fmt, in addition to a few other checks to detect whitespace issues. NOTE: this requires having docker working on the machine running the test

Releasing new versions

• Update version contained in VERSION
• Document changes in CHANGELOG.md
• Create a tag in github for the commit associated with the version

License

Apache 2 Licensed. See LICENSE for full details.