@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
373 lines • 15 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Domain = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Manages an Amazon OpenSearch Domain.
*
* ## Elasticsearch vs. OpenSearch
*
* Amazon OpenSearch Service is the successor to Amazon Elasticsearch Service and supports OpenSearch and legacy Elasticsearch OSS (up to 7.10, the final open source version of the software).
*
* OpenSearch Domain configurations are similar in many ways to Elasticsearch Domain configurations. However, there are important differences including these:
*
* * OpenSearch has `engineVersion` while Elasticsearch has `elasticsearchVersion`
* * Versions are specified differently - _e.g._, `Elasticsearch_7.10` with OpenSearch vs. `7.10` for Elasticsearch.
* * `instanceType` argument values end in `search` for OpenSearch vs. `elasticsearch` for Elasticsearch (_e.g._, `t2.micro.search` vs. `t2.micro.elasticsearch`).
* * The AWS-managed service-linked role for OpenSearch is called `AWSServiceRoleForAmazonOpenSearchService` instead of `AWSServiceRoleForAmazonElasticsearchService` for Elasticsearch.
*
* There are also some potentially unexpected similarities in configurations:
*
* * ARNs for both are prefaced with `arn:aws:es:`.
* * Both OpenSearch and Elasticsearch use assume role policies that refer to the `Principal` `Service` as `es.amazonaws.com`.
* * IAM policy actions, such as those you will find in `accessPolicies`, are prefaced with `es:` for both.
*
* ## Example Usage
*
* ### Basic Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.opensearch.Domain("example", {
* domainName: "example",
* engineVersion: "Elasticsearch_7.10",
* clusterConfig: {
* instanceType: "r4.large.search",
* },
* tags: {
* Domain: "TestDomain",
* },
* });
* ```
*
* ### Access Policy
*
* > See also: `aws.opensearch.DomainPolicy` resource
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const config = new pulumi.Config();
* const domain = config.get("domain") || "tf-test";
* const current = aws.getRegion({});
* const currentGetCallerIdentity = aws.getCallerIdentity({});
* const example = Promise.all([current, currentGetCallerIdentity]).then(([current, currentGetCallerIdentity]) => aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "*",
* identifiers: ["*"],
* }],
* actions: ["es:*"],
* resources: [`arn:aws:es:${current.region}:${currentGetCallerIdentity.accountId}:domain/${domain}/*`],
* conditions: [{
* test: "IpAddress",
* variable: "aws:SourceIp",
* values: ["66.193.100.22/32"],
* }],
* }],
* }));
* const exampleDomain = new aws.opensearch.Domain("example", {
* domainName: domain,
* accessPolicies: example.then(example => example.json),
* });
* ```
*
* ### Log publishing to CloudWatch Logs
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleLogGroup = new aws.cloudwatch.LogGroup("example", {name: "example"});
* const example = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["es.amazonaws.com"],
* }],
* actions: [
* "logs:PutLogEvents",
* "logs:PutLogEventsBatch",
* "logs:CreateLogStream",
* ],
* resources: ["arn:aws:logs:*"],
* }],
* });
* const exampleLogResourcePolicy = new aws.cloudwatch.LogResourcePolicy("example", {
* policyName: "example",
* policyDocument: example.then(example => example.json),
* });
* const exampleDomain = new aws.opensearch.Domain("example", {logPublishingOptions: [{
* cloudwatchLogGroupArn: exampleLogGroup.arn,
* logType: "INDEX_SLOW_LOGS",
* }]});
* ```
*
* ### VPC based OpenSearch
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const config = new pulumi.Config();
* const vpc = config.requireObject<any>("vpc");
* const domain = config.get("domain") || "tf-test";
* const example = aws.ec2.getVpc({
* tags: {
* Name: vpc,
* },
* });
* const exampleGetSubnets = example.then(example => aws.ec2.getSubnets({
* filters: [{
* name: "vpc-id",
* values: [example.id],
* }],
* tags: {
* Tier: "private",
* },
* }));
* const current = aws.getRegion({});
* const currentGetCallerIdentity = aws.getCallerIdentity({});
* const exampleSecurityGroup = new aws.ec2.SecurityGroup("example", {
* name: `${vpc}-opensearch-${domain}`,
* description: "Managed by Pulumi",
* vpcId: example.then(example => example.id),
* ingress: [{
* fromPort: 443,
* toPort: 443,
* protocol: "tcp",
* cidrBlocks: [example.then(example => example.cidrBlock)],
* }],
* });
* const exampleServiceLinkedRole = new aws.iam.ServiceLinkedRole("example", {awsServiceName: "opensearchservice.amazonaws.com"});
* const exampleGetPolicyDocument = Promise.all([current, currentGetCallerIdentity]).then(([current, currentGetCallerIdentity]) => aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "*",
* identifiers: ["*"],
* }],
* actions: ["es:*"],
* resources: [`arn:aws:es:${current.region}:${currentGetCallerIdentity.accountId}:domain/${domain}/*`],
* }],
* }));
* const exampleDomain = new aws.opensearch.Domain("example", {
* domainName: domain,
* engineVersion: "OpenSearch_1.0",
* clusterConfig: {
* instanceType: "m4.large.search",
* zoneAwarenessEnabled: true,
* },
* vpcOptions: {
* subnetIds: [
* exampleGetSubnets.then(exampleGetSubnets => exampleGetSubnets.ids?.[0]),
* exampleGetSubnets.then(exampleGetSubnets => exampleGetSubnets.ids?.[1]),
* ],
* securityGroupIds: [exampleSecurityGroup.id],
* },
* advancedOptions: {
* "rest.action.multi.allow_explicit_index": "true",
* },
* accessPolicies: exampleGetPolicyDocument.then(exampleGetPolicyDocument => exampleGetPolicyDocument.json),
* tags: {
* Domain: "TestDomain",
* },
* }, {
* dependsOn: [exampleServiceLinkedRole],
* });
* ```
*
* ### Enabling fine-grained access control on an existing domain
*
* This example shows two configurations: one to create a domain without fine-grained access control and the second to modify the domain to enable fine-grained access control. For more information, see [Enabling fine-grained access control](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html).
*
* ### First apply
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.opensearch.Domain("example", {
* domainName: "ggkitty",
* engineVersion: "Elasticsearch_7.1",
* clusterConfig: {
* instanceType: "r5.large.search",
* },
* advancedSecurityOptions: {
* enabled: false,
* anonymousAuthEnabled: true,
* internalUserDatabaseEnabled: true,
* masterUserOptions: {
* masterUserName: "example",
* masterUserPassword: "Barbarbarbar1!",
* },
* },
* encryptAtRest: {
* enabled: true,
* },
* domainEndpointOptions: {
* enforceHttps: true,
* tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
* },
* nodeToNodeEncryption: {
* enabled: true,
* },
* ebsOptions: {
* ebsEnabled: true,
* volumeSize: 10,
* },
* });
* ```
*
* ### Second apply
*
* Notice that the only change is `advanced_security_options.0.enabled` is now set to `true`.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.opensearch.Domain("example", {
* domainName: "ggkitty",
* engineVersion: "Elasticsearch_7.1",
* clusterConfig: {
* instanceType: "r5.large.search",
* },
* advancedSecurityOptions: {
* enabled: true,
* anonymousAuthEnabled: true,
* internalUserDatabaseEnabled: true,
* masterUserOptions: {
* masterUserName: "example",
* masterUserPassword: "Barbarbarbar1!",
* },
* },
* encryptAtRest: {
* enabled: true,
* },
* domainEndpointOptions: {
* enforceHttps: true,
* tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
* },
* nodeToNodeEncryption: {
* enabled: true,
* },
* ebsOptions: {
* ebsEnabled: true,
* volumeSize: 10,
* },
* });
* ```
*
* ## Import
*
* Using `pulumi import`, import OpenSearch domains using the `domain_name`. For example:
*
* ```sh
* $ pulumi import aws:opensearch/domain:Domain example domain_name
* ```
*/
class Domain extends pulumi.CustomResource {
/**
* Get an existing Domain resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Domain(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of Domain. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Domain.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["accessPolicies"] = state?.accessPolicies;
resourceInputs["advancedOptions"] = state?.advancedOptions;
resourceInputs["advancedSecurityOptions"] = state?.advancedSecurityOptions;
resourceInputs["arn"] = state?.arn;
resourceInputs["autoTuneOptions"] = state?.autoTuneOptions;
resourceInputs["clusterConfig"] = state?.clusterConfig;
resourceInputs["cognitoOptions"] = state?.cognitoOptions;
resourceInputs["dashboardEndpoint"] = state?.dashboardEndpoint;
resourceInputs["dashboardEndpointV2"] = state?.dashboardEndpointV2;
resourceInputs["domainEndpointOptions"] = state?.domainEndpointOptions;
resourceInputs["domainEndpointV2HostedZoneId"] = state?.domainEndpointV2HostedZoneId;
resourceInputs["domainId"] = state?.domainId;
resourceInputs["domainName"] = state?.domainName;
resourceInputs["ebsOptions"] = state?.ebsOptions;
resourceInputs["encryptAtRest"] = state?.encryptAtRest;
resourceInputs["endpoint"] = state?.endpoint;
resourceInputs["endpointV2"] = state?.endpointV2;
resourceInputs["engineVersion"] = state?.engineVersion;
resourceInputs["ipAddressType"] = state?.ipAddressType;
resourceInputs["logPublishingOptions"] = state?.logPublishingOptions;
resourceInputs["nodeToNodeEncryption"] = state?.nodeToNodeEncryption;
resourceInputs["offPeakWindowOptions"] = state?.offPeakWindowOptions;
resourceInputs["region"] = state?.region;
resourceInputs["snapshotOptions"] = state?.snapshotOptions;
resourceInputs["softwareUpdateOptions"] = state?.softwareUpdateOptions;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
resourceInputs["vpcOptions"] = state?.vpcOptions;
}
else {
const args = argsOrState;
resourceInputs["accessPolicies"] = args?.accessPolicies;
resourceInputs["advancedOptions"] = args?.advancedOptions;
resourceInputs["advancedSecurityOptions"] = args?.advancedSecurityOptions;
resourceInputs["autoTuneOptions"] = args?.autoTuneOptions;
resourceInputs["clusterConfig"] = args?.clusterConfig;
resourceInputs["cognitoOptions"] = args?.cognitoOptions;
resourceInputs["domainEndpointOptions"] = args?.domainEndpointOptions;
resourceInputs["domainName"] = args?.domainName;
resourceInputs["ebsOptions"] = args?.ebsOptions;
resourceInputs["encryptAtRest"] = args?.encryptAtRest;
resourceInputs["engineVersion"] = args?.engineVersion;
resourceInputs["ipAddressType"] = args?.ipAddressType;
resourceInputs["logPublishingOptions"] = args?.logPublishingOptions;
resourceInputs["nodeToNodeEncryption"] = args?.nodeToNodeEncryption;
resourceInputs["offPeakWindowOptions"] = args?.offPeakWindowOptions;
resourceInputs["region"] = args?.region;
resourceInputs["snapshotOptions"] = args?.snapshotOptions;
resourceInputs["softwareUpdateOptions"] = args?.softwareUpdateOptions;
resourceInputs["tags"] = args?.tags;
resourceInputs["vpcOptions"] = args?.vpcOptions;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["dashboardEndpoint"] = undefined /*out*/;
resourceInputs["dashboardEndpointV2"] = undefined /*out*/;
resourceInputs["domainEndpointV2HostedZoneId"] = undefined /*out*/;
resourceInputs["domainId"] = undefined /*out*/;
resourceInputs["endpoint"] = undefined /*out*/;
resourceInputs["endpointV2"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Domain.__pulumiType, name, resourceInputs, opts);
}
}
exports.Domain = Domain;
/** @internal */
Domain.__pulumiType = 'aws:opensearch/domain:Domain';
//# sourceMappingURL=domain.js.map