aws.elasticsearch.DomainPolicy
Explore with Pulumi AI
Allows setting policy to an Elasticsearch domain while referencing domain attributes (e.g., ARN)
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.elasticsearch.Domain("example", {
domainName: "tf-test",
elasticsearchVersion: "2.3",
});
const main = new aws.elasticsearch.DomainPolicy("main", {
domainName: example.domainName,
accessPolicies: pulumi.interpolate`{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Condition": {
"IpAddress": {"aws:SourceIp": "127.0.0.1/32"}
},
"Resource": "${example.arn}/*"
}
]
}
`,
});
import pulumi
import pulumi_aws as aws
example = aws.elasticsearch.Domain("example",
domain_name="tf-test",
elasticsearch_version="2.3")
main = aws.elasticsearch.DomainPolicy("main",
domain_name=example.domain_name,
access_policies=example.arn.apply(lambda arn: f"""{{
"Version": "2012-10-17",
"Statement": [
{{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Condition": {{
"IpAddress": {{"aws:SourceIp": "127.0.0.1/32"}}
}},
"Resource": "{arn}/*"
}}
]
}}
"""))
package main
import (
"fmt"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/elasticsearch"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
example, err := elasticsearch.NewDomain(ctx, "example", &elasticsearch.DomainArgs{
DomainName: pulumi.String("tf-test"),
ElasticsearchVersion: pulumi.String("2.3"),
})
if err != nil {
return err
}
_, err = elasticsearch.NewDomainPolicy(ctx, "main", &elasticsearch.DomainPolicyArgs{
DomainName: example.DomainName,
AccessPolicies: example.Arn.ApplyT(func(arn string) (string, error) {
return fmt.Sprintf(`{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Condition": {
"IpAddress": {"aws:SourceIp": "127.0.0.1/32"}
},
"Resource": "%v/*"
}
]
}
`, arn), nil
}).(pulumi.StringOutput),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.ElasticSearch.Domain("example", new()
{
DomainName = "tf-test",
ElasticsearchVersion = "2.3",
});
var main = new Aws.ElasticSearch.DomainPolicy("main", new()
{
DomainName = example.DomainName,
AccessPolicies = example.Arn.Apply(arn => @$"{{
""Version"": ""2012-10-17"",
""Statement"": [
{{
""Action"": ""es:*"",
""Principal"": ""*"",
""Effect"": ""Allow"",
""Condition"": {{
""IpAddress"": {{""aws:SourceIp"": ""127.0.0.1/32""}}
}},
""Resource"": ""{arn}/*""
}}
]
}}
"),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.elasticsearch.Domain;
import com.pulumi.aws.elasticsearch.DomainArgs;
import com.pulumi.aws.elasticsearch.DomainPolicy;
import com.pulumi.aws.elasticsearch.DomainPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new Domain("example", DomainArgs.builder()
.domainName("tf-test")
.elasticsearchVersion("2.3")
.build());
var main = new DomainPolicy("main", DomainPolicyArgs.builder()
.domainName(example.domainName())
.accessPolicies(example.arn().applyValue(_arn -> """
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Condition": {
"IpAddress": {"aws:SourceIp": "127.0.0.1/32"}
},
"Resource": "%s/*"
}
]
}
", _arn)))
.build());
}
}
resources:
example:
type: aws:elasticsearch:Domain
properties:
domainName: tf-test
elasticsearchVersion: '2.3'
main:
type: aws:elasticsearch:DomainPolicy
properties:
domainName: ${example.domainName}
accessPolicies: |
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Condition": {
"IpAddress": {"aws:SourceIp": "127.0.0.1/32"}
},
"Resource": "${example.arn}/*"
}
]
}
Create DomainPolicy Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new DomainPolicy(name: string, args: DomainPolicyArgs, opts?: CustomResourceOptions);
@overload
def DomainPolicy(resource_name: str,
args: DomainPolicyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def DomainPolicy(resource_name: str,
opts: Optional[ResourceOptions] = None,
access_policies: Optional[Union[str, PolicyDocumentArgs]] = None,
domain_name: Optional[str] = None,
region: Optional[str] = None)
func NewDomainPolicy(ctx *Context, name string, args DomainPolicyArgs, opts ...ResourceOption) (*DomainPolicy, error)
public DomainPolicy(string name, DomainPolicyArgs args, CustomResourceOptions? opts = null)
public DomainPolicy(String name, DomainPolicyArgs args)
public DomainPolicy(String name, DomainPolicyArgs args, CustomResourceOptions options)
type: aws:elasticsearch:DomainPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args DomainPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args DomainPolicyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args DomainPolicyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args DomainPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args DomainPolicyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var domainPolicyResource = new Aws.ElasticSearch.DomainPolicy("domainPolicyResource", new()
{
AccessPolicies = "string",
DomainName = "string",
Region = "string",
});
example, err := elasticsearch.NewDomainPolicy(ctx, "domainPolicyResource", &elasticsearch.DomainPolicyArgs{
AccessPolicies: pulumi.Any("string"),
DomainName: pulumi.String("string"),
Region: pulumi.String("string"),
})
var domainPolicyResource = new com.pulumi.aws.elasticsearch.DomainPolicy("domainPolicyResource", com.pulumi.aws.elasticsearch.DomainPolicyArgs.builder()
.accessPolicies("string")
.domainName("string")
.region("string")
.build());
domain_policy_resource = aws.elasticsearch.DomainPolicy("domainPolicyResource",
access_policies="string",
domain_name="string",
region="string")
const domainPolicyResource = new aws.elasticsearch.DomainPolicy("domainPolicyResource", {
accessPolicies: "string",
domainName: "string",
region: "string",
});
type: aws:elasticsearch:DomainPolicy
properties:
accessPolicies: string
domainName: string
region: string
DomainPolicy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The DomainPolicy resource accepts the following input properties:
- Access
Policies string | PolicyDocument - IAM policy document specifying the access policies for the domain
- Domain
Name string - Name of the domain.
- Region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- Access
Policies string | PolicyDocument Args - IAM policy document specifying the access policies for the domain
- Domain
Name string - Name of the domain.
- Region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies String | PolicyDocument - IAM policy document specifying the access policies for the domain
- domain
Name String - Name of the domain.
- region String
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies string | PolicyDocument - IAM policy document specifying the access policies for the domain
- domain
Name string - Name of the domain.
- region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access_
policies str | PolicyDocument Args - IAM policy document specifying the access policies for the domain
- domain_
name str - Name of the domain.
- region str
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies String | Property Map - IAM policy document specifying the access policies for the domain
- domain
Name String - Name of the domain.
- region String
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
Outputs
All input properties are implicitly available as output properties. Additionally, the DomainPolicy resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing DomainPolicy Resource
Get an existing DomainPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: DomainPolicyState, opts?: CustomResourceOptions): DomainPolicy
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
access_policies: Optional[Union[str, PolicyDocumentArgs]] = None,
domain_name: Optional[str] = None,
region: Optional[str] = None) -> DomainPolicy
func GetDomainPolicy(ctx *Context, name string, id IDInput, state *DomainPolicyState, opts ...ResourceOption) (*DomainPolicy, error)
public static DomainPolicy Get(string name, Input<string> id, DomainPolicyState? state, CustomResourceOptions? opts = null)
public static DomainPolicy get(String name, Output<String> id, DomainPolicyState state, CustomResourceOptions options)
resources: _: type: aws:elasticsearch:DomainPolicy get: id: ${id}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Access
Policies string | PolicyDocument - IAM policy document specifying the access policies for the domain
- Domain
Name string - Name of the domain.
- Region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- Access
Policies string | PolicyDocument Args - IAM policy document specifying the access policies for the domain
- Domain
Name string - Name of the domain.
- Region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies String | PolicyDocument - IAM policy document specifying the access policies for the domain
- domain
Name String - Name of the domain.
- region String
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies string | PolicyDocument - IAM policy document specifying the access policies for the domain
- domain
Name string - Name of the domain.
- region string
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access_
policies str | PolicyDocument Args - IAM policy document specifying the access policies for the domain
- domain_
name str - Name of the domain.
- region str
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
- access
Policies String | Property Map - IAM policy document specifying the access policies for the domain
- domain
Name String - Name of the domain.
- region String
- Region where this resource will be managed. Defaults to the Region set in the provider configuration.
Supporting Types
AWSPrincipal, AWSPrincipalArgs
- AWS string | List<string>
- AWS account identifier or ARN.
- AWS string | []string
- AWS account identifier or ARN.
- AWS String | List<String>
- AWS account identifier or ARN.
- AWS string | string[]
- AWS account identifier or ARN.
- aws str | Sequence[str]
- AWS account identifier or ARN.
- AWS String | List<String>
- AWS account identifier or ARN.
FederatedPrincipal, FederatedPrincipalArgs
- Federated string | List<string>
- The federated principal identifier.
- Federated string | []string
- The federated principal identifier.
- Federated String | List<String>
- The federated principal identifier.
- Federated string | string[]
- The federated principal identifier.
- federated str | Sequence[str]
- The federated principal identifier.
- Federated String | List<String>
- The federated principal identifier.
PolicyDocument, PolicyDocumentArgs
PolicyDocumentVersion, PolicyDocumentVersionArgs
- Policy
Document Version_2012_10_17 - 2012-10-17
- Policy
Document Version_2008_10_17 - 2008-10-17
- Policy
Document Version_2012_10_17 - 2012-10-17
- Policy
Document Version_2008_10_17 - 2008-10-17
- _20121017
- 2012-10-17
- _20081017
- 2008-10-17
- Policy
Document Version_2012_10_17 - 2012-10-17
- Policy
Document Version_2008_10_17 - 2008-10-17
- POLICY_DOCUMENT_VERSION_2012_10_17
- 2012-10-17
- POLICY_DOCUMENT_VERSION_2008_10_17
- 2008-10-17
- "2012-10-17"
- 2012-10-17
- "2008-10-17"
- 2008-10-17
PolicyStatement, PolicyStatementArgs
- Effect
Pulumi.
Aws. Iam. Policy Statement Effect - Indicate whether the policy allows or denies access.
- Action string | List<string>
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- Condition Dictionary<string, object>
- Specify the circumstances under which the policy grants permission.
- Not
Action string | List<string> - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- Not
Principal string | Pulumi.Aws. | Pulumi.Iam. Inputs. AWSPrincipal Aws. | Pulumi.Iam. Inputs. Service Principal Aws. Iam. Inputs. Federated Principal - Indicate the account, user, role, or federated user to which this policy does not apply.
- Not
Resource string | List<string> - A list of resources that are specifically excluded by this policy.
- Principal
string | Pulumi.
Aws. | Pulumi.Iam. Inputs. AWSPrincipal Aws. | Pulumi.Iam. Inputs. Service Principal Aws. Iam. Inputs. Federated Principal - Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- Resource string | List<string>
- A list of resources to which the actions apply.
- Sid string
- An optional statement ID to differentiate between your statements.
- Effect
Policy
Statement Effect - Indicate whether the policy allows or denies access.
- Action string | []string
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- Condition map[string]interface{}
- Specify the circumstances under which the policy grants permission.
- Not
Action string | []string - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- Not
Principal string | AWSPrincipal | ServicePrincipal | FederatedPrincipal - Indicate the account, user, role, or federated user to which this policy does not apply.
- Not
Resource string | []string - A list of resources that are specifically excluded by this policy.
- Principal
string | AWSPrincipal | Service
Principal | FederatedPrincipal - Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- Resource string | []string
- A list of resources to which the actions apply.
- Sid string
- An optional statement ID to differentiate between your statements.
- Effect
Policy
Statement Effect - Indicate whether the policy allows or denies access.
- Action String | List<String>
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- Condition Map<String,Object>
- Specify the circumstances under which the policy grants permission.
- Not
Action String | List<String> - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- Not
Principal String | AWSPrincipal | ServicePrincipal | FederatedPrincipal - Indicate the account, user, role, or federated user to which this policy does not apply.
- Not
Resource String | List<String> - A list of resources that are specifically excluded by this policy.
- Principal
String | AWSPrincipal | Service
Principal | FederatedPrincipal - Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- Resource String | List<String>
- A list of resources to which the actions apply.
- Sid String
- An optional statement ID to differentiate between your statements.
- Effect
iam.
Policy Statement Effect - Indicate whether the policy allows or denies access.
- Action string | string[]
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- Condition {[key: string]: any}
- Specify the circumstances under which the policy grants permission.
- Not
Action string | string[] - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- Not
Principal string | iam.AWSPrincipal | iam.Service | iam.Principal Federated Principal - Indicate the account, user, role, or federated user to which this policy does not apply.
- Not
Resource string | string[] - A list of resources that are specifically excluded by this policy.
- Principal
string | iam.
AWSPrincipal | iam.Service | iam.Principal Federated Principal - Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- Resource string | string[]
- A list of resources to which the actions apply.
- Sid string
- An optional statement ID to differentiate between your statements.
- effect
iam.
Policy Statement Effect - Indicate whether the policy allows or denies access.
- action str | Sequence[str]
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- condition Mapping[str, Any]
- Specify the circumstances under which the policy grants permission.
- not_
action str | Sequence[str] - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- not_
principal str | iam.AWSPrincipal | iam.Service | iam.Principal Federated Principal - Indicate the account, user, role, or federated user to which this policy does not apply.
- not_
resource str | Sequence[str] - A list of resources that are specifically excluded by this policy.
- principal
str | iam.
AWSPrincipal | iam.Service | iam.Principal Federated Principal - Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- resource str | Sequence[str]
- A list of resources to which the actions apply.
- sid str
- An optional statement ID to differentiate between your statements.
- Effect "Allow" | "Deny"
- Indicate whether the policy allows or denies access.
- Action String | List<String>
- Include a list of actions that the policy allows or denies. Required (either Action or NotAction)
- Condition Map<Any>
- Specify the circumstances under which the policy grants permission.
- Not
Action String | List<String> - Include a list of actions that are not covered by this policy. Required (either Action or NotAction)
- Not
Principal String | Property Map | Property Map | Property Map - Indicate the account, user, role, or federated user to which this policy does not apply.
- Not
Resource String | List<String> - A list of resources that are specifically excluded by this policy.
- Principal String | Property Map | Property Map | Property Map
- Indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating a policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role.
- Resource String | List<String>
- A list of resources to which the actions apply.
- Sid String
- An optional statement ID to differentiate between your statements.
PolicyStatementEffect, PolicyStatementEffectArgs
- ALLOW
- Allow
- DENY
- Deny
- Policy
Statement Effect ALLOW - Allow
- Policy
Statement Effect DENY - Deny
- ALLOW
- Allow
- DENY
- Deny
- ALLOW
- Allow
- DENY
- Deny
- ALLOW
- Allow
- DENY
- Deny
- "Allow"
- Allow
- "Deny"
- Deny
ServicePrincipal, ServicePrincipalArgs
- Service string | List<string>
- The service principal identifier.
- Service string | []string
- The service principal identifier.
- Service String | List<String>
- The service principal identifier.
- Service string | string[]
- The service principal identifier.
- service str | Sequence[str]
- The service principal identifier.
- Service String | List<String>
- The service principal identifier.
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
aws
Terraform Provider.