AWS Classic
Domain
Manages an Amazon OpenSearch Domain.
Elasticsearch vs. OpenSearch
Amazon OpenSearch Service is the successor to Amazon Elasticsearch Service and supports OpenSearch and legacy Elasticsearch OSS (up to 7.10, the final open source version of the software).
OpenSearch Domain configurations are similar in many ways to Elasticsearch Domain configurations. However, there are important differences including these:
- OpenSearch has
engine_version
while Elasticsearch haselasticsearch_version
- Versions are specified differently - e.g.,
Elasticsearch_7.10
with OpenSearch vs.7.10
for Elasticsearch. instance_type
argument values end insearch
for OpenSearch vs.elasticsearch
for Elasticsearch (e.g.,t2.micro.search
vs.t2.micro.elasticsearch
).- The AWS-managed service-linked role for OpenSearch is called
AWSServiceRoleForAmazonOpenSearchService
instead ofAWSServiceRoleForAmazonElasticsearchService
for Elasticsearch.
There are also some potentially unexpected similarities in configurations:
- ARNs for both are prefaced with
arn:aws:es:
. - Both OpenSearch and Elasticsearch use assume role policies that refer to the
Principal
Service
ases.amazonaws.com
. - IAM policy actions, such as those you will find in
access_policies
, are prefaced withes:
for both.
Example Usage
Basic Usage
using Pulumi;
using Aws = Pulumi.Aws;
class MyStack : Stack
{
public MyStack()
{
var example = new Aws.OpenSearch.Domain("example", new Aws.OpenSearch.DomainArgs
{
ClusterConfig = new Aws.OpenSearch.Inputs.DomainClusterConfigArgs
{
InstanceType = "r4.large.search",
},
EngineVersion = "Elasticsearch_7.10",
Tags =
{
{ "Domain", "TestDomain" },
},
});
}
}
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/opensearch"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := opensearch.NewDomain(ctx, "example", &opensearch.DomainArgs{
ClusterConfig: &opensearch.DomainClusterConfigArgs{
InstanceType: pulumi.String("r4.large.search"),
},
EngineVersion: pulumi.String("Elasticsearch_7.10"),
Tags: pulumi.StringMap{
"Domain": pulumi.String("TestDomain"),
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new Domain("example", DomainArgs.builder()
.clusterConfig(DomainClusterConfigArgs.builder()
.instanceType("r4.large.search")
.build())
.engineVersion("Elasticsearch_7.10")
.tags(Map.of("Domain", "TestDomain"))
.build());
}
}
import pulumi
import pulumi_aws as aws
example = aws.opensearch.Domain("example",
cluster_config=aws.opensearch.DomainClusterConfigArgs(
instance_type="r4.large.search",
),
engine_version="Elasticsearch_7.10",
tags={
"Domain": "TestDomain",
})
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.opensearch.Domain("example", {
clusterConfig: {
instanceType: "r4.large.search",
},
engineVersion: "Elasticsearch_7.10",
tags: {
Domain: "TestDomain",
},
});
resources:
example:
type: aws:opensearch:Domain
properties:
clusterConfig:
instanceType: r4.large.search
engineVersion: Elasticsearch_7.10
tags:
Domain: TestDomain
Access Policy
using Pulumi;
using Aws = Pulumi.Aws;
class MyStack : Stack
{
public MyStack()
{
var config = new Config();
var domain = config.Get("domain") ?? "tf-test";
var currentRegion = Output.Create(Aws.GetRegion.InvokeAsync());
var currentCallerIdentity = Output.Create(Aws.GetCallerIdentity.InvokeAsync());
var example = new Aws.OpenSearch.Domain("example", new Aws.OpenSearch.DomainArgs
{
AccessPolicies = Output.Tuple(currentRegion, currentCallerIdentity).Apply(values =>
{
var currentRegion = values.Item1;
var currentCallerIdentity = values.Item2;
return @$"{{
""Version"": ""2012-10-17"",
""Statement"": [
{{
""Action"": ""es:*"",
""Principal"": ""*"",
""Effect"": ""Allow"",
""Resource"": ""arn:aws:es:{currentRegion.Name}:{currentCallerIdentity.AccountId}:domain/{domain}/*"",
""Condition"": {{
""IpAddress"": {{""aws:SourceIp"": [""66.193.100.22/32""]}}
}}
}}
]
}}
";
}),
});
}
}
package main
import (
"fmt"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/opensearch"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
cfg := config.New(ctx, "")
domain := "tf-test"
if param := cfg.Get("domain"); param != "" {
domain = param
}
currentRegion, err := aws.GetRegion(ctx, nil, nil)
if err != nil {
return err
}
currentCallerIdentity, err := aws.GetCallerIdentity(ctx, nil, nil)
if err != nil {
return err
}
_, err = opensearch.NewDomain(ctx, "example", &opensearch.DomainArgs{
AccessPolicies: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", " \"Version\": \"2012-10-17\",\n", " \"Statement\": [\n", " {\n", " \"Action\": \"es:*\",\n", " \"Principal\": \"*\",\n", " \"Effect\": \"Allow\",\n", " \"Resource\": \"arn:aws:es:", currentRegion.Name, ":", currentCallerIdentity.AccountId, ":domain/", domain, "/*\",\n", " \"Condition\": {\n", " \"IpAddress\": {\"aws:SourceIp\": [\"66.193.100.22/32\"]}\n", " }\n", " }\n", " ]\n", "}\n")),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var config = ctx.config();
final var domain = config.get("domain").orElse("tf-test");
final var currentRegion = Output.of(AwsFunctions.getRegion());
final var currentCallerIdentity = Output.of(AwsFunctions.getCallerIdentity());
var example = new Domain("example", DomainArgs.builder()
.accessPolicies("""
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:%s:%s:domain/%s/*",
"Condition": {
"IpAddress": {"aws:SourceIp": ["66.193.100.22/32"]}
}
}
]
}
", currentRegion.apply(getRegionResult -> getRegionResult.name()),currentCallerIdentity.apply(getCallerIdentityResult -> getCallerIdentityResult.accountId()),domain))
.build());
}
}
import pulumi
import pulumi_aws as aws
config = pulumi.Config()
domain = config.get("domain")
if domain is None:
domain = "tf-test"
current_region = aws.get_region()
current_caller_identity = aws.get_caller_identity()
example = aws.opensearch.Domain("example", access_policies=f"""{{
"Version": "2012-10-17",
"Statement": [
{{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:{current_region.name}:{current_caller_identity.account_id}:domain/{domain}/*",
"Condition": {{
"IpAddress": {{"aws:SourceIp": ["66.193.100.22/32"]}}
}}
}}
]
}}
""")
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const config = new pulumi.Config();
const domain = config.get("domain") || "tf-test";
const currentRegion = aws.getRegion({});
const currentCallerIdentity = aws.getCallerIdentity({});
const example = new aws.opensearch.Domain("example", {accessPolicies: Promise.all([currentRegion, currentCallerIdentity]).then(([currentRegion, currentCallerIdentity]) => `{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:${currentRegion.name}:${currentCallerIdentity.accountId}:domain/${domain}/*",
"Condition": {
"IpAddress": {"aws:SourceIp": ["66.193.100.22/32"]}
}
}
]
}
`)});
configuration:
domain:
type: string
default: tf-test
resources:
example:
type: aws:opensearch:Domain
properties:
accessPolicies: |
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:${currentRegion.name}:${currentCallerIdentity.accountId}:domain/${domain}/*",
"Condition": {
"IpAddress": {"aws:SourceIp": ["66.193.100.22/32"]}
}
}
]
}
variables:
currentRegion:
Fn::Invoke:
Function: aws:getRegion
Arguments: {}
currentCallerIdentity:
Fn::Invoke:
Function: aws:getCallerIdentity
Arguments: {}
Log Publishing to CloudWatch Logs
using Pulumi;
using Aws = Pulumi.Aws;
class MyStack : Stack
{
public MyStack()
{
var exampleLogGroup = new Aws.CloudWatch.LogGroup("exampleLogGroup", new Aws.CloudWatch.LogGroupArgs
{
});
var exampleLogResourcePolicy = new Aws.CloudWatch.LogResourcePolicy("exampleLogResourcePolicy", new Aws.CloudWatch.LogResourcePolicyArgs
{
PolicyName = "example",
PolicyDocument = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""es.amazonaws.com""
},
""Action"": [
""logs:PutLogEvents"",
""logs:PutLogEventsBatch"",
""logs:CreateLogStream""
],
""Resource"": ""arn:aws:logs:*""
}
]
}
",
});
// .. other configuration ...
var exampleDomain = new Aws.OpenSearch.Domain("exampleDomain", new Aws.OpenSearch.DomainArgs
{
LogPublishingOptions =
{
new Aws.OpenSearch.Inputs.DomainLogPublishingOptionArgs
{
CloudwatchLogGroupArn = exampleLogGroup.Arn,
LogType = "INDEX_SLOW_LOGS",
},
},
});
}
}
package main
import (
"fmt"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/cloudwatch"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/opensearch"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
exampleLogGroup, err := cloudwatch.NewLogGroup(ctx, "exampleLogGroup", nil)
if err != nil {
return err
}
_, err = cloudwatch.NewLogResourcePolicy(ctx, "exampleLogResourcePolicy", &cloudwatch.LogResourcePolicyArgs{
PolicyName: pulumi.String("example"),
PolicyDocument: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", " \"Version\": \"2012-10-17\",\n", " \"Statement\": [\n", " {\n", " \"Effect\": \"Allow\",\n", " \"Principal\": {\n", " \"Service\": \"es.amazonaws.com\"\n", " },\n", " \"Action\": [\n", " \"logs:PutLogEvents\",\n", " \"logs:PutLogEventsBatch\",\n", " \"logs:CreateLogStream\"\n", " ],\n", " \"Resource\": \"arn:aws:logs:*\"\n", " }\n", " ]\n", "}\n")),
})
if err != nil {
return err
}
_, err = opensearch.NewDomain(ctx, "exampleDomain", &opensearch.DomainArgs{
LogPublishingOptions: opensearch.DomainLogPublishingOptionArray{
&opensearch.DomainLogPublishingOptionArgs{
CloudwatchLogGroupArn: exampleLogGroup.Arn,
LogType: pulumi.String("INDEX_SLOW_LOGS"),
},
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var exampleLogGroup = new LogGroup("exampleLogGroup");
var exampleLogResourcePolicy = new LogResourcePolicy("exampleLogResourcePolicy", LogResourcePolicyArgs.builder()
.policyName("example")
.policyDocument("""
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "es.amazonaws.com"
},
"Action": [
"logs:PutLogEvents",
"logs:PutLogEventsBatch",
"logs:CreateLogStream"
],
"Resource": "arn:aws:logs:*"
}
]
}
""")
.build());
var exampleDomain = new Domain("exampleDomain", DomainArgs.builder()
.logPublishingOptions(DomainLogPublishingOptionArgs.builder()
.cloudwatchLogGroupArn(exampleLogGroup.arn())
.logType("INDEX_SLOW_LOGS")
.build())
.build());
}
}
import pulumi
import pulumi_aws as aws
example_log_group = aws.cloudwatch.LogGroup("exampleLogGroup")
example_log_resource_policy = aws.cloudwatch.LogResourcePolicy("exampleLogResourcePolicy",
policy_name="example",
policy_document="""{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "es.amazonaws.com"
},
"Action": [
"logs:PutLogEvents",
"logs:PutLogEventsBatch",
"logs:CreateLogStream"
],
"Resource": "arn:aws:logs:*"
}
]
}
""")
# .. other configuration ...
example_domain = aws.opensearch.Domain("exampleDomain", log_publishing_options=[aws.opensearch.DomainLogPublishingOptionArgs(
cloudwatch_log_group_arn=example_log_group.arn,
log_type="INDEX_SLOW_LOGS",
)])
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const exampleLogGroup = new aws.cloudwatch.LogGroup("exampleLogGroup", {});
const exampleLogResourcePolicy = new aws.cloudwatch.LogResourcePolicy("exampleLogResourcePolicy", {
policyName: "example",
policyDocument: `{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "es.amazonaws.com"
},
"Action": [
"logs:PutLogEvents",
"logs:PutLogEventsBatch",
"logs:CreateLogStream"
],
"Resource": "arn:aws:logs:*"
}
]
}
`,
});
// .. other configuration ...
const exampleDomain = new aws.opensearch.Domain("exampleDomain", {logPublishingOptions: [{
cloudwatchLogGroupArn: exampleLogGroup.arn,
logType: "INDEX_SLOW_LOGS",
}]});
resources:
exampleLogGroup:
type: aws:cloudwatch:LogGroup
exampleLogResourcePolicy:
type: aws:cloudwatch:LogResourcePolicy
properties:
policyName: example
policyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "es.amazonaws.com"
},
"Action": [
"logs:PutLogEvents",
"logs:PutLogEventsBatch",
"logs:CreateLogStream"
],
"Resource": "arn:aws:logs:*"
}
]
}
exampleDomain:
type: aws:opensearch:Domain
properties:
logPublishingOptions:
- cloudwatchLogGroupArn: ${exampleLogGroup.arn}
logType: INDEX_SLOW_LOGS
VPC based OpenSearch
using Pulumi;
using Aws = Pulumi.Aws;
class MyStack : Stack
{
public MyStack()
{
var config = new Config();
var vpc = config.RequireObject<dynamic>("vpc");
var domain = config.Get("domain") ?? "tf-test";
var exampleVpc = Output.Create(Aws.Ec2.GetVpc.InvokeAsync(new Aws.Ec2.GetVpcArgs
{
Tags =
{
{ "Name", vpc },
},
}));
var exampleSubnetIds = exampleVpc.Apply(exampleVpc => Output.Create(Aws.Ec2.GetSubnetIds.InvokeAsync(new Aws.Ec2.GetSubnetIdsArgs
{
VpcId = exampleVpc.Id,
Tags =
{
{ "Tier", "private" },
},
})));
var currentRegion = Output.Create(Aws.GetRegion.InvokeAsync());
var currentCallerIdentity = Output.Create(Aws.GetCallerIdentity.InvokeAsync());
var exampleSecurityGroup = new Aws.Ec2.SecurityGroup("exampleSecurityGroup", new Aws.Ec2.SecurityGroupArgs
{
Description = "Managed by Terraform",
VpcId = exampleVpc.Apply(exampleVpc => exampleVpc.Id),
Ingress =
{
new Aws.Ec2.Inputs.SecurityGroupIngressArgs
{
FromPort = 443,
ToPort = 443,
Protocol = "tcp",
CidrBlocks =
{
exampleVpc.Apply(exampleVpc => exampleVpc.CidrBlock),
},
},
},
});
var exampleServiceLinkedRole = new Aws.Iam.ServiceLinkedRole("exampleServiceLinkedRole", new Aws.Iam.ServiceLinkedRoleArgs
{
AwsServiceName = "opensearchservice.amazonaws.com",
});
var exampleDomain = new Aws.OpenSearch.Domain("exampleDomain", new Aws.OpenSearch.DomainArgs
{
EngineVersion = "OpenSearch_1.0",
ClusterConfig = new Aws.OpenSearch.Inputs.DomainClusterConfigArgs
{
InstanceType = "m4.large.search",
ZoneAwarenessEnabled = true,
},
VpcOptions = new Aws.OpenSearch.Inputs.DomainVpcOptionsArgs
{
SubnetIds =
{
exampleSubnetIds.Apply(exampleSubnetIds => exampleSubnetIds.Ids?[0]),
exampleSubnetIds.Apply(exampleSubnetIds => exampleSubnetIds.Ids?[1]),
},
SecurityGroupIds =
{
exampleSecurityGroup.Id,
},
},
AdvancedOptions =
{
{ "rest.action.multi.allow_explicit_index", "true" },
},
AccessPolicies = Output.Tuple(currentRegion, currentCallerIdentity).Apply(values =>
{
var currentRegion = values.Item1;
var currentCallerIdentity = values.Item2;
return @$"{{
""Version"": ""2012-10-17"",
""Statement"": [
{{
""Action"": ""es:*"",
""Principal"": ""*"",
""Effect"": ""Allow"",
""Resource"": ""arn:aws:es:{currentRegion.Name}:{currentCallerIdentity.AccountId}:domain/{domain}/*""
}}
]
}}
";
}),
Tags =
{
{ "Domain", "TestDomain" },
},
}, new CustomResourceOptions
{
DependsOn =
{
exampleServiceLinkedRole,
},
});
}
}
Coming soon!
package generated_program;
import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;
import com.pulumi.resources.CustomResourceOptions;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var config = ctx.config();
final var vpc = config.get("vpc");
final var domain = config.get("domain").orElse("tf-test");
final var exampleVpc = Output.of(Ec2Functions.getVpc(GetVpcArgs.builder()
.tags(Map.of("Name", vpc))
.build()));
final var exampleSubnetIds = Output.of(Ec2Functions.getSubnetIds(GetSubnetIdsArgs.builder()
.vpcId(exampleVpc.apply(getVpcResult -> getVpcResult.id()))
.tags(Map.of("Tier", "private"))
.build()));
final var currentRegion = Output.of(AwsFunctions.getRegion());
final var currentCallerIdentity = Output.of(AwsFunctions.getCallerIdentity());
var exampleSecurityGroup = new SecurityGroup("exampleSecurityGroup", SecurityGroupArgs.builder()
.description("Managed by Terraform")
.vpcId(exampleVpc.apply(getVpcResult -> getVpcResult.id()))
.ingress(SecurityGroupIngressArgs.builder()
.fromPort(443)
.toPort(443)
.protocol("tcp")
.cidrBlocks(exampleVpc.apply(getVpcResult -> getVpcResult.cidrBlock()))
.build())
.build());
var exampleServiceLinkedRole = new ServiceLinkedRole("exampleServiceLinkedRole", ServiceLinkedRoleArgs.builder()
.awsServiceName("opensearchservice.amazonaws.com")
.build());
var exampleDomain = new Domain("exampleDomain", DomainArgs.builder()
.engineVersion("OpenSearch_1.0")
.clusterConfig(DomainClusterConfigArgs.builder()
.instanceType("m4.large.search")
.zoneAwarenessEnabled(true)
.build())
.vpcOptions(DomainVpcOptionsArgs.builder()
.subnetIds(
exampleSubnetIds.apply(getSubnetIdsResult -> getSubnetIdsResult.ids()[0]),
exampleSubnetIds.apply(getSubnetIdsResult -> getSubnetIdsResult.ids()[1]))
.securityGroupIds(exampleSecurityGroup.id())
.build())
.advancedOptions(Map.of("rest.action.multi.allow_explicit_index", "true"))
.accessPolicies("""
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:%s:%s:domain/%s/*"
}
]
}
", currentRegion.apply(getRegionResult -> getRegionResult.name()),currentCallerIdentity.apply(getCallerIdentityResult -> getCallerIdentityResult.accountId()),domain))
.tags(Map.of("Domain", "TestDomain"))
.build(), CustomResourceOptions.builder()
.dependsOn(exampleServiceLinkedRole)
.build());
}
}
import pulumi
import pulumi_aws as aws
config = pulumi.Config()
vpc = config.require_object("vpc")
domain = config.get("domain")
if domain is None:
domain = "tf-test"
example_vpc = aws.ec2.get_vpc(tags={
"Name": vpc,
})
example_subnet_ids = aws.ec2.get_subnet_ids(vpc_id=example_vpc.id,
tags={
"Tier": "private",
})
current_region = aws.get_region()
current_caller_identity = aws.get_caller_identity()
example_security_group = aws.ec2.SecurityGroup("exampleSecurityGroup",
description="Managed by Terraform",
vpc_id=example_vpc.id,
ingress=[aws.ec2.SecurityGroupIngressArgs(
from_port=443,
to_port=443,
protocol="tcp",
cidr_blocks=[example_vpc.cidr_block],
)])
example_service_linked_role = aws.iam.ServiceLinkedRole("exampleServiceLinkedRole", aws_service_name="opensearchservice.amazonaws.com")
example_domain = aws.opensearch.Domain("exampleDomain",
engine_version="OpenSearch_1.0",
cluster_config=aws.opensearch.DomainClusterConfigArgs(
instance_type="m4.large.search",
zone_awareness_enabled=True,
),
vpc_options=aws.opensearch.DomainVpcOptionsArgs(
subnet_ids=[
example_subnet_ids.ids[0],
example_subnet_ids.ids[1],
],
security_group_ids=[example_security_group.id],
),
advanced_options={
"rest.action.multi.allow_explicit_index": "true",
},
access_policies=f"""{{
"Version": "2012-10-17",
"Statement": [
{{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:{current_region.name}:{current_caller_identity.account_id}:domain/{domain}/*"
}}
]
}}
""",
tags={
"Domain": "TestDomain",
},
opts=pulumi.ResourceOptions(depends_on=[example_service_linked_role]))
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const config = new pulumi.Config();
const vpc = config.requireObject("vpc");
const domain = config.get("domain") || "tf-test";
const exampleVpc = aws.ec2.getVpc({
tags: {
Name: vpc,
},
});
const exampleSubnetIds = exampleVpc.then(exampleVpc => aws.ec2.getSubnetIds({
vpcId: exampleVpc.id,
tags: {
Tier: "private",
},
}));
const currentRegion = aws.getRegion({});
const currentCallerIdentity = aws.getCallerIdentity({});
const exampleSecurityGroup = new aws.ec2.SecurityGroup("exampleSecurityGroup", {
description: "Managed by Terraform",
vpcId: exampleVpc.then(exampleVpc => exampleVpc.id),
ingress: [{
fromPort: 443,
toPort: 443,
protocol: "tcp",
cidrBlocks: [exampleVpc.then(exampleVpc => exampleVpc.cidrBlock)],
}],
});
const exampleServiceLinkedRole = new aws.iam.ServiceLinkedRole("exampleServiceLinkedRole", {awsServiceName: "opensearchservice.amazonaws.com"});
const exampleDomain = new aws.opensearch.Domain("exampleDomain", {
engineVersion: "OpenSearch_1.0",
clusterConfig: {
instanceType: "m4.large.search",
zoneAwarenessEnabled: true,
},
vpcOptions: {
subnetIds: [
exampleSubnetIds.then(exampleSubnetIds => exampleSubnetIds.ids?[0]),
exampleSubnetIds.then(exampleSubnetIds => exampleSubnetIds.ids?[1]),
],
securityGroupIds: [exampleSecurityGroup.id],
},
advancedOptions: {
"rest.action.multi.allow_explicit_index": "true",
},
accessPolicies: Promise.all([currentRegion, currentCallerIdentity]).then(([currentRegion, currentCallerIdentity]) => `{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:${currentRegion.name}:${currentCallerIdentity.accountId}:domain/${domain}/*"
}
]
}
`),
tags: {
Domain: "TestDomain",
},
}, {
dependsOn: [exampleServiceLinkedRole],
});
configuration:
vpc:
type: dynamic
domain:
type: string
default: tf-test
resources:
exampleSecurityGroup:
type: aws:ec2:SecurityGroup
properties:
description: Managed by Terraform
vpcId: ${exampleVpc.id}
ingress:
- fromPort: 443
toPort: 443
protocol: tcp
cidrBlocks:
- ${exampleVpc.cidrBlock}
exampleServiceLinkedRole:
type: aws:iam:ServiceLinkedRole
properties:
awsServiceName: opensearchservice.amazonaws.com
exampleDomain:
type: aws:opensearch:Domain
properties:
engineVersion: OpenSearch_1.0
clusterConfig:
instanceType: m4.large.search
zoneAwarenessEnabled: true
vpcOptions:
subnetIds:
- ${exampleSubnetIds.ids[0]}
- ${exampleSubnetIds.ids[1]}
securityGroupIds:
- ${exampleSecurityGroup.id}
advancedOptions:
rest.action.multi.allow_explicit_index: true
accessPolicies: |
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "es:*",
"Principal": "*",
"Effect": "Allow",
"Resource": "arn:aws:es:${currentRegion.name}:${currentCallerIdentity.accountId}:domain/${domain}/*"
}
]
}
tags:
Domain: TestDomain
options:
dependson:
- ${exampleServiceLinkedRole}
variables:
exampleVpc:
Fn::Invoke:
Function: aws:ec2:getVpc
Arguments:
tags:
Name: ${vpc}
exampleSubnetIds:
Fn::Invoke:
Function: aws:ec2:getSubnetIds
Arguments:
vpcId: ${exampleVpc.id}
tags:
Tier: private
currentRegion:
Fn::Invoke:
Function: aws:getRegion
Arguments: {}
currentCallerIdentity:
Fn::Invoke:
Function: aws:getCallerIdentity
Arguments: {}
Create a Domain Resource
new Domain(name: string, args?: DomainArgs, opts?: CustomResourceOptions);
@overload
def Domain(resource_name: str,
opts: Optional[ResourceOptions] = None,
access_policies: Optional[str] = None,
advanced_options: Optional[Mapping[str, str]] = None,
advanced_security_options: Optional[DomainAdvancedSecurityOptionsArgs] = None,
auto_tune_options: Optional[DomainAutoTuneOptionsArgs] = None,
cluster_config: Optional[DomainClusterConfigArgs] = None,
cognito_options: Optional[DomainCognitoOptionsArgs] = None,
domain_endpoint_options: Optional[DomainDomainEndpointOptionsArgs] = None,
domain_name: Optional[str] = None,
ebs_options: Optional[DomainEbsOptionsArgs] = None,
encrypt_at_rest: Optional[DomainEncryptAtRestArgs] = None,
engine_version: Optional[str] = None,
log_publishing_options: Optional[Sequence[DomainLogPublishingOptionArgs]] = None,
node_to_node_encryption: Optional[DomainNodeToNodeEncryptionArgs] = None,
snapshot_options: Optional[DomainSnapshotOptionsArgs] = None,
tags: Optional[Mapping[str, str]] = None,
vpc_options: Optional[DomainVpcOptionsArgs] = None)
@overload
def Domain(resource_name: str,
args: Optional[DomainArgs] = None,
opts: Optional[ResourceOptions] = None)
func NewDomain(ctx *Context, name string, args *DomainArgs, opts ...ResourceOption) (*Domain, error)
public Domain(string name, DomainArgs? args = null, CustomResourceOptions? opts = null)
public Domain(String name, DomainArgs args)
public Domain(String name, DomainArgs args, CustomResourceOptions options)
type: aws:opensearch:Domain
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args DomainArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args DomainArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args DomainArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args DomainArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args DomainArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Domain Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The Domain resource accepts the following input properties:
- Access
Policies string IAM policy document specifying the access policies for the domain.
- Advanced
Options Dictionary<string, string> - Advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- Auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- Cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- Cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- Domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- Domain
Name string Name of the domain.
- Ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- Encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- Engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- Log
Publishing List<DomainOptions Log Publishing Option Args> Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- Node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- Snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Dictionary<string, string>
- Vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- Access
Policies string IAM policy document specifying the access policies for the domain.
- Advanced
Options map[string]string - Advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- Auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- Cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- Cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- Domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- Domain
Name string Name of the domain.
- Ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- Encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- Engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- Log
Publishing []DomainOptions Log Publishing Option Args Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- Node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- Snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- map[string]string
- Vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies String IAM policy document specifying the access policies for the domain.
- advanced
Options Map<String,String> - advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Name String Name of the domain.
- ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- engine
Version String Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- log
Publishing List<DomainOptions Log Publishing Option Args> Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Map<String,String>
- vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies string IAM policy document specifying the access policies for the domain.
- advanced
Options {[key: string]: string} - advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Name string Name of the domain.
- ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- log
Publishing DomainOptions Log Publishing Option Args[] Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- {[key: string]: string}
- vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access_
policies str IAM policy document specifying the access policies for the domain.
- advanced_
options Mapping[str, str] - advanced_
security_ Domainoptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- auto_
tune_ Domainoptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster_
config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito_
options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain_
endpoint_ Domainoptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain_
name str Name of the domain.
- ebs_
options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt_
at_ Domainrest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- engine_
version str Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- log_
publishing_ Sequence[Domainoptions Log Publishing Option Args] Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node_
to_ Domainnode_ encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot_
options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Mapping[str, str]
- vpc_
options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies String IAM policy document specifying the access policies for the domain.
- advanced
Options Map<String> - advanced
Security Property MapOptions Configuration block for fine-grained access control. Detailed below.
- auto
Tune Property MapOptions Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config Property Map Configuration block for the cluster of the domain. Detailed below.
- cognito
Options Property Map Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint Property MapOptions Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Name String Name of the domain.
- ebs
Options Property Map Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At Property MapRest Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- engine
Version String Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- log
Publishing List<Property Map>Options Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To Property MapNode Encryption Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options Property Map Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Map<String>
- vpc
Options Property Map Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
Outputs
All input properties are implicitly available as output properties. Additionally, the Domain resource produces the following output properties:
- Arn string
ARN of the domain.
- Domain
Id string Unique identifier for the domain.
- Endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- Id string
The provider-assigned unique ID for this managed resource.
- Kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- Dictionary<string, string>
- Arn string
ARN of the domain.
- Domain
Id string Unique identifier for the domain.
- Endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- Id string
The provider-assigned unique ID for this managed resource.
- Kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- map[string]string
- arn String
ARN of the domain.
- domain
Id String Unique identifier for the domain.
- endpoint String
Domain-specific endpoint used to submit index, search, and data upload requests.
- id String
The provider-assigned unique ID for this managed resource.
- kibana
Endpoint String Domain-specific endpoint for kibana without https scheme.
- Map<String,String>
- arn string
ARN of the domain.
- domain
Id string Unique identifier for the domain.
- endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- id string
The provider-assigned unique ID for this managed resource.
- kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- {[key: string]: string}
- arn str
ARN of the domain.
- domain_
id str Unique identifier for the domain.
- endpoint str
Domain-specific endpoint used to submit index, search, and data upload requests.
- id str
The provider-assigned unique ID for this managed resource.
- kibana_
endpoint str Domain-specific endpoint for kibana without https scheme.
- Mapping[str, str]
- arn String
ARN of the domain.
- domain
Id String Unique identifier for the domain.
- endpoint String
Domain-specific endpoint used to submit index, search, and data upload requests.
- id String
The provider-assigned unique ID for this managed resource.
- kibana
Endpoint String Domain-specific endpoint for kibana without https scheme.
- Map<String>
Look up an Existing Domain Resource
Get an existing Domain resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: DomainState, opts?: CustomResourceOptions): Domain
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
access_policies: Optional[str] = None,
advanced_options: Optional[Mapping[str, str]] = None,
advanced_security_options: Optional[DomainAdvancedSecurityOptionsArgs] = None,
arn: Optional[str] = None,
auto_tune_options: Optional[DomainAutoTuneOptionsArgs] = None,
cluster_config: Optional[DomainClusterConfigArgs] = None,
cognito_options: Optional[DomainCognitoOptionsArgs] = None,
domain_endpoint_options: Optional[DomainDomainEndpointOptionsArgs] = None,
domain_id: Optional[str] = None,
domain_name: Optional[str] = None,
ebs_options: Optional[DomainEbsOptionsArgs] = None,
encrypt_at_rest: Optional[DomainEncryptAtRestArgs] = None,
endpoint: Optional[str] = None,
engine_version: Optional[str] = None,
kibana_endpoint: Optional[str] = None,
log_publishing_options: Optional[Sequence[DomainLogPublishingOptionArgs]] = None,
node_to_node_encryption: Optional[DomainNodeToNodeEncryptionArgs] = None,
snapshot_options: Optional[DomainSnapshotOptionsArgs] = None,
tags: Optional[Mapping[str, str]] = None,
tags_all: Optional[Mapping[str, str]] = None,
vpc_options: Optional[DomainVpcOptionsArgs] = None) -> Domain
func GetDomain(ctx *Context, name string, id IDInput, state *DomainState, opts ...ResourceOption) (*Domain, error)
public static Domain Get(string name, Input<string> id, DomainState? state, CustomResourceOptions? opts = null)
public static Domain get(String name, Output<String> id, DomainState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Access
Policies string IAM policy document specifying the access policies for the domain.
- Advanced
Options Dictionary<string, string> - Advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- Arn string
ARN of the domain.
- Auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- Cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- Cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- Domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- Domain
Id string Unique identifier for the domain.
- Domain
Name string Name of the domain.
- Ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- Encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- Endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- Engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- Kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- Log
Publishing List<DomainOptions Log Publishing Option Args> Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- Node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- Snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Dictionary<string, string>
- Dictionary<string, string>
- Vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- Access
Policies string IAM policy document specifying the access policies for the domain.
- Advanced
Options map[string]string - Advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- Arn string
ARN of the domain.
- Auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- Cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- Cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- Domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- Domain
Id string Unique identifier for the domain.
- Domain
Name string Name of the domain.
- Ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- Encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- Endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- Engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- Kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- Log
Publishing []DomainOptions Log Publishing Option Args Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- Node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- Snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- map[string]string
- map[string]string
- Vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies String IAM policy document specifying the access policies for the domain.
- advanced
Options Map<String,String> - advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- arn String
ARN of the domain.
- auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Id String Unique identifier for the domain.
- domain
Name String Name of the domain.
- ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- endpoint String
Domain-specific endpoint used to submit index, search, and data upload requests.
- engine
Version String Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- kibana
Endpoint String Domain-specific endpoint for kibana without https scheme.
- log
Publishing List<DomainOptions Log Publishing Option Args> Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Map<String,String>
- Map<String,String>
- vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies string IAM policy document specifying the access policies for the domain.
- advanced
Options {[key: string]: string} - advanced
Security DomainOptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- arn string
ARN of the domain.
- auto
Tune DomainOptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito
Options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint DomainOptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Id string Unique identifier for the domain.
- domain
Name string Name of the domain.
- ebs
Options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At DomainRest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- endpoint string
Domain-specific endpoint used to submit index, search, and data upload requests.
- engine
Version string Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- kibana
Endpoint string Domain-specific endpoint for kibana without https scheme.
- log
Publishing DomainOptions Log Publishing Option Args[] Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To DomainNode Encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- {[key: string]: string}
- {[key: string]: string}
- vpc
Options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access_
policies str IAM policy document specifying the access policies for the domain.
- advanced_
options Mapping[str, str] - advanced_
security_ Domainoptions Advanced Security Options Args Configuration block for fine-grained access control. Detailed below.
- arn str
ARN of the domain.
- auto_
tune_ Domainoptions Auto Tune Options Args Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster_
config DomainCluster Config Args Configuration block for the cluster of the domain. Detailed below.
- cognito_
options DomainCognito Options Args Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain_
endpoint_ Domainoptions Domain Endpoint Options Args Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain_
id str Unique identifier for the domain.
- domain_
name str Name of the domain.
- ebs_
options DomainEbs Options Args Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt_
at_ Domainrest Encrypt At Rest Args Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- endpoint str
Domain-specific endpoint used to submit index, search, and data upload requests.
- engine_
version str Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- kibana_
endpoint str Domain-specific endpoint for kibana without https scheme.
- log_
publishing_ Sequence[Domainoptions Log Publishing Option Args] Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node_
to_ Domainnode_ encryption Node To Node Encryption Args Configuration block for node-to-node encryption options. Detailed below.
- snapshot_
options DomainSnapshot Options Args Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Mapping[str, str]
- Mapping[str, str]
- vpc_
options DomainVpc Options Args Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
- access
Policies String IAM policy document specifying the access policies for the domain.
- advanced
Options Map<String> - advanced
Security Property MapOptions Configuration block for fine-grained access control. Detailed below.
- arn String
ARN of the domain.
- auto
Tune Property MapOptions Configuration block for the Auto-Tune options of the domain. Detailed below.
- cluster
Config Property Map Configuration block for the cluster of the domain. Detailed below.
- cognito
Options Property Map Configuration block for authenticating Kibana with Cognito. Detailed below.
- domain
Endpoint Property MapOptions Configuration block for domain endpoint HTTP(S) related options. Detailed below.
- domain
Id String Unique identifier for the domain.
- domain
Name String Name of the domain.
- ebs
Options Property Map Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.
- encrypt
At Property MapRest Configuration block for encrypt at rest options. Only available for certain instance types. Detailed below.
- endpoint String
Domain-specific endpoint used to submit index, search, and data upload requests.
- engine
Version String Either
Elasticsearch_X.Y
orOpenSearch_X.Y
to specify the engine version for the Amazon OpenSearch Service domain. For example,OpenSearch_1.0
orElasticsearch_7.9
. See Creating and managing Amazon OpenSearch Service domains. Defaults toOpenSearch_1.1
.- kibana
Endpoint String Domain-specific endpoint for kibana without https scheme.
- log
Publishing List<Property Map>Options Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
- node
To Property MapNode Encryption Configuration block for node-to-node encryption options. Detailed below.
- snapshot
Options Property Map Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
- Map<String>
- Map<String>
- vpc
Options Property Map Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.
Supporting Types
DomainAdvancedSecurityOptions
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- Internal
User boolDatabase Enabled Whether the internal user database is enabled. Default is
false
.- Master
User DomainOptions Advanced Security Options Master User Options Configuration block for the main user. Detailed below.
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- Internal
User boolDatabase Enabled Whether the internal user database is enabled. Default is
false
.- Master
User DomainOptions Advanced Security Options Master User Options Configuration block for the main user. Detailed below.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- internal
User BooleanDatabase Enabled Whether the internal user database is enabled. Default is
false
.- master
User DomainOptions Advanced Security Options Master User Options Configuration block for the main user. Detailed below.
- enabled boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- internal
User booleanDatabase Enabled Whether the internal user database is enabled. Default is
false
.- master
User DomainOptions Advanced Security Options Master User Options Configuration block for the main user. Detailed below.
- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- internal_
user_ booldatabase_ enabled Whether the internal user database is enabled. Default is
false
.- master_
user_ Domainoptions Advanced Security Options Master User Options Configuration block for the main user. Detailed below.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- internal
User BooleanDatabase Enabled Whether the internal user database is enabled. Default is
false
.- master
User Property MapOptions Configuration block for the main user. Detailed below.
DomainAdvancedSecurityOptionsMasterUserOptions
- Master
User stringArn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- Master
User stringName Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- Master
User stringPassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
- Master
User stringArn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- Master
User stringName Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- Master
User stringPassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
- master
User StringArn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- master
User StringName Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- master
User StringPassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
- master
User stringArn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- master
User stringName Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- master
User stringPassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
- master_
user_ strarn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- master_
user_ strname Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- master_
user_ strpassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
- master
User StringArn ARN for the main user. Only specify if
internal_user_database_enabled
is not set or set tofalse
.- master
User StringName Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.- master
User StringPassword Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if
internal_user_database_enabled
is set totrue
.
DomainAutoTuneOptions
- Desired
State string Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- Maintenance
Schedules List<DomainAuto Tune Options Maintenance Schedule> Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- Rollback
On stringDisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
- Desired
State string Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- Maintenance
Schedules []DomainAuto Tune Options Maintenance Schedule Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- Rollback
On stringDisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
- desired
State String Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- maintenance
Schedules List<DomainAuto Tune Options Maintenance Schedule> Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- rollback
On StringDisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
- desired
State string Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- maintenance
Schedules DomainAuto Tune Options Maintenance Schedule[] Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- rollback
On stringDisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
- desired_
state str Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- maintenance_
schedules Sequence[DomainAuto Tune Options Maintenance Schedule] Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- rollback_
on_ strdisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
- desired
State String Auto-Tune desired state for the domain. Valid values:
ENABLED
orDISABLED
.- maintenance
Schedules List<Property Map> Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
- rollback
On StringDisable Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values:
DEFAULT_ROLLBACK
orNO_ROLLBACK
.
DomainAutoTuneOptionsMaintenanceSchedule
- Cron
Expression stringFor Recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- Duration
Domain
Auto Tune Options Maintenance Schedule Duration Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- Start
At string Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
- Cron
Expression stringFor Recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- Duration
Domain
Auto Tune Options Maintenance Schedule Duration Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- Start
At string Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
- cron
Expression StringFor Recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- duration
Domain
Auto Tune Options Maintenance Schedule Duration Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- start
At String Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
- cron
Expression stringFor Recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- duration
Domain
Auto Tune Options Maintenance Schedule Duration Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- start
At string Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
- cron_
expression_ strfor_ recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- duration
Domain
Auto Tune Options Maintenance Schedule Duration Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- start_
at str Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
- cron
Expression StringFor Recurrence A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
- duration Property Map
Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
- start
At String Date and time at which to start the Auto-Tune maintenance schedule in RFC3339 format.
DomainAutoTuneOptionsMaintenanceScheduleDuration
DomainClusterConfig
- Cold
Storage DomainOptions Cluster Config Cold Storage Options Configuration block containing cold storage configuration. Detailed below.
- Dedicated
Master intCount Number of dedicated main nodes in the cluster.
- Dedicated
Master boolEnabled Whether dedicated main nodes are enabled for the cluster.
- Dedicated
Master stringType Instance type of the dedicated main nodes in the cluster.
- Instance
Count int Number of instances in the cluster.
- Instance
Type string Instance type of data nodes in the cluster.
- Warm
Count int Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- Warm
Enabled bool Whether to enable warm storage.
- Warm
Type string Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- Zone
Awareness DomainConfig Cluster Config Zone Awareness Config Configuration block containing zone awareness settings. Detailed below.
- Zone
Awareness boolEnabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
- Cold
Storage DomainOptions Cluster Config Cold Storage Options Configuration block containing cold storage configuration. Detailed below.
- Dedicated
Master intCount Number of dedicated main nodes in the cluster.
- Dedicated
Master boolEnabled Whether dedicated main nodes are enabled for the cluster.
- Dedicated
Master stringType Instance type of the dedicated main nodes in the cluster.
- Instance
Count int Number of instances in the cluster.
- Instance
Type string Instance type of data nodes in the cluster.
- Warm
Count int Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- Warm
Enabled bool Whether to enable warm storage.
- Warm
Type string Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- Zone
Awareness DomainConfig Cluster Config Zone Awareness Config Configuration block containing zone awareness settings. Detailed below.
- Zone
Awareness boolEnabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
- cold
Storage DomainOptions Cluster Config Cold Storage Options Configuration block containing cold storage configuration. Detailed below.
- dedicated
Master IntegerCount Number of dedicated main nodes in the cluster.
- dedicated
Master BooleanEnabled Whether dedicated main nodes are enabled for the cluster.
- dedicated
Master StringType Instance type of the dedicated main nodes in the cluster.
- instance
Count Integer Number of instances in the cluster.
- instance
Type String Instance type of data nodes in the cluster.
- warm
Count Integer Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- warm
Enabled Boolean Whether to enable warm storage.
- warm
Type String Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- zone
Awareness DomainConfig Cluster Config Zone Awareness Config Configuration block containing zone awareness settings. Detailed below.
- zone
Awareness BooleanEnabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
- cold
Storage DomainOptions Cluster Config Cold Storage Options Configuration block containing cold storage configuration. Detailed below.
- dedicated
Master numberCount Number of dedicated main nodes in the cluster.
- dedicated
Master booleanEnabled Whether dedicated main nodes are enabled for the cluster.
- dedicated
Master stringType Instance type of the dedicated main nodes in the cluster.
- instance
Count number Number of instances in the cluster.
- instance
Type string Instance type of data nodes in the cluster.
- warm
Count number Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- warm
Enabled boolean Whether to enable warm storage.
- warm
Type string Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- zone
Awareness DomainConfig Cluster Config Zone Awareness Config Configuration block containing zone awareness settings. Detailed below.
- zone
Awareness booleanEnabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
- cold_
storage_ Domainoptions Cluster Config Cold Storage Options Configuration block containing cold storage configuration. Detailed below.
- dedicated_
master_ intcount Number of dedicated main nodes in the cluster.
- dedicated_
master_ boolenabled Whether dedicated main nodes are enabled for the cluster.
- dedicated_
master_ strtype Instance type of the dedicated main nodes in the cluster.
- instance_
count int Number of instances in the cluster.
- instance_
type str Instance type of data nodes in the cluster.
- warm_
count int Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- warm_
enabled bool Whether to enable warm storage.
- warm_
type str Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- zone_
awareness_ Domainconfig Cluster Config Zone Awareness Config Configuration block containing zone awareness settings. Detailed below.
- zone_
awareness_ boolenabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
- cold
Storage Property MapOptions Configuration block containing cold storage configuration. Detailed below.
- dedicated
Master NumberCount Number of dedicated main nodes in the cluster.
- dedicated
Master BooleanEnabled Whether dedicated main nodes are enabled for the cluster.
- dedicated
Master StringType Instance type of the dedicated main nodes in the cluster.
- instance
Count Number Number of instances in the cluster.
- instance
Type String Instance type of data nodes in the cluster.
- warm
Count Number Number of warm nodes in the cluster. Valid values are between
2
and150
.warm_count
can be only and must be set whenwarm_enabled
is set totrue
.- warm
Enabled Boolean Whether to enable warm storage.
- warm
Type String Instance type for the OpenSearch cluster's warm nodes. Valid values are
ultrawarm1.medium.search
,ultrawarm1.large.search
andultrawarm1.xlarge.search
.warm_type
can be only and must be set whenwarm_enabled
is set totrue
.- zone
Awareness Property MapConfig Configuration block containing zone awareness settings. Detailed below.
- zone
Awareness BooleanEnabled Whether zone awareness is enabled, set to
true
for multi-az deployment. To enable awareness with three Availability Zones, theavailability_zone_count
within thezone_awareness_config
must be set to3
.
DomainClusterConfigColdStorageOptions
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
DomainClusterConfigZoneAwarenessConfig
- Availability
Zone intCount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
- Availability
Zone intCount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
- availability
Zone IntegerCount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
- availability
Zone numberCount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
- availability_
zone_ intcount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
- availability
Zone NumberCount Number of Availability Zones for the domain to use with
zone_awareness_enabled
. Defaults to2
. Valid values:2
or3
.
DomainCognitoOptions
- Identity
Pool stringId ID of the Cognito Identity Pool to use.
- Role
Arn string ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- User
Pool stringId ID of the Cognito User Pool to use.
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- Identity
Pool stringId ID of the Cognito Identity Pool to use.
- Role
Arn string ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- User
Pool stringId ID of the Cognito User Pool to use.
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- identity
Pool StringId ID of the Cognito Identity Pool to use.
- role
Arn String ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- user
Pool StringId ID of the Cognito User Pool to use.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- identity
Pool stringId ID of the Cognito Identity Pool to use.
- role
Arn string ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- user
Pool stringId ID of the Cognito User Pool to use.
- enabled boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- identity_
pool_ strid ID of the Cognito Identity Pool to use.
- role_
arn str ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- user_
pool_ strid ID of the Cognito User Pool to use.
- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- identity
Pool StringId ID of the Cognito Identity Pool to use.
- role
Arn String ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
- user
Pool StringId ID of the Cognito User Pool to use.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
DomainDomainEndpointOptions
- Custom
Endpoint string Fully qualified domain for your custom endpoint.
- Custom
Endpoint stringCertificate Arn ACM certificate ARN for your custom endpoint.
- Custom
Endpoint boolEnabled Whether to enable custom endpoint for the OpenSearch domain.
- Enforce
Https bool Whether or not to require HTTPS. Defaults to
true
.- Tls
Security stringPolicy
- Custom
Endpoint string Fully qualified domain for your custom endpoint.
- Custom
Endpoint stringCertificate Arn ACM certificate ARN for your custom endpoint.
- Custom
Endpoint boolEnabled Whether to enable custom endpoint for the OpenSearch domain.
- Enforce
Https bool Whether or not to require HTTPS. Defaults to
true
.- Tls
Security stringPolicy
- custom
Endpoint String Fully qualified domain for your custom endpoint.
- custom
Endpoint StringCertificate Arn ACM certificate ARN for your custom endpoint.
- custom
Endpoint BooleanEnabled Whether to enable custom endpoint for the OpenSearch domain.
- enforce
Https Boolean Whether or not to require HTTPS. Defaults to
true
.- tls
Security StringPolicy
- custom
Endpoint string Fully qualified domain for your custom endpoint.
- custom
Endpoint stringCertificate Arn ACM certificate ARN for your custom endpoint.
- custom
Endpoint booleanEnabled Whether to enable custom endpoint for the OpenSearch domain.
- enforce
Https boolean Whether or not to require HTTPS. Defaults to
true
.- tls
Security stringPolicy
- custom_
endpoint str Fully qualified domain for your custom endpoint.
- custom_
endpoint_ strcertificate_ arn ACM certificate ARN for your custom endpoint.
- custom_
endpoint_ boolenabled Whether to enable custom endpoint for the OpenSearch domain.
- enforce_
https bool Whether or not to require HTTPS. Defaults to
true
.- tls_
security_ strpolicy
- custom
Endpoint String Fully qualified domain for your custom endpoint.
- custom
Endpoint StringCertificate Arn ACM certificate ARN for your custom endpoint.
- custom
Endpoint BooleanEnabled Whether to enable custom endpoint for the OpenSearch domain.
- enforce
Https Boolean Whether or not to require HTTPS. Defaults to
true
.- tls
Security StringPolicy
DomainEbsOptions
- Ebs
Enabled bool Whether EBS volumes are attached to data nodes in the domain.
- Iops int
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- Volume
Size int Size of EBS volumes attached to data nodes (in GiB).
- Volume
Type string Type of EBS volumes attached to data nodes.
- Ebs
Enabled bool Whether EBS volumes are attached to data nodes in the domain.
- Iops int
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- Volume
Size int Size of EBS volumes attached to data nodes (in GiB).
- Volume
Type string Type of EBS volumes attached to data nodes.
- ebs
Enabled Boolean Whether EBS volumes are attached to data nodes in the domain.
- iops Integer
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- volume
Size Integer Size of EBS volumes attached to data nodes (in GiB).
- volume
Type String Type of EBS volumes attached to data nodes.
- ebs
Enabled boolean Whether EBS volumes are attached to data nodes in the domain.
- iops number
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- volume
Size number Size of EBS volumes attached to data nodes (in GiB).
- volume
Type string Type of EBS volumes attached to data nodes.
- ebs_
enabled bool Whether EBS volumes are attached to data nodes in the domain.
- iops int
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- volume_
size int Size of EBS volumes attached to data nodes (in GiB).
- volume_
type str Type of EBS volumes attached to data nodes.
- ebs
Enabled Boolean Whether EBS volumes are attached to data nodes in the domain.
- iops Number
Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the Provisioned IOPS EBS volume type.
- volume
Size Number Size of EBS volumes attached to data nodes (in GiB).
- volume
Type String Type of EBS volumes attached to data nodes.
DomainEncryptAtRest
- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.- kms_
key_ strid
DomainLogPublishingOption
- Cloudwatch
Log stringGroup Arn ARN of the Cloudwatch log group to which log needs to be published.
- Log
Type string Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- Cloudwatch
Log stringGroup Arn ARN of the Cloudwatch log group to which log needs to be published.
- Log
Type string Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- cloudwatch
Log StringGroup Arn ARN of the Cloudwatch log group to which log needs to be published.
- log
Type String Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- cloudwatch
Log stringGroup Arn ARN of the Cloudwatch log group to which log needs to be published.
- log
Type string Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- enabled boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- cloudwatch_
log_ strgroup_ arn ARN of the Cloudwatch log group to which log needs to be published.
- log_
type str Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- cloudwatch
Log StringGroup Arn ARN of the Cloudwatch log group to which log needs to be published.
- log
Type String Type of OpenSearch log. Valid values:
INDEX_SLOW_LOGS
,SEARCH_SLOW_LOGS
,ES_APPLICATION_LOGS
,AUDIT_LOGS
.- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
DomainNodeToNodeEncryption
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- Enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled bool
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
- enabled Boolean
Whether to enable node-to-node encryption. If the
node_to_node_encryption
block is not provided then this defaults tofalse
. Enabling node-to-node encryption of a new domain requires anengine_version
ofOpenSearch_X.Y
orElasticsearch_6.0
or greater.
DomainSnapshotOptions
- Automated
Snapshot intStart Hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
- Automated
Snapshot intStart Hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
- automated
Snapshot IntegerStart Hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
- automated
Snapshot numberStart Hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
- automated_
snapshot_ intstart_ hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
- automated
Snapshot NumberStart Hour Hour during which the service takes an automated daily snapshot of the indices in the domain.
DomainVpcOptions
- Availability
Zones List<string> - Security
Group List<string>Ids List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- Subnet
Ids List<string> List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- Vpc
Id string
- Availability
Zones []string - Security
Group []stringIds List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- Subnet
Ids []string List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- Vpc
Id string
- availability
Zones List<String> - security
Group List<String>Ids List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- subnet
Ids List<String> List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- vpc
Id String
- availability
Zones string[] - security
Group string[]Ids List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- subnet
Ids string[] List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- vpc
Id string
- availability_
zones Sequence[str] - security_
group_ Sequence[str]ids List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- subnet_
ids Sequence[str] List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- vpc_
id str
- availability
Zones List<String> - security
Group List<String>Ids List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
- subnet
Ids List<String> List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
- vpc
Id String
Import
OpenSearch domains can be imported using the domain_name
, e.g.,
$ pulumi import aws:opensearch/domain:Domain example domain_name
Package Details
- Repository
- https://github.com/pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
aws
Terraform Provider.