# AWS OpenSearch Terraform module Terraform module which creates AWS OpenSearch resources. [![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md) ## Usage See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples) directory for working examples to reference: ```hcl module "opensearch" { source = "terraform-aws-modules/opensearch/aws" # Domain advanced_options = { "rest.action.multi.allow_explicit_index" = "true" } advanced_security_options = { enabled = false anonymous_auth_enabled = true internal_user_database_enabled = true master_user_options = { master_user_name = "example" master_user_password = "Barbarbarbar1!" } # Optional: JWT authentication and authorization # jwt_options = { # enabled = true # public_key = file("path/to/publickey.pem") # roles_key = "roles" # Optional, defaults to "roles" # subject_key = "sub" # Optional, defaults to "sub" # } } auto_tune_options = { desired_state = "ENABLED" maintenance_schedule = [ { start_at = "2028-05-13T07:44:12Z" cron_expression_for_recurrence = "cron(0 0 ? * 1 *)" duration = { value = "2" unit = "HOURS" } } ] rollback_on_disable = "NO_ROLLBACK" } cluster_config = { instance_count = 3 dedicated_master_enabled = true dedicated_master_type = "c6g.large.search" instance_type = "r6g.large.search" zone_awareness_config = { availability_zone_count = 3 } zone_awareness_enabled = true } domain_endpoint_options = { enforce_https = true tls_security_policy = "Policy-Min-TLS-1-2-2019-07" } domain_name = local.name ebs_options = { ebs_enabled = true iops = 3000 throughput = 125 volume_type = "gp3" volume_size = 20 } encrypt_at_rest = { enabled = true } engine_version = "OpenSearch_2.11" log_publishing_options = [ { log_type = "INDEX_SLOW_LOGS" }, { log_type = "SEARCH_SLOW_LOGS" }, ] node_to_node_encryption = { enabled = true } software_update_options = { auto_software_update_enabled = true } vpc_options = { subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"] } # VPC endpoint vpc_endpoints = { one = { subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"] } } # Access policy access_policy_statements = [ { effect = "Allow" principals = [{ type = "*" identifiers = ["*"] }] actions = ["es:*"] conditions = [{ test = "IpAddress" variable = "aws:SourceIp" values = ["127.0.0.1/32"] }] } ] tags = { Terraform = "true" Environment = "dev" } } ``` ## Examples Examples codified under the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you! - [Complete](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/complete) - [Serverless](https://github.com/terraform-aws-modules/terraform-aws-opensearch/tree/master/examples/collection) ## Requirements | Name | Version | | ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.5.7 | | [aws](#requirement\_aws) | >= 6.41 | ## Providers | Name | Version | | ---- | ------- | | [aws](#provider\_aws) | >= 6.41 | ## Modules No modules. ## Resources | Name | Type | | ---- | ---- | | [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | | [aws_cloudwatch_log_resource_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_resource_policy) | resource | | [aws_opensearch_domain.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain) | resource | | [aws_opensearch_domain_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain_policy) | resource | | [aws_opensearch_domain_saml_options.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain_saml_options) | resource | | [aws_opensearch_outbound_connection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_outbound_connection) | resource | | [aws_opensearch_package_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_package_association) | resource | | [aws_opensearch_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_vpc_endpoint) | resource | | [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | | [aws_vpc_security_group_egress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource | | [aws_vpc_security_group_ingress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_iam_policy_document.cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_session_context.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_session_context) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | | [aws_subnet.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source | ## Inputs | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [access\_policies](#input\_access\_policies) | IAM policy document specifying the access policies for the domain. Required if `create_access_policy` is `false` | `string` | `null` | no | | [access\_policy\_override\_policy\_documents](#input\_access\_policy\_override\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no | | [access\_policy\_source\_policy\_documents](#input\_access\_policy\_source\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s | `list(string)` | `[]` | no | | [access\_policy\_statements](#input\_access\_policy\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `any` | `{}` | no | | [advanced\_options](#input\_advanced\_options) | Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your Elasticsearch domain on every apply | `map(string)` | `{}` | no | | [advanced\_security\_options](#input\_advanced\_security\_options) | Configuration block for [fine-grained access control](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html) | `any` |

{
  "anonymous_auth_enabled": false,
  "enabled": true
}

| no | | [aiml\_options](#input\_aiml\_options) | Configuration block for AI/ML options including Natural Language Query Generation, S3 Vectors, and Serverless Vector Acceleration |

object({
    natural_language_query_generation_options = optional(object({
      desired_state = optional(string)
    }))
    s3_vectors_engine = optional(object({
      enabled = optional(bool)
    }))
    serverless_vector_acceleration = optional(object({
      enabled = optional(bool)
    }))
  })

{
  "desired_state": "ENABLED",
  "rollback_on_disable": "NO_ROLLBACK"
}

| no | | [cloudwatch\_log\_group\_class](#input\_cloudwatch\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `null` | no | | [cloudwatch\_log\_group\_kms\_key\_id](#input\_cloudwatch\_log\_group\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `null` | no | | [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Number of days to retain log events | `number` | `60` | no | | [cloudwatch\_log\_group\_skip\_destroy](#input\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `null` | no | | [cloudwatch\_log\_resource\_policy\_name](#input\_cloudwatch\_log\_resource\_policy\_name) | Name of the resource policy for OpenSearch to log to CloudWatch | `string` | `null` | no | | [cluster\_config](#input\_cluster\_config) | Configuration block for the cluster of the domain | `any` |

{
  "dedicated_master_enabled": true
}

| no | | [cognito\_options](#input\_cognito\_options) | Configuration block for authenticating Kibana with Cognito | `any` | `{}` | no | | [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no | | [create\_access\_policy](#input\_create\_access\_policy) | Determines whether an access policy will be created | `bool` | `true` | no | | [create\_cloudwatch\_log\_groups](#input\_create\_cloudwatch\_log\_groups) | Determines whether log groups are created | `bool` | `true` | no | | [create\_cloudwatch\_log\_resource\_policy](#input\_create\_cloudwatch\_log\_resource\_policy) | Determines whether a resource policy will be created for OpenSearch to log to CloudWatch | `bool` | `true` | no | | [create\_saml\_options](#input\_create\_saml\_options) | Determines whether SAML options will be created | `bool` | `false` | no | | [create\_security\_group](#input\_create\_security\_group) | Determines if a security group is created | `bool` | `true` | no | | [deployment\_strategy\_options](#input\_deployment\_strategy\_options) | Configuration block for deployment strategy options |

object({
    deployment_strategy = string
  })

{
  "enforce_https": true,
  "tls_security_policy": "Policy-Min-TLS-1-2-2019-07"
}

| no | | [domain\_name](#input\_domain\_name) | Name of the domain | `string` | `""` | no | | [ebs\_options](#input\_ebs\_options) | Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/elasticsearch-service/pricing/) | `any` |

{
  "ebs_enabled": true,
  "volume_size": 64,
  "volume_type": "gp3"
}

{
  "enabled": true
}

object({
    enabled_api_access           = optional(bool)
    identity_center_instance_arn = optional(string)
    roles_key                    = optional(string)
    subject_key                  = optional(string)
  })

[
  {
    "log_type": "INDEX_SLOW_LOGS"
  },
  {
    "log_type": "SEARCH_SLOW_LOGS"
  }
]

| no | | [node\_to\_node\_encryption](#input\_node\_to\_node\_encryption) | Configuration block for node-to-node encryption options | `any` |

{
  "enabled": true
}

| no | | [off\_peak\_window\_options](#input\_off\_peak\_window\_options) | Configuration to add Off Peak update options | `any` |

{
  "enabled": true,
  "off_peak_window": {
    "hours": 7
  }
}

| no | | [outbound\_connections](#input\_outbound\_connections) | Map of AWS OpenSearch outbound connections to create | `any` | `{}` | no | | [package\_associations](#input\_package\_associations) | Map of package association IDs to associate with the domain | `map(string)` | `{}` | no | | [region](#input\_region) | Region where this resource will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no | | [saml\_options](#input\_saml\_options) | SAML authentication options for an AWS OpenSearch Domain | `any` | `{}` | no | | [security\_group\_description](#input\_security\_group\_description) | Description of the security group created | `string` | `null` | no | | [security\_group\_name](#input\_security\_group\_name) | Name to use on security group created | `string` | `null` | no | | [security\_group\_rules](#input\_security\_group\_rules) | Security group ingress and egress rules to add to the security group created | `any` | `{}` | no | | [security\_group\_tags](#input\_security\_group\_tags) | A map of additional tags to add to the security group created | `map(string)` | `{}` | no | | [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix) | Determines whether the security group name (`security_group_name`) is used as a prefix | `bool` | `true` | no | | [software\_update\_options](#input\_software\_update\_options) | Software update options for the domain | `any` |

{
  "auto_software_update_enabled": true
}

| no | | [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no | | [timeouts](#input\_timeouts) | Create and delete timeout configurations for the domain | `map(string)` | `{}` | no | | [vpc\_endpoints](#input\_vpc\_endpoints) | Map of VPC endpoints to create for the domain | `any` | `{}` | no | | [vpc\_options](#input\_vpc\_options) | Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-vpc-limitations)) | `any` | `{}` | no | ## Outputs | Name | Description | | ---- | ----------- | | [cloudwatch\_logs](#output\_cloudwatch\_logs) | Map of CloudWatch log groups created and their attributes | | [domain\_arn](#output\_domain\_arn) | The Amazon Resource Name (ARN) of the domain | | [domain\_dashboard\_endpoint](#output\_domain\_dashboard\_endpoint) | Domain-specific endpoint for Dashboard without https scheme | | [domain\_dashboard\_endpoint\_v2](#output\_domain\_dashboard\_endpoint\_v2) | V2 domain endpoint for Dashboard that works with both IPv4 and IPv6 addresses, without https scheme | | [domain\_endpoint](#output\_domain\_endpoint) | Domain-specific endpoint used to submit index, search, and data upload requests | | [domain\_endpoint\_v2](#output\_domain\_endpoint\_v2) | V2 domain endpoint that works with both IPv4 and IPv6 addresses, used to submit index, search, and data upload requests | | [domain\_endpoint\_v2\_hosted\_zone\_id](#output\_domain\_endpoint\_v2\_hosted\_zone\_id) | Dual stack hosted zone ID for the domain. | | [domain\_id](#output\_domain\_id) | The unique identifier for the domain | | [domain\_name](#output\_domain\_name) | The name of the domain | | [outbound\_connections](#output\_outbound\_connections) | Map of outbound connections created and their attributes | | [package\_associations](#output\_package\_associations) | Map of package associations created and their attributes | | [security\_group\_arn](#output\_security\_group\_arn) | Amazon Resource Name (ARN) of the security group | | [security\_group\_id](#output\_security\_group\_id) | ID of the security group | | [vpc\_endpoints](#output\_vpc\_endpoints) | Map of VPC endpoints created and their attributes | ## License Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-opensearch/blob/master/LICENSE).

AWS OpenSearch Terraform module

Terraform Module Source