{"id":40856718,"url":"https://github.com/element84/terraform-aws-stac-server","last_synced_at":"2026-01-28T01:14:48.281Z","repository":{"id":319880992,"uuid":"1079844093","full_name":"Element84/terraform-aws-stac-server","owner":"Element84","description":"stac-server Terraform module for AWS","archived":false,"fork":false,"pushed_at":"2026-01-20T22:27:20.000Z","size":36692,"stargazers_count":0,"open_issues_count":9,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-21T07:15:07.832Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Element84.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-20T13:25:30.000Z","updated_at":"2026-01-05T20:18:20.000Z","dependencies_parsed_at":null,"dependency_job_id":"1c32c80a-7eb2-4cea-9794-321ce83614dc","html_url":"https://github.com/Element84/terraform-aws-stac-server","commit_stats":null,"previous_names":["element84/terraform-aws-stac-server"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/Element84/terraform-aws-stac-server","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Element84%2Fterraform-aws-stac-server","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Element84%2Fterraform-aws-stac-server/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Element84%2Fterraform-aws-stac-server/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Element84%2Fterraform-aws-stac-server/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Element84","download_url":"https://codeload.github.com/Element84/terraform-aws-stac-server/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Element84%2Fterraform-aws-stac-server/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28647470,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-21T21:29:11.980Z","status":"ssl_error","status_checked_at":"2026-01-21T21:24:31.872Z","response_time":86,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-22T00:00:29.903Z","updated_at":"2026-01-28T01:14:48.273Z","avatar_url":"https://github.com/Element84.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# stac-server Terraform on AWS\n\nAn opinionated way of deploying [stac-server](https://github.com/stac-utils/stac-server) on AWS via Terraform. Commonly used in the [FilmDrop Ecosystem](https://github.com/Element84/filmdrop-aws-tf-modules), a suite of open source tools for ingesting, archiving, processing, analyzing and distributing geospatial data in the cloud.\n\n**stac-server Version**\n\nA default version of stac-server is packaged with this module. See the default value of `stac_server_version` in `inputs.tf` for the currently packaged version, and note that it can be overridden. Use caution when overriding the default version; we cannot guarantee the infrastructure deployed by this module will support versions of stac-server that it has not been tested with.\n\n\u003c!-- yes, newline required after \u003cdiv\u003e to separate html --\u003e\n\u003cdiv align=\"center\"\u003e\n\n[![CI](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/ci.yml/badge.svg)](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/ci.yml)\n[![Release Tests](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/release-tests.yml/badge.svg)](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/release-tests.yml)\n[![Snyk Scan](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/snyk-scan.yml/badge.svg)](https://github.com/Element84/terraform-aws-stac-server/actions/workflows/snyk-scan.yml)\n[![GitHub Release](https://img.shields.io/github/v/release/Element84/terraform-aws-stac-server?color=2334D058)]()  [![License](https://img.shields.io/github/license/Element84/terraform-aws-stac-server?color=2334D058)]()\n\n\u003c/div\u003e\n\n\n## General Usage\n\nWhile this module is most commonly used in conjunction with a FilmDrop deployment, it can be deployed as a standalone STAC server. Prerequisites:\n\n- A VPC in an AWS account which contains at least one private subnet\n\n**Quickstart**\n\n- Clone this repository\n- Authenticate to the AWS account you're deploying to\n- Install [tfenv](https://github.com/tfutils/tfenv), then use it to install Terraform: `tfenv install` \n  - This will install the specific Terraform version denoted in `.terraform-version`, which has been explicitly tested with this module. As an alternative to using tfenv, simply install that version of Terraform directly\n- Optionally point to a remote Terraform state store, rather than storing state locally. See [/utils/cicd](./utils/cicd) for an S3 example\n- Initialize Terraform: `terraform init`\n- Edit `default.tfvars`, noting that some var values are invalid placeholders which must be updated\n- You're now ready to validate/plan/apply, e.g. `terraform apply -var-file=default.tfvars`\n\n**Example Usages:**\n\n- [/utils/cicd](./utils/cicd) in this repository provides an example used by our CI/CD tests\n\n- [filmdrop-aws-tf-modules](https://github.com/Element84/filmdrop-aws-tf-modules) is a complete working example usage in the core FilmDrop module\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.13.0 |\n| \u003ca name=\"requirement_archive\"\u003e\u003c/a\u003e [archive](#requirement\\_archive) | ~\u003e 2.4 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 6.0 |\n| \u003ca name=\"requirement_null\"\u003e\u003c/a\u003e [null](#requirement\\_null) | ~\u003e 3.2 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | ~\u003e 3.5 |\n\n## Modules\n\nNo modules.\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_additional_ingest_sqs_senders_arns\"\u003e\u003c/a\u003e [additional\\_ingest\\_sqs\\_senders\\_arns](#input\\_additional\\_ingest\\_sqs\\_senders\\_arns) | List of additional principals to grant access to send to the Ingest SQS. This is required to allow STAC API SNS notifications (e.g. earth search's ingest SNS topic) to be able to publish SQS ingest messages to our stac-server for indexing. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_allow_explicit_index\"\u003e\u003c/a\u003e [allow\\_explicit\\_index](#input\\_allow\\_explicit\\_index) | Allow OpenSearch Explicit Index | `string` | `\"true\"` | no |\n| \u003ca name=\"input_api_lambda\"\u003e\u003c/a\u003e [api\\_lambda](#input\\_api\\_lambda) | (optional, object) Parameters for the stac-server API Lambda function.\u003cbr/\u003e  - zip\\_filepath: (optional, string) Filepath to a ZIP that implements the\u003cbr/\u003e    stac-server API Lambda. Path is relative to the root module of this\u003cbr/\u003e    deployment. Overrides the default ZIP included with this module.\u003cbr/\u003e  - runtime: (optional, string) Lambda runtime.\u003cbr/\u003e  - handler: (optional, string) Lambda handler.\u003cbr/\u003e  - memory\\_mb: (optional, number) Lambda max memory (MB).\u003cbr/\u003e  - timeout\\_seconds (optional, number) Lambda timeout (seconds).\u003cbr/\u003e  - environment\\_variables: (optional, map(string)) Custom environment variables\u003cbr/\u003e    to add to the Lambda. These will be merged with the default environment\u003cbr/\u003e    variables. Custom variables with the same key will override defaults. | \u003cpre\u003eobject({\u003cbr/\u003e    zip_filepath          = optional(string)\u003cbr/\u003e    runtime               = optional(string, \"nodejs22.x\")\u003cbr/\u003e    handler               = optional(string, \"index.handler\")\u003cbr/\u003e    memory_mb             = optional(number, 1024)\u003cbr/\u003e    timeout_seconds       = optional(number, 30)\u003cbr/\u003e    environment_variables = optional(map(string), {})\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"environment_variables\": {},\u003cbr/\u003e  \"handler\": \"index.handler\",\u003cbr/\u003e  \"memory_mb\": 1024,\u003cbr/\u003e  \"runtime\": \"nodejs22.x\",\u003cbr/\u003e  \"timeout_seconds\": 30,\u003cbr/\u003e  \"zip_filepath\": null\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_api_method_authorization_type\"\u003e\u003c/a\u003e [api\\_method\\_authorization\\_type](#input\\_api\\_method\\_authorization\\_type) | STAC API Gateway method authorization type | `string` | `\"NONE\"` | no |\n| \u003ca name=\"input_api_rest_type\"\u003e\u003c/a\u003e [api\\_rest\\_type](#input\\_api\\_rest\\_type) | STAC API Gateway type | `string` | `\"EDGE\"` | no |\n| \u003ca name=\"input_asset_proxy_bucket_list\"\u003e\u003c/a\u003e [asset\\_proxy\\_bucket\\_list](#input\\_asset\\_proxy\\_bucket\\_list) | Comma-separated list of S3 bucket names to proxy. Required when `ASSET_PROXY_BUCKET_OPTION` is `LIST`.\u003cbr/\u003e\u003cbr/\u003eExample: 'bucket1,bucket2,bucket3' | `string` | `\"\"` | no |\n| \u003ca name=\"input_asset_proxy_bucket_option\"\u003e\u003c/a\u003e [asset\\_proxy\\_bucket\\_option](#input\\_asset\\_proxy\\_bucket\\_option) | Control which S3 buckets are proxied through the API. See stac-server utils documentation for details.\u003cbr/\u003e\u003cbr/\u003eOptions: `NONE` (disabled), `ALL` (all S3 assets), `ALL_BUCKETS_IN_ACCOUNT` (all buckets in AWS account), `LIST` (specific buckets only). | `string` | `\"NONE\"` | no |\n| \u003ca name=\"input_asset_proxy_url_expiry\"\u003e\u003c/a\u003e [asset\\_proxy\\_url\\_expiry](#input\\_asset\\_proxy\\_url\\_expiry) | Pre-signed URL expiry time in seconds for proxied assets. | `number` | `300` | no |\n| \u003ca name=\"input_authorized_s3_arns\"\u003e\u003c/a\u003e [authorized\\_s3\\_arns](#input\\_authorized\\_s3\\_arns) | List of S3 bucket ARNs to give GetObject permissions to | `list(string)` | `[]` | no |\n| \u003ca name=\"input_collection_to_index_mappings\"\u003e\u003c/a\u003e [collection\\_to\\_index\\_mappings](#input\\_collection\\_to\\_index\\_mappings) | A JSON object representing collection id to index name mappings if they do not have the same names | `string` | `\"\"` | no |\n| \u003ca name=\"input_cors_credentials\"\u003e\u003c/a\u003e [cors\\_credentials](#input\\_cors\\_credentials) | n/a | `bool` | `false` | no |\n| \u003ca name=\"input_cors_headers\"\u003e\u003c/a\u003e [cors\\_headers](#input\\_cors\\_headers) | n/a | `string` | `\"\"` | no |\n| \u003ca name=\"input_cors_methods\"\u003e\u003c/a\u003e [cors\\_methods](#input\\_cors\\_methods) | n/a | `string` | `\"\"` | no |\n| \u003ca name=\"input_cors_origin\"\u003e\u003c/a\u003e [cors\\_origin](#input\\_cors\\_origin) | n/a | `string` | `\"*\"` | no |\n| \u003ca name=\"input_custom_vpce_id\"\u003e\u003c/a\u003e [custom\\_vpce\\_id](#input\\_custom\\_vpce\\_id) | If you are managing a VPC Endpoint for API Gateways outside of this module, provide the VPC Endpoint ID here. \u003cbr/\u003eThis will prevent the module from creating a VPC Endpoint, and will use the provided one instead for\u003cbr/\u003econfiguring access to the private STAC Server API Gateway. If you have multiple API Gateways which need to\u003cbr/\u003ecommunicate with VPC resources, they can share a central VPC Endpoint rather than creating one per API Gateway.\u003cbr/\u003e\u003cbr/\u003eShould be used in conjunction with api\\_rest\\_type = \"PRIVATE\" | `string` | `null` | no |\n| \u003ca name=\"input_deploy_local_stac_server_artifacts\"\u003e\u003c/a\u003e [deploy\\_local\\_stac\\_server\\_artifacts](#input\\_deploy\\_local\\_stac\\_server\\_artifacts) | Deploy STAC Server artifacts for local deploy | `bool` | `false` | no |\n| \u003ca name=\"input_deploy_stac_server_opensearch_serverless\"\u003e\u003c/a\u003e [deploy\\_stac\\_server\\_opensearch\\_serverless](#input\\_deploy\\_stac\\_server\\_opensearch\\_serverless) | Deploy FilmDrop Stac-Server with OpenSearch Serverless. If False, Stac-server will be deployed with a classic OpenSearch domain. | `bool` | `false` | no |\n| \u003ca name=\"input_deploy_stac_server_outside_vpc\"\u003e\u003c/a\u003e [deploy\\_stac\\_server\\_outside\\_vpc](#input\\_deploy\\_stac\\_server\\_outside\\_vpc) | Deploy FilmDrop Stac-Server resources, including OpenSearch outside VPC. Defaults to false. If False, Stac-server resources will be deployed within the vpc. | `bool` | `false` | no |\n| \u003ca name=\"input_domain_alias\"\u003e\u003c/a\u003e [domain\\_alias](#input\\_domain\\_alias) | Custom domain alias for private API Gateway endpoint | `string` | `\"\"` | no |\n| \u003ca name=\"input_enable_collections_authx\"\u003e\u003c/a\u003e [enable\\_collections\\_authx](#input\\_enable\\_collections\\_authx) | Enable Collections Authx | `bool` | `false` | no |\n| \u003ca name=\"input_enable_filter_authx\"\u003e\u003c/a\u003e [enable\\_filter\\_authx](#input\\_enable\\_filter\\_authx) | Enable Filter Authx | `bool` | `false` | no |\n| \u003ca name=\"input_enable_ingest_action_truncate\"\u003e\u003c/a\u003e [enable\\_ingest\\_action\\_truncate](#input\\_enable\\_ingest\\_action\\_truncate) | Enable Ingest Action Truncate | `string` | `false` | no |\n| \u003ca name=\"input_enable_response_compression\"\u003e\u003c/a\u003e [enable\\_response\\_compression](#input\\_enable\\_response\\_compression) | Enable Response Compression | `bool` | `false` | no |\n| \u003ca name=\"input_enable_transactions_extension\"\u003e\u003c/a\u003e [enable\\_transactions\\_extension](#input\\_enable\\_transactions\\_extension) | Enable Transactions Extension | `bool` | `false` | no |\n| \u003ca name=\"input_ingest_lambda\"\u003e\u003c/a\u003e [ingest\\_lambda](#input\\_ingest\\_lambda) | (optional, object) Parameters for the stac-server ingest Lambda function.\u003cbr/\u003e  - zip\\_filepath: (optional, string) Filepath to a ZIP that implements the\u003cbr/\u003e    stac-server ingest Lambda. Path is relative to the root module of this\u003cbr/\u003e    deployment. Overrides the default ZIP included with this module.\u003cbr/\u003e  - runtime: (optional, string) Lambda runtime.\u003cbr/\u003e  - handler: (optional, string) Lambda handler.\u003cbr/\u003e  - memory\\_mb: (optional, number) Lambda max memory (MB).\u003cbr/\u003e  - timeout\\_seconds (optional, number) Lambda timeout (seconds).\u003cbr/\u003e  - environment\\_variables: (optional, map(string)) Custom environment variables\u003cbr/\u003e    to add to the Lambda. These will be merged with the default environment\u003cbr/\u003e    variables. Custom variables with the same key will override defaults. | \u003cpre\u003eobject({\u003cbr/\u003e    zip_filepath          = optional(string)\u003cbr/\u003e    runtime               = optional(string, \"nodejs22.x\")\u003cbr/\u003e    handler               = optional(string, \"index.handler\")\u003cbr/\u003e    memory_mb             = optional(number, 512)\u003cbr/\u003e    timeout_seconds       = optional(number, 60)\u003cbr/\u003e    environment_variables = optional(map(string), {})\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"environment_variables\": {},\u003cbr/\u003e  \"handler\": \"index.handler\",\u003cbr/\u003e  \"memory_mb\": 512,\u003cbr/\u003e  \"runtime\": \"nodejs22.x\",\u003cbr/\u003e  \"timeout_seconds\": 60,\u003cbr/\u003e  \"zip_filepath\": null\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_ingest_sns_topic_arns\"\u003e\u003c/a\u003e [ingest\\_sns\\_topic\\_arns](#input\\_ingest\\_sns\\_topic\\_arns) | List of additional Ingest SNS topic arns to subscribe to stac server | `list(string)` | `[]` | no |\n| \u003ca name=\"input_ingest_sqs_dlq_timeout\"\u003e\u003c/a\u003e [ingest\\_sqs\\_dlq\\_timeout](#input\\_ingest\\_sqs\\_dlq\\_timeout) | STAC Ingest SQS Dead Letter Queue Visibility Timeout | `number` | `30` | no |\n| \u003ca name=\"input_ingest_sqs_max_receive_count\"\u003e\u003c/a\u003e [ingest\\_sqs\\_max\\_receive\\_count](#input\\_ingest\\_sqs\\_max\\_receive\\_count) | STAC Ingest SQS Max Receive Count | `number` | `2` | no |\n| \u003ca name=\"input_ingest_sqs_receive_wait_time_seconds\"\u003e\u003c/a\u003e [ingest\\_sqs\\_receive\\_wait\\_time\\_seconds](#input\\_ingest\\_sqs\\_receive\\_wait\\_time\\_seconds) | STAC Ingest Receive Wait time | `number` | `5` | no |\n| \u003ca name=\"input_ingest_sqs_timeout\"\u003e\u003c/a\u003e [ingest\\_sqs\\_timeout](#input\\_ingest\\_sqs\\_timeout) | STAC Ingest SQS Visibility Timeout | `number` | `120` | no |\n| \u003ca name=\"input_items_max_limit\"\u003e\u003c/a\u003e [items\\_max\\_limit](#input\\_items\\_max\\_limit) | Items Max Limit | `number` | `100` | no |\n| \u003ca name=\"input_log_level\"\u003e\u003c/a\u003e [log\\_level](#input\\_log\\_level) | Logging level (error, warn, info, http, verbose, debug, silly) | `string` | `\"warn\"` | no |\n| \u003ca name=\"input_opensearch_admin_username\"\u003e\u003c/a\u003e [opensearch\\_admin\\_username](#input\\_opensearch\\_admin\\_username) | OpenSearch admin username | `string` | `\"admin\"` | no |\n| \u003ca name=\"input_opensearch_advanced_security_options_enabled\"\u003e\u003c/a\u003e [opensearch\\_advanced\\_security\\_options\\_enabled](#input\\_opensearch\\_advanced\\_security\\_options\\_enabled) | OpenSearch advanced security options enabled | `bool` | `true` | no |\n| \u003ca name=\"input_opensearch_cluster_availability_zone_count\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_availability\\_zone\\_count](#input\\_opensearch\\_cluster\\_availability\\_zone\\_count) | The number of Availability Zones to deploy the OpenSearch cluster across.\u003cbr/\u003e\u003cbr/\u003eConstraints:\u003cbr/\u003e- Valid values are 2 or 3.\u003cbr/\u003e- Only used and enforced when opensearch\\_cluster\\_zone\\_awareness\\_enabled is true.\u003cbr/\u003e- You must provide at least this many subnets in vpc\\_subnet\\_ids. | `number` | `3` | no |\n| \u003ca name=\"input_opensearch_cluster_dedicated_master_count\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_dedicated\\_master\\_count](#input\\_opensearch\\_cluster\\_dedicated\\_master\\_count) | Number of dedicated main nodes in the cluster. | `number` | `3` | no |\n| \u003ca name=\"input_opensearch_cluster_dedicated_master_enabled\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_dedicated\\_master\\_enabled](#input\\_opensearch\\_cluster\\_dedicated\\_master\\_enabled) | OpenSearch Domain dedicated master | `bool` | `false` | no |\n| \u003ca name=\"input_opensearch_cluster_dedicated_master_type\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_dedicated\\_master\\_type](#input\\_opensearch\\_cluster\\_dedicated\\_master\\_type) | OpenSearch Domain dedicated master instance type | `string` | `\"m6g.large.search\"` | no |\n| \u003ca name=\"input_opensearch_cluster_instance_count\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_instance\\_count](#input\\_opensearch\\_cluster\\_instance\\_count) | The number of data nodes to provision in the OpenSearch cluster.\u003cbr/\u003e\u003cbr/\u003eConstraints:\u003cbr/\u003e- If zone\\_awareness\\_enabled is false: Allowed values are integer \u003e= 1.\u003cbr/\u003e- If zone\\_awareness\\_enabled is true and availability\\_zone\\_count is 2: Must be an even number \u003e= 2.\u003cbr/\u003e- If zone\\_awareness\\_enabled is true and availability\\_zone\\_count is 3: Must be a multiple of 3 \u003e= 3. | `number` | `3` | no |\n| \u003ca name=\"input_opensearch_cluster_instance_type\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_instance\\_type](#input\\_opensearch\\_cluster\\_instance\\_type) | OpenSearch Domain instance type. \u003cbr/\u003eExamples: \u003cbr/\u003e- t3.small.search (entry level, development)\u003cbr/\u003e- m6g.large.search (general purpose)\u003cbr/\u003e- or2.medium.search (opensearch optimized)\u003cbr/\u003e\u003cbr/\u003eSee AWS documentation for full list of supported instance types per region and engine version. | `string` | `\"c6g.large.search\"` | no |\n| \u003ca name=\"input_opensearch_cluster_zone_awareness_enabled\"\u003e\u003c/a\u003e [opensearch\\_cluster\\_zone\\_awareness\\_enabled](#input\\_opensearch\\_cluster\\_zone\\_awareness\\_enabled) | Enable Zone Awareness to distribute instances across multiple Availability Zones.\u003cbr/\u003e\u003cbr/\u003eConfiguration Rules:\u003cbr/\u003e- If true: \u003cbr/\u003e  - You must set opensearch\\_cluster\\_instance\\_count \u003e= 2.\u003cbr/\u003e  - You must provided enough subnets in vpc\\_subnet\\_ids (at least availability\\_zone\\_count).\u003cbr/\u003e- If false: \u003cbr/\u003e  - You can set opensearch\\_cluster\\_instance\\_count to 1 or more.\u003cbr/\u003e  - All instances will be placed in the first subnet provided in vpc\\_subnet\\_ids. | `bool` | `true` | no |\n| \u003ca name=\"input_opensearch_domain_enforce_https\"\u003e\u003c/a\u003e [opensearch\\_domain\\_enforce\\_https](#input\\_opensearch\\_domain\\_enforce\\_https) | OpenSearch Domain enforce https | `bool` | `true` | no |\n| \u003ca name=\"input_opensearch_domain_min_tls\"\u003e\u003c/a\u003e [opensearch\\_domain\\_min\\_tls](#input\\_opensearch\\_domain\\_min\\_tls) | OpenSearch Domain minimum TLS | `string` | `\"Policy-Min-TLS-1-2-2019-07\"` | no |\n| \u003ca name=\"input_opensearch_ebs_volume_size\"\u003e\u003c/a\u003e [opensearch\\_ebs\\_volume\\_size](#input\\_opensearch\\_ebs\\_volume\\_size) | OpenSearch EBS volume size | `number` | `35` | no |\n| \u003ca name=\"input_opensearch_ebs_volume_type\"\u003e\u003c/a\u003e [opensearch\\_ebs\\_volume\\_type](#input\\_opensearch\\_ebs\\_volume\\_type) | OpenSearch EBS volume type | `string` | `\"gp3\"` | no |\n| \u003ca name=\"input_opensearch_host\"\u003e\u003c/a\u003e [opensearch\\_host](#input\\_opensearch\\_host) | OpenSearch Host | `string` | `\"\"` | no |\n| \u003ca name=\"input_opensearch_internal_user_database_enabled\"\u003e\u003c/a\u003e [opensearch\\_internal\\_user\\_database\\_enabled](#input\\_opensearch\\_internal\\_user\\_database\\_enabled) | OpenSearch internal user database enabled | `bool` | `true` | no |\n| \u003ca name=\"input_opensearch_logs\"\u003e\u003c/a\u003e [opensearch\\_logs](#input\\_opensearch\\_logs) | Configuration for OpenSearch log publishing to CloudWatch.\u003cbr/\u003eThis entire variable is optional. If not provided, no logs will be published.\u003cbr/\u003e\u003cbr/\u003eNOTE: This variable only applies to the managed (provisioned) OpenSearch service. \u003cbr/\u003eIt is NOT supported when `deploy_stac_server_opensearch_serverless` is set to `true`.\u003cbr/\u003e\u003cbr/\u003eYou can configure any combination of the following log types (all are optional):\u003cbr/\u003e- `ES_APPLICATION_LOGS`: OpenSearch application logs (error, warn, info).\u003cbr/\u003e- `INDEX_SLOW_LOGS`: Logs for slow indexing operations.\u003cbr/\u003e- `SEARCH_SLOW_LOGS`: Logs for slow search queries.\u003cbr/\u003e- `AUDIT_LOGS`: Logs for access and security audits. Tracks user activity and access to the domain.\u003cbr/\u003e  Warning: Audit logs can be extremely verbose and may result in significant CloudWatch Log ingestion and storage costs. | \u003cpre\u003eobject({\u003cbr/\u003e    ES_APPLICATION_LOGS = optional(object({\u003cbr/\u003e      enabled                     = bool\u003cbr/\u003e      retention_in_days           = number\u003cbr/\u003e      deletion_protection_enabled = optional(bool, false)\u003cbr/\u003e    }))\u003cbr/\u003e    INDEX_SLOW_LOGS = optional(object({\u003cbr/\u003e      enabled                     = bool\u003cbr/\u003e      retention_in_days           = number\u003cbr/\u003e      deletion_protection_enabled = optional(bool, false)\u003cbr/\u003e    }))\u003cbr/\u003e    SEARCH_SLOW_LOGS = optional(object({\u003cbr/\u003e      enabled                     = bool\u003cbr/\u003e      retention_in_days           = number\u003cbr/\u003e      deletion_protection_enabled = optional(bool, false)\u003cbr/\u003e    }))\u003cbr/\u003e    AUDIT_LOGS = optional(object({\u003cbr/\u003e      enabled                     = bool\u003cbr/\u003e      retention_in_days           = number\u003cbr/\u003e      deletion_protection_enabled = bool # required property; audit logs are usually very important\u003cbr/\u003e    }))\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_opensearch_override_main_response_version\"\u003e\u003c/a\u003e [opensearch\\_override\\_main\\_response\\_version](#input\\_opensearch\\_override\\_main\\_response\\_version) | Newer versions of Elasticsearch forcefully set this, even if it's not defined here in which case Terraform will try to\u003cbr/\u003erevert it on every apply. This value does NOT actually change the setting in OpenSearch cluster. See the GitHub issue\u003cbr/\u003elinked below. This value is here to appease Terraform only. If Terraform is nagging you with perpetual changes to\u003cbr/\u003eoverride main response version, set this var to the value your cluster currently has or alternatively update your\u003cbr/\u003ecluster settings via AWS API to match the default null value set by this module \u003cbr/\u003ehttps://github.com/hashicorp/terraform-provider-aws/issues/27371\u003cbr/\u003ehttps://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpgradeDomain.html#opensearchservice-UpgradeDomain-request-AdvancedOptions | `string` | `null` | no |\n| \u003ca name=\"input_opensearch_stac_server_domain_name_override\"\u003e\u003c/a\u003e [opensearch\\_stac\\_server\\_domain\\_name\\_override](#input\\_opensearch\\_stac\\_server\\_domain\\_name\\_override) | This optionally overrides the OpenSearch server name.  Since this name can't change after the server has been created, it is provided so that any changes to the default name don't require tearing down the server on future TF updates. | `string` | `null` | no |\n| \u003ca name=\"input_opensearch_stac_server_username\"\u003e\u003c/a\u003e [opensearch\\_stac\\_server\\_username](#input\\_opensearch\\_stac\\_server\\_username) | OpenSearch stac server username | `string` | `\"stac_server\"` | no |\n| \u003ca name=\"input_opensearch_version\"\u003e\u003c/a\u003e [opensearch\\_version](#input\\_opensearch\\_version) | OpenSearch version for OpenSearch Domain | `string` | `\"OpenSearch_2.19\"` | no |\n| \u003ca name=\"input_pre_hook_lambda\"\u003e\u003c/a\u003e [pre\\_hook\\_lambda](#input\\_pre\\_hook\\_lambda) | (optional, object) Parameters for the stac-server pre-hook Lambda function.\u003cbr/\u003e  - zip\\_filepath: (optional, string) Filepath to a ZIP that implements the\u003cbr/\u003e    stac-server auth pre-hook Lambda. Path is relative to the root module of\u003cbr/\u003e    this deployment. Overrides the default ZIP included with this module.\u003cbr/\u003e  - runtime: (optional, string) Lambda runtime.\u003cbr/\u003e  - handler: (optional, string) Lambda handler.\u003cbr/\u003e  - memory\\_mb: (optional, number) Lambda max memory (MB).\u003cbr/\u003e  - timeout\\_seconds (optional, number) Lambda timeout (seconds).\u003cbr/\u003e  - environment\\_variables: (optional, map(string)) Custom environment variables\u003cbr/\u003e    to add to the Lambda. These will be merged with the default environment\u003cbr/\u003e    variables. Custom variables with the same key will override defaults. | \u003cpre\u003eobject({\u003cbr/\u003e    zip_filepath          = optional(string)\u003cbr/\u003e    runtime               = optional(string, \"nodejs22.x\")\u003cbr/\u003e    handler               = optional(string, \"index.handler\")\u003cbr/\u003e    memory_mb             = optional(number, 128)\u003cbr/\u003e    timeout_seconds       = optional(number, 25)\u003cbr/\u003e    environment_variables = optional(map(string), {})\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"environment_variables\": {},\u003cbr/\u003e  \"handler\": \"index.handler\",\u003cbr/\u003e  \"memory_mb\": 128,\u003cbr/\u003e  \"runtime\": \"nodejs22.x\",\u003cbr/\u003e  \"timeout_seconds\": 25,\u003cbr/\u003e  \"zip_filepath\": null\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_private_api_additional_security_group_ids\"\u003e\u003c/a\u003e [private\\_api\\_additional\\_security\\_group\\_ids](#input\\_private\\_api\\_additional\\_security\\_group\\_ids) | Optional list of security group IDs that'll be applied to the VPC interface\u003cbr/\u003eendpoints of a PRIVATE-type stac-server API Gateway. These security groups are\u003cbr/\u003ein addition to the security groups that allow traffic from the private subnet\u003cbr/\u003eCIDR blocks. Only applicable when `var.api_rest_type == PRIVATE`. | `list(string)` | `null` | no |\n| \u003ca name=\"input_private_certificate_arn\"\u003e\u003c/a\u003e [private\\_certificate\\_arn](#input\\_private\\_certificate\\_arn) | Private Certificate ARN for custom domain alias of private API Gateway endpoint | `string` | `\"\"` | no |\n| \u003ca name=\"input_project_name\"\u003e\u003c/a\u003e [project\\_name](#input\\_project\\_name) | Project Name | `string` | n/a | yes |\n| \u003ca name=\"input_request_logging_enabled\"\u003e\u003c/a\u003e [request\\_logging\\_enabled](#input\\_request\\_logging\\_enabled) | Log all requests to the server | `bool` | `true` | no |\n| \u003ca name=\"input_reserved_concurrent_executions\"\u003e\u003c/a\u003e [reserved\\_concurrent\\_executions](#input\\_reserved\\_concurrent\\_executions) | STAC ingest lambda reserved concurrent executions (max concurrency) | `number` | `10` | no |\n| \u003ca name=\"input_stac_api_provisioned_concurrency\"\u003e\u003c/a\u003e [stac\\_api\\_provisioned\\_concurrency](#input\\_stac\\_api\\_provisioned\\_concurrency) | Number of lambda instances to concurrently provision if desired for faster api response time and no cold start delay | `number` | `0` | no |\n| \u003ca name=\"input_stac_api_rootpath\"\u003e\u003c/a\u003e [stac\\_api\\_rootpath](#input\\_stac\\_api\\_rootpath) | If stac-server has a cloudfront distribution, this should be an empty string.\u003cbr/\u003eIf stac-server does not have a cloudfront distribution, the api\\_rest\\_type is\u003cbr/\u003ePRIVATE, and you're managing a custom API Gateway domain outside of this module,\u003cbr/\u003ethis should be an empty string.\u003cbr/\u003eIf neither is true, the stac\\_api\\_stage var should be used. | `string` | `\"\"` | no |\n| \u003ca name=\"input_stac_api_stage\"\u003e\u003c/a\u003e [stac\\_api\\_stage](#input\\_stac\\_api\\_stage) | STAC API stage | `string` | `\"dev\"` | no |\n| \u003ca name=\"input_stac_api_stage_description\"\u003e\u003c/a\u003e [stac\\_api\\_stage\\_description](#input\\_stac\\_api\\_stage\\_description) | STAC API stage description | `string` | `\"\"` | no |\n| \u003ca name=\"input_stac_api_url\"\u003e\u003c/a\u003e [stac\\_api\\_url](#input\\_stac\\_api\\_url) | When the STAC\\_API\\_URL env var is set, the item/message will have the self link set to the ingested items URL in the API; if not, the self link points to the copy of it in s3. | `string` | `\"\"` | no |\n| \u003ca name=\"input_stac_description\"\u003e\u003c/a\u003e [stac\\_description](#input\\_stac\\_description) | STAC description | `string` | `\"A STAC API using stac-server\"` | no |\n| \u003ca name=\"input_stac_docs_url\"\u003e\u003c/a\u003e [stac\\_docs\\_url](#input\\_stac\\_docs\\_url) | STAC Documentation URL | `string` | `\"https://stac-utils.github.io/stac-server/\"` | no |\n| \u003ca name=\"input_stac_id\"\u003e\u003c/a\u003e [stac\\_id](#input\\_stac\\_id) | STAC identifier | `string` | `\"stac-server\"` | no |\n| \u003ca name=\"input_stac_server_auth_pre_hook_enabled\"\u003e\u003c/a\u003e [stac\\_server\\_auth\\_pre\\_hook\\_enabled](#input\\_stac\\_server\\_auth\\_pre\\_hook\\_enabled) | STAC API Pre-Hook Auth Lambda Enabled | `bool` | `false` | no |\n| \u003ca name=\"input_stac_server_post_hook_lambda_arn\"\u003e\u003c/a\u003e [stac\\_server\\_post\\_hook\\_lambda\\_arn](#input\\_stac\\_server\\_post\\_hook\\_lambda\\_arn) | STAC API Post-Hook Lambda ARN | `string` | `\"\"` | no |\n| \u003ca name=\"input_stac_server_pre_hook_lambda_arn\"\u003e\u003c/a\u003e [stac\\_server\\_pre\\_hook\\_lambda\\_arn](#input\\_stac\\_server\\_pre\\_hook\\_lambda\\_arn) | STAC API Pre-Hook Lambda ARN | `string` | `\"\"` | no |\n| \u003ca name=\"input_stac_server_version\"\u003e\u003c/a\u003e [stac\\_server\\_version](#input\\_stac\\_server\\_version) | stac-server version. Leave this null to use the default, prepackaged version of stac-server.\u003cbr/\u003e\u003cbr/\u003eIf you need to use a custom version, set this variable to the desired version string *and* set\u003cbr/\u003edeploy\\_local\\_stac\\_server\\_artifacts = true. Note though that custom versions of stac-server are not\u003cbr/\u003eguaranteed to be compatible with this module. | `string` | `\"v4.5.0\"` | no |\n| \u003ca name=\"input_stac_title\"\u003e\u003c/a\u003e [stac\\_title](#input\\_stac\\_title) | STAC title | `string` | `\"STAC API\"` | no |\n| \u003ca name=\"input_vpc_cidr_range\"\u003e\u003c/a\u003e [vpc\\_cidr\\_range](#input\\_vpc\\_cidr\\_range) | CIDR Range for FilmDrop vpc | `string` | n/a | yes |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | FilmDrop VPC ID | `string` | n/a | yes |\n| \u003ca name=\"input_vpc_security_group_ids\"\u003e\u003c/a\u003e [vpc\\_security\\_group\\_ids](#input\\_vpc\\_security\\_group\\_ids) | List of security groups in the FilmDrop vpc | `list(string)` | n/a | yes |\n| \u003ca name=\"input_vpc_subnet_ids\"\u003e\u003c/a\u003e [vpc\\_subnet\\_ids](#input\\_vpc\\_subnet\\_ids) | List of subnet ids in the FilmDrop vpc | `list(string)` | n/a | yes |\n| \u003ca name=\"input_vpce_private_dns_enabled\"\u003e\u003c/a\u003e [vpce\\_private\\_dns\\_enabled](#input\\_vpce\\_private\\_dns\\_enabled) | Whether to enable Private DNS on the Interface VPC Endpoint used for the STAC API (execute-api). \u003cbr/\u003eLeave false if you rely on VPC endpoint-specific hostnames; set true to resolve the standard API Gateway \u003cbr/\u003ehostname to the VPC endpoint from within the VPC. | `bool` | `false` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_stac_server_api_domain_name\"\u003e\u003c/a\u003e [stac\\_server\\_api\\_domain\\_name](#output\\_stac\\_server\\_api\\_domain\\_name) | n/a |\n| \u003ca name=\"output_stac_server_api_gateway_id\"\u003e\u003c/a\u003e [stac\\_server\\_api\\_gateway\\_id](#output\\_stac\\_server\\_api\\_gateway\\_id) | n/a |\n| \u003ca name=\"output_stac_server_api_lambda_arn\"\u003e\u003c/a\u003e [stac\\_server\\_api\\_lambda\\_arn](#output\\_stac\\_server\\_api\\_lambda\\_arn) | n/a |\n| \u003ca name=\"output_stac_server_api_lambda_name\"\u003e\u003c/a\u003e [stac\\_server\\_api\\_lambda\\_name](#output\\_stac\\_server\\_api\\_lambda\\_name) | n/a |\n| \u003ca name=\"output_stac_server_api_path\"\u003e\u003c/a\u003e [stac\\_server\\_api\\_path](#output\\_stac\\_server\\_api\\_path) | n/a |\n| \u003ca name=\"output_stac_server_ingest_lambda_arn\"\u003e\u003c/a\u003e [stac\\_server\\_ingest\\_lambda\\_arn](#output\\_stac\\_server\\_ingest\\_lambda\\_arn) | n/a |\n| \u003ca name=\"output_stac_server_ingest_lambda_name\"\u003e\u003c/a\u003e [stac\\_server\\_ingest\\_lambda\\_name](#output\\_stac\\_server\\_ingest\\_lambda\\_name) | n/a |\n| \u003ca name=\"output_stac_server_ingest_queue_arn\"\u003e\u003c/a\u003e [stac\\_server\\_ingest\\_queue\\_arn](#output\\_stac\\_server\\_ingest\\_queue\\_arn) | n/a |\n| \u003ca name=\"output_stac_server_ingest_queue_url\"\u003e\u003c/a\u003e [stac\\_server\\_ingest\\_queue\\_url](#output\\_stac\\_server\\_ingest\\_queue\\_url) | n/a |\n| \u003ca name=\"output_stac_server_ingest_sns_topic_arn\"\u003e\u003c/a\u003e [stac\\_server\\_ingest\\_sns\\_topic\\_arn](#output\\_stac\\_server\\_ingest\\_sns\\_topic\\_arn) | n/a |\n| \u003ca name=\"output_stac_server_lambda_iam_role_arn\"\u003e\u003c/a\u003e [stac\\_server\\_lambda\\_iam\\_role\\_arn](#output\\_stac\\_server\\_lambda\\_iam\\_role\\_arn) | n/a |\n| \u003ca name=\"output_stac_server_name_prefix\"\u003e\u003c/a\u003e [stac\\_server\\_name\\_prefix](#output\\_stac\\_server\\_name\\_prefix) | n/a |\n| \u003ca name=\"output_stac_server_opensearch_domain\"\u003e\u003c/a\u003e [stac\\_server\\_opensearch\\_domain](#output\\_stac\\_server\\_opensearch\\_domain) | n/a |\n| \u003ca name=\"output_stac_server_opensearch_endpoint\"\u003e\u003c/a\u003e [stac\\_server\\_opensearch\\_endpoint](#output\\_stac\\_server\\_opensearch\\_endpoint) | n/a |\n| \u003ca name=\"output_stac_server_opensearch_name\"\u003e\u003c/a\u003e [stac\\_server\\_opensearch\\_name](#output\\_stac\\_server\\_opensearch\\_name) | n/a |\n| \u003ca name=\"output_stac_server_post_ingest_sns_topic_arn\"\u003e\u003c/a\u003e [stac\\_server\\_post\\_ingest\\_sns\\_topic\\_arn](#output\\_stac\\_server\\_post\\_ingest\\_sns\\_topic\\_arn) | n/a |\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felement84%2Fterraform-aws-stac-server","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felement84%2Fterraform-aws-stac-server","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felement84%2Fterraform-aws-stac-server/lists"}