{"id":19165339,"url":"https://github.com/skyscrapers/terraform-opensearch","last_synced_at":"2025-09-07T22:35:00.252Z","repository":{"id":45049086,"uuid":"116396304","full_name":"skyscrapers/terraform-opensearch","owner":"skyscrapers","description":"Terraform module to setup all resources needed for setting up an AWS Elasticsearch Service cluster.","archived":false,"fork":false,"pushed_at":"2024-08-07T08:08:03.000Z","size":15683,"stargazers_count":11,"open_issues_count":1,"forks_count":18,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-19T22:02:28.786Z","etag":null,"topics":["aws","aws-elasticsearch","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/skyscrapers.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-01-05T15:00:41.000Z","updated_at":"2024-10-04T05:38:17.000Z","dependencies_parsed_at":"2024-01-09T08:29:08.322Z","dependency_job_id":"4c1e5057-827a-4178-ae6c-2242c2e85ea5","html_url":"https://github.com/skyscrapers/terraform-opensearch","commit_stats":null,"previous_names":[],"tags_count":78,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skyscrapers%2Fterraform-opensearch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skyscrapers%2Fterraform-opensearch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skyscrapers%2Fterraform-opensearch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skyscrapers%2Fterraform-opensearch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/skyscrapers","download_url":"https://codeload.github.com/skyscrapers/terraform-opensearch/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252874809,"owners_count":21817910,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-elasticsearch","terraform","terraform-modules"],"created_at":"2024-11-09T09:27:28.901Z","updated_at":"2025-09-07T22:35:00.234Z","avatar_url":"https://github.com/skyscrapers.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-opensearch\n\n- [terraform-opensearch](#terraform-opensearch)\n  - [opensearch](#opensearch)\n    - [Requirements](#requirements)\n    - [Providers](#providers)\n    - [Modules](#modules)\n    - [Resources](#resources)\n    - [Inputs](#inputs)\n    - [Outputs](#outputs)\n    - [Example](#example)\n    - [Logging](#logging)\n    - [Monitoring](#monitoring)\n    - [NOTES](#notes)\n  - [opensearch-backup](#opensearch-backup)\n    - [Requirements](#requirements-1)\n    - [Providers](#providers-1)\n    - [Modules](#modules-1)\n    - [Resources](#resources-1)\n    - [Inputs](#inputs-1)\n    - [Outputs](#outputs-1)\n    - [Example](#example-1)\n  - [elasticsearch\\_k8s\\_monitoring](#elasticsearch_k8s_monitoring)\n    - [Requirements](#requirements-2)\n    - [Providers](#providers-2)\n    - [Modules](#modules-2)\n    - [Resources](#resources-2)\n    - [Inputs](#inputs-2)\n  - [Outputs](#outputs-2)\n  - [kibana\\_k8s\\_auth\\_proxy](#kibana_k8s_auth_proxy)\n    - [Inputs](#inputs-3)\n    - [Outputs](#outputs-3)\n  - [Upgrading](#upgrading)\n    - [Version 10.0.0 to 11.0.0](#version-1000-to-1100)\n    - [Version 9.1.4 to 10.0.0](#version-914-to-1000)\n    - [Version 8.0.0 to 8.2.0](#version-800-to-820)\n    - [Version 7.0.0 to 8.0.0](#version-700-to-800)\n    - [Version 6.0.0 to 7.0.0](#version-600-to-700)\n\n## opensearch\n\nTerraform module to setup all resources needed for setting up an AWS OpenSearch Service domain.\n\n### Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement_terraform) | \u003e= 1.3.9 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement_aws) | ~\u003e 6.0 |\n\n### Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider_aws) | ~\u003e 6.0 |\n\n### Modules\n\nNo modules.\n\n### Resources\n\n| Name | Type |\n|------|------|\n| [aws_cloudwatch_log_group.cwl_application](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_cloudwatch_log_group.cwl_index](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_cloudwatch_log_group.cwl_search](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_cloudwatch_log_resource_policy.cwl_resource_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_resource_policy) | resource |\n| [aws_elasticsearch_domain.es](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticsearch_domain) | resource |\n| [aws_security_group.sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [aws_iam_policy_document.cwl_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n| [aws_subnet.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_instance_type\"\u003e\u003c/a\u003e [instance_type](#input_instance_type) | Instance type to use for the OpenSearch domain | `string` | n/a | yes |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input_name) | Name to use for the OpenSearch domain | `string` | n/a | yes |\n| \u003ca name=\"input_volume_size\"\u003e\u003c/a\u003e [volume_size](#input_volume_size) | EBS volume size (in GB) to use for the OpenSearch domain | `number` | n/a | yes |\n| \u003ca name=\"input_application_logging_enabled\"\u003e\u003c/a\u003e [application_logging_enabled](#input_application_logging_enabled) | Whether to enable OpenSearch application logs (error) in Cloudwatch | `bool` | `false` | no |\n| \u003ca name=\"input_availability_zone_count\"\u003e\u003c/a\u003e [availability_zone_count](#input_availability_zone_count) | Number of Availability Zones for the domain to use with zone_awareness_enabled.Valid values: 2 or 3. Automatically configured through number of instances/subnets available if not set. | `number` | `null` | no |\n| \u003ca name=\"input_cognito_enabled\"\u003e\u003c/a\u003e [cognito_enabled](#input_cognito_enabled) | Whether to enable Cognito for authentication in Kibana | `bool` | `false` | no |\n| \u003ca name=\"input_cognito_identity_pool_id\"\u003e\u003c/a\u003e [cognito_identity_pool_id](#input_cognito_identity_pool_id) | Required when cognito_enabled is enabled: ID of the Cognito Identity Pool to use | `string` | `null` | no |\n| \u003ca name=\"input_cognito_role_arn\"\u003e\u003c/a\u003e [cognito_role_arn](#input_cognito_role_arn) | Required when `cognito_enabled` is enabled: ARN of the IAM role that has the AmazonESCognitoAccess policy attached | `string` | `null` | no |\n| \u003ca name=\"input_cognito_user_pool_id\"\u003e\u003c/a\u003e [cognito_user_pool_id](#input_cognito_user_pool_id) | Required when cognito_enabled is enabled: ID of the Cognito User Pool to use | `string` | `null` | no |\n| \u003ca name=\"input_custom_endpoint\"\u003e\u003c/a\u003e [custom_endpoint](#input_custom_endpoint) | The domain name to use as custom endpoint for Elasicsearch | `string` | `null` | no |\n| \u003ca name=\"input_custom_endpoint_certificate_arn\"\u003e\u003c/a\u003e [custom_endpoint_certificate_arn](#input_custom_endpoint_certificate_arn) | ARN of the ACM certificate to use for the custom endpoint. Required when custom endpoint is set along with enabling `endpoint_enforce_https` | `string` | `null` | no |\n| \u003ca name=\"input_dedicated_master_count\"\u003e\u003c/a\u003e [dedicated_master_count](#input_dedicated_master_count) | Number of dedicated master nodes in the domain (can be 3 or 5) | `number` | `3` | no |\n| \u003ca name=\"input_dedicated_master_enabled\"\u003e\u003c/a\u003e [dedicated_master_enabled](#input_dedicated_master_enabled) | Whether dedicated master nodes are enabled for the domain. Automatically enabled when `warm_enabled = true` | `bool` | `false` | no |\n| \u003ca name=\"input_dedicated_master_type\"\u003e\u003c/a\u003e [dedicated_master_type](#input_dedicated_master_type) | Instance type of the dedicated master nodes in the domain | `string` | `\"t3.small.search\"` | no |\n| \u003ca name=\"input_encrypt_at_rest\"\u003e\u003c/a\u003e [encrypt_at_rest](#input_encrypt_at_rest) | Whether to enable encryption at rest for the cluster. Changing this on an existing cluster will force a new resource! | `bool` | `true` | no |\n| \u003ca name=\"input_encrypt_at_rest_kms_key_id\"\u003e\u003c/a\u003e [encrypt_at_rest_kms_key_id](#input_encrypt_at_rest_kms_key_id) | The KMS key id to encrypt the OpenSearch domain with. If not specified then it defaults to using the `aws/es` service KMS key | `string` | `null` | no |\n| \u003ca name=\"input_endpoint_enforce_https\"\u003e\u003c/a\u003e [endpoint_enforce_https](#input_endpoint_enforce_https) | Whether or not to require HTTPS | `bool` | `true` | no |\n| \u003ca name=\"input_endpoint_tls_security_policy\"\u003e\u003c/a\u003e [endpoint_tls_security_policy](#input_endpoint_tls_security_policy) | The name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values: `Policy-Min-TLS-1-0-2019-07` and `Policy-Min-TLS-1-2-2019-07` | `string` | `\"Policy-Min-TLS-1-2-2019-07\"` | no |\n| \u003ca name=\"input_ephemeral_list\"\u003e\u003c/a\u003e [ephemeral_list](#input_ephemeral_list) | m3 and r3 are supported by aws using ephemeral storage but are a legacy instance type | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"i3.large.search\",\u003cbr/\u003e  \"i3.xlarge.search\",\u003cbr/\u003e  \"i3.2xlarge.search\",\u003cbr/\u003e  \"i3.4xlarge.search\",\u003cbr/\u003e  \"i3.8xlarge.search\",\u003cbr/\u003e  \"i3.16xlarge.search\",\u003cbr/\u003e  \"r6gd.large.search\",\u003cbr/\u003e  \"r6gd.xlarge.search\",\u003cbr/\u003e  \"r6gd.2xlarge.search\",\u003cbr/\u003e  \"r6gd.4xlarge.search\",\u003cbr/\u003e  \"r6gd.8xlarge.search\",\u003cbr/\u003e  \"r6gd.12xlarge.search\",\u003cbr/\u003e  \"r6gd.16xlarge.search\",\u003cbr/\u003e  \"i3.large.elasticsearch\",\u003cbr/\u003e  \"i3.xlarge.elasticsearch\",\u003cbr/\u003e  \"i3.2xlarge.elasticsearch\",\u003cbr/\u003e  \"i3.4xlarge.elasticsearch\",\u003cbr/\u003e  \"i3.8xlarge.elasticsearch\",\u003cbr/\u003e  \"i3.16xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.large.elasticsearch\",\u003cbr/\u003e  \"r6gd.xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.2xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.4xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.8xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.12xlarge.elasticsearch\",\u003cbr/\u003e  \"r6gd.16xlarge.elasticsearch\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_instance_count\"\u003e\u003c/a\u003e [instance_count](#input_instance_count) | Size of the OpenSearch domain | `number` | `1` | no |\n| \u003ca name=\"input_logging_enabled\"\u003e\u003c/a\u003e [logging_enabled](#input_logging_enabled) | Whether to enable OpenSearch slow logs (index \u0026 search) in Cloudwatch | `bool` | `false` | no |\n| \u003ca name=\"input_logging_retention\"\u003e\u003c/a\u003e [logging_retention](#input_logging_retention) | How many days to retain OpenSearch logs in Cloudwatch | `number` | `30` | no |\n| \u003ca name=\"input_node_to_node_encryption\"\u003e\u003c/a\u003e [node_to_node_encryption](#input_node_to_node_encryption) | Whether to enable node-to-node encryption. Changing this on an existing cluster will force a new resource! | `bool` | `true` | no |\n| \u003ca name=\"input_options_indices_fielddata_cache_size\"\u003e\u003c/a\u003e [options_indices_fielddata_cache_size](#input_options_indices_fielddata_cache_size) | Sets the `indices.fielddata.cache.size` advanced option. Specifies the percentage of heap space that is allocated to fielddata | `number` | `null` | no |\n| \u003ca name=\"input_options_indices_query_bool_max_clause_count\"\u003e\u003c/a\u003e [options_indices_query_bool_max_clause_count](#input_options_indices_query_bool_max_clause_count) | Sets the `indices.query.bool.max_clause_count` advanced option. Specifies the maximum number of allowed boolean clauses in a query | `number` | `1024` | no |\n| \u003ca name=\"input_options_override_main_response_version\"\u003e\u003c/a\u003e [options_override_main_response_version](#input_options_override_main_response_version) | Whether to enable compatibility mode when creating an OpenSearch domain. Because certain Elasticsearch OSS clients and plugins check the cluster version before connecting, compatibility mode sets OpenSearch to report its version as 7.10 so these clients continue to work | `bool` | `true` | no |\n| \u003ca name=\"input_options_rest_action_multi_allow_explicit_index\"\u003e\u003c/a\u003e [options_rest_action_multi_allow_explicit_index](#input_options_rest_action_multi_allow_explicit_index) | Sets the `rest.action.multi.allow_explicit_index` advanced option. When set to `false`, OpenSearch will reject requests that have an explicit index specified in the request body | `bool` | `true` | no |\n| \u003ca name=\"input_search_version\"\u003e\u003c/a\u003e [search_version](#input_search_version) | Version of the OpenSearch domain | `string` | `\"OpenSearch_2.5\"` | no |\n| \u003ca name=\"input_security_group_ids\"\u003e\u003c/a\u003e [security_group_ids](#input_security_group_ids) | Extra security group IDs to attach to the OpenSearch domain. Note: a default SG is already created and exposed via outputs | `list(string)` | `[]` | no |\n| \u003ca name=\"input_snapshot_start_hour\"\u003e\u003c/a\u003e [snapshot_start_hour](#input_snapshot_start_hour) | Hour during which an automated daily snapshot is taken of the OpenSearch indices | `number` | `3` | no |\n| \u003ca name=\"input_subnet_ids\"\u003e\u003c/a\u003e [subnet_ids](#input_subnet_ids) | Required if vpc_id is specified: Subnet IDs for the VPC enabled OpenSearch domain endpoints to be created in | `list(string)` | `[]` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input_tags) | Optional tags | `map(string)` | `{}` | no |\n| \u003ca name=\"input_volume_iops\"\u003e\u003c/a\u003e [volume_iops](#input_volume_iops) | Required if volume_type=\"io1\" or \"gp3\": Amount of provisioned IOPS for the EBS volume | `number` | `0` | no |\n| \u003ca name=\"input_volume_type\"\u003e\u003c/a\u003e [volume_type](#input_volume_type) | EBS volume type to use for the OpenSearch domain | `string` | `\"gp2\"` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc_id](#input_vpc_id) | VPC ID where to deploy the OpenSearch domain. If set, you also need to specify `subnet_ids`. If not set, the module creates a public domain | `string` | `null` | no |\n| \u003ca name=\"input_warm_count\"\u003e\u003c/a\u003e [warm_count](#input_warm_count) | Number of warm nodes (2 - 150) | `number` | `2` | no |\n| \u003ca name=\"input_warm_enabled\"\u003e\u003c/a\u003e [warm_enabled](#input_warm_enabled) | Whether to enable warm storage | `bool` | `false` | no |\n| \u003ca name=\"input_warm_type\"\u003e\u003c/a\u003e [warm_type](#input_warm_type) | Instance type of the warm nodes | `string` | `\"ultrawarm1.medium.search\"` | no |\n| \u003ca name=\"input_zone_awareness_enabled\"\u003e\u003c/a\u003e [zone_awareness_enabled](#input_zone_awareness_enabled) | Whether to enable zone_awareness or not, if not set, multi az is enabled by default and configured through number of instances/subnets available | `bool` | `null` | no |\n\n### Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_arn\"\u003e\u003c/a\u003e [arn](#output_arn) | ARN of the OpenSearch domain |\n| \u003ca name=\"output_domain_id\"\u003e\u003c/a\u003e [domain_id](#output_domain_id) | ID of the OpenSearch domain |\n| \u003ca name=\"output_domain_name\"\u003e\u003c/a\u003e [domain_name](#output_domain_name) | Name of the OpenSearch domain |\n| \u003ca name=\"output_domain_region\"\u003e\u003c/a\u003e [domain_region](#output_domain_region) | Region of the OpenSearch domain |\n| \u003ca name=\"output_endpoint\"\u003e\u003c/a\u003e [endpoint](#output_endpoint) | DNS endpoint of the OpenSearch domain |\n| \u003ca name=\"output_kibana_endpoint\"\u003e\u003c/a\u003e [kibana_endpoint](#output_kibana_endpoint) | DNS endpoint of Kibana |\n| \u003ca name=\"output_sg_id\"\u003e\u003c/a\u003e [sg_id](#output_sg_id) | ID of the OpenSearch security group |\n\n### Example\n\n```terraform\nmodule \"opensearch\" {\n  source = \"github.com/skyscrapers/terraform-opensearch//opensearch?ref=11.3.0\"\n\n  name           = \"logs-${terraform.workspace}-es\"\n  instance_count = 3\n  instance_type  = \"m5.large.elasticsearch\"\n  volume_size    = 100\n  vpc_id         = data.terraform_remote_state.networking.outputs.vpc_id\n  subnet_ids     = data.terraform_remote_state.networking.outputs.private_db_subnets\n}\n\ndata \"aws_iam_policy_document\" \"opensearch\" {\n  statement {\n    effect = \"Allow\"\n\n    principals {\n      type        = \"AWS\"\n      identifiers = [\"${aws_iam_user.es_user.arn}\"]\n    }\n\n    actions   = [\"es:*\"]\n    resources = [\"${module.elasticsearch.arn}/*\"]\n  }\n}\n\nresource \"aws_elasticsearch_domain_policy\" \"opensearch\" {\n  domain_name     = module.opensearch.domain_name\n  access_policies = data.aws_iam_policy_document.opensearch.json\n}\n```\n\n### Logging\n\nThis module by default creates Cloudwatch Log Groups \u0026 IAM permissions for ElasticSearch slow logging (search \u0026 index), but we don't enable these logs by default. You can control logging behavior via the `logging_enabled` and `logging_retention` parameters. When enabling this, make sure you also enable this on Elasticsearch side, following the [AWS documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createdomain-configure-slow-logs.html).\n\nYou can also enable Elasticsearch error logs via `application_logging_enabled = true`.\n\n### Monitoring\n\nFor a CloudWatch based solution, check out our [`terraform-cloudwatch` modules](https://github.com/skyscrapers/terraform-cloudwatch).\n\nFor a Kubernetes \u0026 Prometheus based solution, see the [`elasticsearch_k8s_monitoring` module](#elasticsearch_k8s_monitoring) below.\n\n### NOTES\n\nThis module will not work without the ES default role [AWSServiceRoleForAmazonElasticsearchService](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/slr-es.html). This service role needs to be created per-account so you will need to add it if not present (just once per AWS account).\n\nHere is a code sample you can use:\n\n```terraform\nresource \"aws_iam_service_linked_role\" \"es\" {\n  aws_service_name = \"es.amazonaws.com\"\n}\n```\n\n## opensearch-backup\n\nThis module can be used to create your own snapshots of Opensearch to S3, using [Snapshot Management](https://opensearch.org/docs/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-management/). It can also deploy a [PrometheusRule](https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PrometheusRule) for monitoring snapshot success.\n\n\u003e [!IMPORTANT]\n\u003e This requires Opensearch \u003e= 2.5!\n\n### Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement_terraform) | \u003e= 1.3.9 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement_aws) | ~\u003e 6.0 |\n| \u003ca name=\"requirement_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#requirement_kubernetes) | ~\u003e 2.23 |\n| \u003ca name=\"requirement_opensearch\"\u003e\u003c/a\u003e [opensearch](#requirement_opensearch) | ~\u003e 2.2 |\n\n### Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider_aws) | ~\u003e 6.0 |\n| \u003ca name=\"provider_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#provider_kubernetes) | ~\u003e 2.23 |\n| \u003ca name=\"provider_opensearch\"\u003e\u003c/a\u003e [opensearch](#provider_opensearch) | ~\u003e 2.2 |\n\n### Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_s3_snapshot\"\u003e\u003c/a\u003e [s3_snapshot](#module_s3_snapshot) | terraform-aws-modules/s3-bucket/aws | ~\u003e 5.0 |\n\n### Resources\n\n| Name | Type |\n|------|------|\n| [aws_iam_role.snapshot_create](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy.snapshot_create](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [kubernetes_manifest.prometheusrule](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |\n| [opensearch_sm_policy.snapshot](https://registry.terraform.io/providers/opensearch-project/opensearch/latest/docs/resources/sm_policy) | resource |\n| [opensearch_snapshot_repository.repo](https://registry.terraform.io/providers/opensearch-project/opensearch/latest/docs/resources/snapshot_repository) | resource |\n| [aws_iam_policy_document.s3_snapshot_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.snapshot_create](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.snapshot_create_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input_name) | Name for the snapshot system, S3 bucket, etc. | `string` | n/a | yes |\n| \u003ca name=\"input_aws_kms_key_arn\"\u003e\u003c/a\u003e [aws_kms_key_arn](#input_aws_kms_key_arn) | ARN of the CMK used for S3 Server Side Encryption. When specified, we'll use the `aws:kms` SSE algorithm. When not specified, falls back to using `AES256` | `string` | `null` | no |\n| \u003ca name=\"input_bucket_key_enabled\"\u003e\u003c/a\u003e [bucket_key_enabled](#input_bucket_key_enabled) | Whether to use Amazon S3 Bucket Keys for encryption, which reduces API costs | `bool` | `false` | no |\n| \u003ca name=\"input_create_cron_expression\"\u003e\u003c/a\u003e [create_cron_expression](#input_create_cron_expression) | The cron schedule used to create snapshots | `string` | `\"0 0 * * *\"` | no |\n| \u003ca name=\"input_create_time_limit\"\u003e\u003c/a\u003e [create_time_limit](#input_create_time_limit) | Sets the maximum time to wait for snapshot creation to finish. If time_limit is longer than the scheduled time interval for taking snapshots, no scheduled snapshots are taken until time_limit elapses. For example, if time_limit is set to 35 minutes and snapshots are taken every 30 minutes starting at midnight, the snapshots at 00:00 and 01:00 are taken, but the snapshot at 00:30 is skipped | `string` | `\"1h\"` | no |\n| \u003ca name=\"input_custom_sm_policy\"\u003e\u003c/a\u003e [custom_sm_policy](#input_custom_sm_policy) | Set this variable when you want to override the generated SM policy JSON with your own. Make sure to correctly set `snapshot_config.repository` to the same value as `var.name` (the bucket name) | `string` | `null` | no |\n| \u003ca name=\"input_delete_cron_expression\"\u003e\u003c/a\u003e [delete_cron_expression](#input_delete_cron_expression) | The cron schedule used to delete snapshots | `string` | `\"0 2 * * *\"` | no |\n| \u003ca name=\"input_delete_time_limit\"\u003e\u003c/a\u003e [delete_time_limit](#input_delete_time_limit) | Sets the maximum time to wait for snapshot deletion to finish | `string` | `\"1h\"` | no |\n| \u003ca name=\"input_extra_bucket_policy\"\u003e\u003c/a\u003e [extra_bucket_policy](#input_extra_bucket_policy) | Extra bucket policy to attach to the S3 bucket (JSON string formatted) | `string` | `null` | no |\n| \u003ca name=\"input_indices\"\u003e\u003c/a\u003e [indices](#input_indices) | The names of the indexes in the snapshot. Multiple index names are separated by `,`. Supports wildcards (`*`) | `string` | `\"*\"` | no |\n| \u003ca name=\"input_max_age\"\u003e\u003c/a\u003e [max_age](#input_max_age) | The maximum time a snapshot is retained in S3 | `string` | `\"14d\"` | no |\n| \u003ca name=\"input_max_count\"\u003e\u003c/a\u003e [max_count](#input_max_count) | The maximum number of snapshots retained in S3 | `number` | `400` | no |\n| \u003ca name=\"input_min_count\"\u003e\u003c/a\u003e [min_count](#input_min_count) | The minimum number of snapshot retained in S3 | `number` | `1` | no |\n| \u003ca name=\"input_prometheusrule_alert_labels\"\u003e\u003c/a\u003e [prometheusrule_alert_labels](#input_prometheusrule_alert_labels) | Additional labels to add to the PrometheusRule alert | `map(string)` | `{}` | no |\n| \u003ca name=\"input_prometheusrule_enabled\"\u003e\u003c/a\u003e [prometheusrule_enabled](#input_prometheusrule_enabled) | Whether to deploy a [PrometheusRule](https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PrometheusRule) for monitoring the snapshots. Requires the [prometheus-operator](https://prometheus-operator.dev/) and [elasticsearch-exporter](https://github.com/prometheus-community/elasticsearch_exporter) to be deployed | `bool` | `true` | no |\n| \u003ca name=\"input_prometheusrule_labels\"\u003e\u003c/a\u003e [prometheusrule_labels](#input_prometheusrule_labels) | Additional K8s labels to add to the PrometheusRule | `map(string)` | \u003cpre\u003e{\u003cbr/\u003e  \"prometheus\": \"opensearch-backup\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_prometheusrule_namespace\"\u003e\u003c/a\u003e [prometheusrule_namespace](#input_prometheusrule_namespace) | Namespace where to deploy the PrometheusRule | `string` | `\"infrastructure\"` | no |\n| \u003ca name=\"input_prometheusrule_query_period\"\u003e\u003c/a\u003e [prometheusrule_query_period](#input_prometheusrule_query_period) | Period to apply to the PrometheusRule queries. Make sure this is bigger than the `create_cron_expression` interval | `string` | `\"32h\"` | no |\n| \u003ca name=\"input_prometheusrule_severity\"\u003e\u003c/a\u003e [prometheusrule_severity](#input_prometheusrule_severity) | Severity of the PrometheusRule alert. Usual values are: `info`, `warning` and `critical` | `string` | `\"warning\"` | no |\n| \u003ca name=\"input_s3_force_destroy\"\u003e\u003c/a\u003e [s3_force_destroy](#input_s3_force_destroy) | Whether to force-destroy and empty the S3 bucket when destroying this Terraform module. WARNING: Not recommended! | `bool` | `false` | no |\n| \u003ca name=\"input_s3_replication_configuration\"\u003e\u003c/a\u003e [s3_replication_configuration](#input_s3_replication_configuration) | Replication configuration block for the S3 bucket. See \u003chttps://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/v3.15.1/examples/s3-replication\u003e for an example | `any` | `{}` | no |\n\n### Outputs\n\nNo outputs.\n\n### Example\n\n```terraform\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp/aws\"\n    }\n    opensearch = {\n      source = \"opensearch-project/opensearch\"\n    }\n  }\n}\n\nprovider \"opensearch\" {\n  url                 = module.opensearch.endpoint\n  aws_region          = var._aws_provider_region\n  aws_profile         = var._aws_provider_profile\n  aws_assume_role_arn = \"arn:aws:iam::${var._aws_provider_account_id}:role/${var._aws_provider_assume_role}\"\n}\n\nmodule \"opensearch_snapshots\" {\n  source = \"github.com/skyscrapers/terraform-opensearch//opensearch-backup?ref=11.3.0\"\n  name   = \"${module.opensearch.domain_name}-snapshots\"\n}\n```\n\n## elasticsearch_k8s_monitoring\n\nThis module deploys our [`elasticsearch/monitoring`](https://github.com/skyscrapers/charts/elasticsearch-monitoring) chart on Kubernetes.\n\n### Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement_terraform) | \u003e= 1.3.9 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement_aws) | ~\u003e 6.0 |\n| \u003ca name=\"requirement_helm\"\u003e\u003c/a\u003e [helm](#requirement_helm) | ~\u003e 3.0 |\n| \u003ca name=\"requirement_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#requirement_kubernetes) | ~\u003e 2.23 |\n\n### Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_helm\"\u003e\u003c/a\u003e [helm](#provider_helm) | ~\u003e 3.0 |\n\n### Modules\n\nNo modules.\n\n### Resources\n\n| Name | Type |\n|------|------|\n| [helm_release.elasticsearch_monitoring](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_cloudwatch_exporter_role_arn\"\u003e\u003c/a\u003e [cloudwatch_exporter_role_arn](#input_cloudwatch_exporter_role_arn) | IAM role ARN to use for the CloudWatch exporter. Used via either IRSA or kube2iam (see `var.irsa_enabled`) | `string` | n/a | yes |\n| \u003ca name=\"input_elasticsearch_domain_name\"\u003e\u003c/a\u003e [elasticsearch_domain_name](#input_elasticsearch_domain_name) | Domain name of the AWS Elasticsearch domain | `string` | n/a | yes |\n| \u003ca name=\"input_elasticsearch_domain_region\"\u003e\u003c/a\u003e [elasticsearch_domain_region](#input_elasticsearch_domain_region) | Region of the AWS Elasticsearch domain | `string` | n/a | yes |\n| \u003ca name=\"input_elasticsearch_endpoint\"\u003e\u003c/a\u003e [elasticsearch_endpoint](#input_elasticsearch_endpoint) | Endpoint of the AWS Elasticsearch domain | `string` | n/a | yes |\n| \u003ca name=\"input_kubernetes_namespace\"\u003e\u003c/a\u003e [kubernetes_namespace](#input_kubernetes_namespace) | Kubernetes namespace where to deploy the `skyscrapers/elasticsearch-monitoring` chart | `string` | n/a | yes |\n| \u003ca name=\"input_cw_exporter_memory\"\u003e\u003c/a\u003e [cw_exporter_memory](#input_cw_exporter_memory) | Memory request and limit for the prometheus-cloudwatch-exporter pod | `string` | `\"160Mi\"` | no |\n| \u003ca name=\"input_elasticsearch_monitoring_chart_version\"\u003e\u003c/a\u003e [elasticsearch_monitoring_chart_version](#input_elasticsearch_monitoring_chart_version) | elasticsearch-monitoring Helm chart version to deploy | `string` | `\"1.11.2\"` | no |\n| \u003ca name=\"input_es_exporter_memory\"\u003e\u003c/a\u003e [es_exporter_memory](#input_es_exporter_memory) | Memory request and limit for the prometheus-elasticsearch-exporter pod | `string` | `\"48Mi\"` | no |\n| \u003ca name=\"input_irsa_enabled\"\u003e\u003c/a\u003e [irsa_enabled](#input_irsa_enabled) | Whether to use [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). When `true`, the Cloudwatch exporter's SA is appropriately annotated. If `false` a [kube2iam](https://github.com/jtblin/kube2iam) Pod annotation is set instead | `bool` | `true` | no |\n| \u003ca name=\"input_sla\"\u003e\u003c/a\u003e [sla](#input_sla) | SLA of the monitored Elasticsearch cluster. Will default to the k8s cluster SLA if omited | `string` | `null` | no |\n| \u003ca name=\"input_system_nodeSelector\"\u003e\u003c/a\u003e [system_nodeSelector](#input_system_nodeSelector) | nodeSelector to add to the kubernetes pods. Set to null to disable. | `map(map(string))` | \u003cpre\u003e{\u003cbr/\u003e  \"nodeSelector\": {\u003cbr/\u003e    \"role\": \"system\"\u003cbr/\u003e  }\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_system_tolerations\"\u003e\u003c/a\u003e [system_tolerations](#input_system_tolerations) | Tolerations to add to the kubernetes pods. Set to null to disable. | `any` | \u003cpre\u003e{\u003cbr/\u003e  \"tolerations\": [\u003cbr/\u003e    {\u003cbr/\u003e      \"effect\": \"NoSchedule\",\u003cbr/\u003e      \"key\": \"role\",\u003cbr/\u003e      \"operator\": \"Equal\",\u003cbr/\u003e      \"value\": \"system\"\u003cbr/\u003e    }\u003cbr/\u003e  ]\u003cbr/\u003e}\u003c/pre\u003e | no |\n\n## Outputs\n\nNo outputs.\n\n## kibana_k8s_auth_proxy\n\n**This module is no longer maintained!**\n\nThis module deploys [keycloack-gatekeeper](https://github.com/keycloak/keycloak-gatekeeper) as OIDC proxy on Kubernetes to reach the AWS Elasticsearch Kibana endpoint.\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|:----:|:-----:|:-----:|\n| elasticsearch\\_endpoint | Endpoint of the AWS Elasticsearch domain | string | n/a | yes |\n| elasticsearch\\_domain\\_name | Domain name of the AWS Elasticsearch domain | string | n/a | yes |\n| kubernetes\\_namespace | Kubernetes namespace where to deploy the Keycloack-gatekeeper proxy chart | string | n/a | yes |\n| gatekeeper\\_image | Docker image to use for the Keycloack-gatekeeper deployment | string | `\"keycloak/keycloak-gatekeeper:6.0.1\"` | no |\n| gatekeeper\\_ingress\\_host | Hostname to use for the Ingress | string | n/a | yes |\n| gatekeeper\\_discovery\\_url | URL for OpenID autoconfiguration | string | n/a | yes |\n| gatekeeper\\_client\\_id | Client ID for OpenID server | string | n/a | yes |\n| gatekeeper\\_client\\_secret | Client secret for OpenID server | string | n/a | yes |\n| gatekeeper\\_oidc\\_groups | Groups that will be granted access. When using Dex with GitHub, teams are defined in the form `\u003cgh_org\u003e:\u003cgh_team\u003e`, for example `skyscrapers:k8s-admins` | string | n/a | yes |\n| gatekeeper\\_timeout | Upstream timeouts to use for the proxy | string | `\"500s\"` | no |\n| gatekeeper\\_extra\\_args | Additional keycloack-gatekeeper command line arguments | list(string) | `[]` | no |\n\n### Outputs\n\n| Name | Description |\n|------|-------------|\n| callback\\_uri | Callback URI. You might need to register this to your OIDC provider (like CoreOS Dex) |\n\n## Upgrading\n\n### Version 10.0.0 to 11.0.0\n\nWe removed the custom S3 backup mechanism (via Lambda) from the `opensearch` module. As an alternative we now offer a new `opensearch-backup` module, which relies on the OpenSearch [Snapshot Management API](https://opensearch.org/docs/latest/tuning-your-cluster/availability-and-recovery/snapshots/sm-api) to create snapshots to S3.\n\nIf you want to upgrade, without destroying your old S3 snapshot bucket, we recommend to remove the bucket from Terraform's state and re-import it into the new backup module. For example, consider your code like this:\n\n```hcl\nmodule \"opensearch\" {\n  source = \"github.com/skyscrapers/terraform-opensearch//opensearch?ref=11.3.0\"\n  ...\n}\n\nmodule \"opensearch_backup\" {\n  source = \"github.com/skyscrapers/terraform-opensearch//opensearch-backup?ref=11.3.0\"\n  name   = \"${module.opensearch.domain_name}-snapshot\"\n}\n```\n\nThen you can migrate your snapshots S3 bucket like this:\n\n```hcl\nterraform state rm module.opensearch.aws_s3_bucket.snapshot[0]\nterraform import module.opensearch_backup.module.s3_snapshot.aws_s3_bucket.this[0] \"\u003copensearch_domain_name\u003e-snapshot\"\n```\n\nAlso make sure to set `var.name` of this module to `\u003copensearch_domain_name\u003e-snapshot`!\n\nAlternatively you can just let the module create a new bucket.\n\n### Version 9.1.4 to 10.0.0\n\nIn the `elasticsearch_k8s_monitoring` module, the variables `system_tolerations` and `system_nodeSelector` have been added to isolate the monitoring on a dedicated system node pool. If you don't want this you can override these variables to `null` to disable.\n\n### Version 8.0.0 to 8.2.0\n\nIn the `opensearch` module, the `s3_snapshots_schedule_expression` variable has been replaced with `s3_snapshots_schedule_period`. Instead of a cron expression, we only allow to specify a period in hours, which will be used as a `rate(x hours)`.\n\n### Version 7.0.0 to 8.0.0\n\nThis change migrates the `elasticsearch` module to `opensearch`. This is mostly a cosmetic change, however there's several breaking things to note:\n\n- Security Group description is updated, which would normally trigger a destroy/recreate. However existing setups won't be affected due to an ignore lifecycle\n- Variables `project` and `environment` have been removed. Only the `name` variable is now used. For existing setups, you can set `name = \"\u003cmyproject\u003e-\u003cmyenvironment\u003e-\u003coldname\u003e\"` to retain the original \"name\".\n- CloudWatch Log Groups will be destroyed and recreated using the new name. If you wish to keep your older logs, it's best to remove the existing Log Groups from the TF state:\n\n```shell\nterraform state rm module.elasticsearch.aws_cloudwatch_log_group.cwl_index\nterraform state rm module.elasticsearch.aws_cloudwatch_log_group.cwl_search\nterraform state rm module.elasticsearch.aws_cloudwatch_log_group.cwl_application\n```\n\n- Variable `elasticsearch_version` has been renamed to `search_version`, with default value `OpenSearch_1.1`\n- We no longer merge the `tags` variable with our own hardcoded defaults (`Environment`, `Project`, `Name`) , all tags need to be passed through the `tags` variable and/or through the `default_tags` provider setting\n- Updated list of instance types with NVMe SSD storage\n\n### Version 6.0.0 to 7.0.0\n\nBehavior of this module in function of backups has changed much between versions 6.0.0 and 7.0.0:\n\n- Replace the `snapshot_bucket_enabled` variable with `s3_snapshots_enabled`\n  - Note: This will also enable the Lambda for automated backups\n  - If you just want to keep the bucket, you can remove it from the terraform state and manage it outside the module: `terraform state rm aws_s3_bucket.snapshot[0]`\n- The IAM role for taking snapshots has been renamed. If you want to keep the old role too, you should remove it from the terraform state: `terraform state rm module.registrations.aws_iam_role.role[0]`\n  - Otherwise just let it destroy the old role and it will create a new one\n\nAlso note that some default values for variables has beem changed, mostly related to encryption. If this triggers an unwanted change, you can override this by explicitly setting the variable with it's old value.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskyscrapers%2Fterraform-opensearch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fskyscrapers%2Fterraform-opensearch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskyscrapers%2Fterraform-opensearch/lists"}