Skip to content

Commit 2ea37bd

Browse files
aurimasmickaurimasmick
authored
Merge pull request #1 from avlcloudtechnologies/initial
Initial commit
2 parents 30980d9 + be467f1 commit 2ea37bd

13 files changed

+529
-0
lines changed

‎.github/pr-labeler.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
enhancement: ['feature/*', 'feat/*', 'enhancement/*']
2+
bug: ['fix/*', 'hotfix/*', 'bugfix/*', 'patch/*', 'bug/*']
3+
chore: ['chore/*', 'docs/*']

‎.github/pull_request_template.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## Description
2+
* List the changes you are making.
3+
* Reference Github issue if appropriate, i.e. `closes #123`
4+
5+
## Breaking Changes
6+
* Any breaking changes?
7+
8+
## Testing
9+
* How was this tested?

‎.github/release-drafter.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name-template: 'v$RESOLVED_VERSION'
2+
tag-template: 'v$RESOLVED_VERSION'
3+
categories:
4+
- title: '❗ Breaking'
5+
labels:
6+
- 'breaking'
7+
- title: 'Features'
8+
labels:
9+
- 'feature'
10+
- 'enhancement'
11+
- title: 'Bug Fixes'
12+
labels:
13+
- 'bug'
14+
- title: 'Maintenance'
15+
label: 'chore'
16+
change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
17+
change-title-escapes: '\<*_&'
18+
version-resolver:
19+
major:
20+
labels:
21+
- 'breaking'
22+
minor:
23+
labels:
24+
- 'enhancement'
25+
patch:
26+
labels:
27+
- 'patch'
28+
- 'bug'
29+
- 'chore'
30+
default: minor
31+
template: |
32+
# What's Changed
33+
34+
$CHANGES

‎.github/workflows/pr-labeler.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: PR Labeler
2+
on:
3+
pull_request:
4+
types: [opened]
5+
6+
jobs:
7+
pr-labeler:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: TimonVS/pr-labeler-action@v3
11+
env:
12+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-drafter.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Release Drafter
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
update_release_draft:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: release-drafter/release-drafter@master
13+
env:
14+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# OSX
2+
.DS_Store
3+
4+
# Local .terraform directories
5+
**/.terraform/*
6+
7+
# .tfstate files
8+
*.tfstate
9+
*.tfstate.*
10+
11+
# Crash log files
12+
crash.log
13+
14+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
15+
# .tfvars files are managed as part of configuration and so should be included in
16+
# version control.
17+
#
18+
# example.tfvars
19+
20+
# Ignore override files as they are usually used to override resources locally and so
21+
# are not checked in
22+
override.tf
23+
override.tf.json
24+
*_override.tf
25+
*_override.tf.json
26+
27+
# Include override files you do wish to add to version control using negated pattern
28+
#
29+
# !example_override.tf
30+
31+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
32+
# example: *tfplan*

‎.pre-commit-config.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
repos:
2+
- repo: git://github.com/antonbabenko/pre-commit-terraform
3+
rev: v1.45.0
4+
hooks:
5+
- id: terraform_fmt
6+
- id: terraform_docs

‎README.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# terraform-aws-opensearch
2+
This module handles creation of AWS Opensearch and SAML auth
3+
4+
## Usage
5+
6+
```hcl
7+
provider "aws" {
8+
region = var.region
9+
}
10+
11+
provider "elasticsearch" {
12+
url = "https://${module.opensearch.fqdn}"
13+
aws_region = var.aws_region
14+
healthcheck = false
15+
}
16+
17+
module "opensearch" {
18+
source = "./terraform-aws-opensearch"
19+
20+
create_opensearch = var.create_opensearch
21+
region = var.region
22+
name_prefix = var.name_prefix
23+
environment = var.environment
24+
root_domain_name = var.root_domain_name
25+
26+
enable_saml = false
27+
}
28+
```
29+
30+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
31+
## Requirements
32+
33+
| Name | Version |
34+
|------|---------|
35+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 4.0 |
36+
| <a name="requirement_elasticsearch"></a> [elasticsearch](#requirement\_elasticsearch) | ~> 2.0 |
37+
38+
## Providers
39+
40+
| Name | Version |
41+
|------|---------|
42+
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 4.0 |
43+
| <a name="provider_elasticsearch"></a> [elasticsearch](#provider\_elasticsearch) | ~> 2.0 |
44+
| <a name="provider_http"></a> [http](#provider\_http) | n/a |
45+
| <a name="provider_time"></a> [time](#provider\_time) | n/a |
46+
47+
## Modules
48+
49+
| Name | Source | Version |
50+
|------|--------|---------|
51+
| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | ~> 4.1.0 |
52+
53+
## Resources
54+
55+
| Name | Type |
56+
|------|------|
57+
| [aws_iam_service_linked_role.opensearch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
58+
| [aws_opensearch_domain.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain) | resource |
59+
| [aws_opensearch_domain_saml_options.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain_saml_options) | resource |
60+
| [aws_route53_record.opensearch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
61+
| [elasticsearch_opensearch_roles_mapping.this](https://registry.terraform.io/providers/phillbaker/elasticsearch/latest/docs/resources/opensearch_roles_mapping) | resource |
62+
| [time_sleep.wait_300_seconds](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
63+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
64+
| [aws_iam_policy_document.access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
65+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
66+
| [aws_route53_zone.env](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
67+
| [http_http.saml_metadata](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source |
68+
69+
## Inputs
70+
71+
| Name | Description | Type | Default | Required |
72+
|------|-------------|------|---------|:--------:|
73+
| <a name="input_create_opensearch"></a> [create\_opensearch](#input\_create\_opensearch) | Whether to create OpenSearch cluster | `bool` | `false` | no |
74+
| <a name="input_enable_advanced_security_options"></a> [enable\_advanced\_security\_options](#input\_enable\_advanced\_security\_options) | Whether advanced security is enabled | `bool` | `true` | no |
75+
| <a name="input_enable_internal_user_database"></a> [enable\_internal\_user\_database](#input\_enable\_internal\_user\_database) | Whether the internal user database is enabled | `bool` | `false` | no |
76+
| <a name="input_enable_saml"></a> [enable\_saml](#input\_enable\_saml) | Whether OpenSearch SAML options are enabled | `bool` | `true` | no |
77+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment name | `string` | n/a | yes |
78+
| <a name="input_master_user_arn"></a> [master\_user\_arn](#input\_master\_user\_arn) | User or role arn which is provisioning opensearch. This role is used to configure opensearch TF provider. | `string` | `null` | no |
79+
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Prefix to be used with resources | `string` | n/a | yes |
80+
| <a name="input_opensearch_engine_version"></a> [opensearch\_engine\_version](#input\_opensearch\_engine\_version) | Either Elasticsearch\_X.Y or OpenSearch\_X.Y to specify the engine version for the Amazon OpenSearch Service domain | `string` | `"OpenSearch_1.2"` | no |
81+
| <a name="input_opensearch_instance_count"></a> [opensearch\_instance\_count](#input\_opensearch\_instance\_count) | Number of instances in the cluster | `string` | `"1"` | no |
82+
| <a name="input_opensearch_instance_type"></a> [opensearch\_instance\_type](#input\_opensearch\_instance\_type) | Instance type of data nodes in the cluster | `string` | `"t3.small.search"` | no |
83+
| <a name="input_opensearch_subdomain"></a> [opensearch\_subdomain](#input\_opensearch\_subdomain) | Route53 OpenSearch subdomain | `string` | `"opensearch"` | no |
84+
| <a name="input_opensearch_volume_size"></a> [opensearch\_volume\_size](#input\_opensearch\_volume\_size) | Size of EBS volumes attached to data nodes (in GiB) | `number` | `40` | no |
85+
| <a name="input_region"></a> [region](#input\_region) | Region name | `string` | n/a | yes |
86+
| <a name="input_roles_mappings"></a> [roles\_mappings](#input\_roles\_mappings) | OpenSearch roles mappings | <pre>map(object({<br> description = optional(string)<br> backend_roles = list(string)<br> }))</pre> | `{}` | no |
87+
| <a name="input_route_53_zone_name"></a> [route\_53\_zone\_name](#input\_route\_53\_zone\_name) | Route53 DNS zone | `string` | n/a | yes |
88+
| <a name="input_sso_admins_group_id"></a> [sso\_admins\_group\_id](#input\_sso\_admins\_group\_id) | AWS SSO admins group | `string` | `null` | no |
89+
| <a name="input_sso_entity_id"></a> [sso\_entity\_id](#input\_sso\_entity\_id) | AWS SSO entity ID | `string` | `null` | no |
90+
91+
## Outputs
92+
93+
| Name | Description |
94+
|------|-------------|
95+
| <a name="output_fqdn"></a> [fqdn](#output\_fqdn) | opensearch\_fqdn |
96+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/complete.tf

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
provider "elasticsearch" {
6+
url = "https://${module.opensearch.fqdn}"
7+
aws_region = var.region
8+
aws_assume_role_arn = module.opensearch_iam_role.iam_role_arn
9+
healthcheck = false
10+
}
11+
12+
module "opensearch" {
13+
source = "./terraform-aws-opensearch"
14+
15+
create_opensearch = true
16+
region = var.region
17+
name_prefix = var.name_prefix
18+
environment = var.environment
19+
root_domain_name = var.root_domain_name
20+
master_user_arn = module.opensearch_iam_role.iam_role_arn
21+
22+
sso_admins_group_id = var.sso_admins_group_id
23+
sso_entity_id = var.sso_entity_id
24+
roles_mappings = {
25+
readall = {
26+
description = "Gives readall Opensearch permission"
27+
backend_roles = [
28+
"123456-abcd" // <AWS_SSO_READONLY_GROUP_ID>
29+
]
30+
}
31+
all_access = {
32+
description = "Gives all_access Opensearch permission"
33+
backend_roles = [
34+
"123456-efgh", // <AWS_SSO_ADMINS_GROUP_ID>,
35+
module.opensearch_iam_role.iam_role_arn
36+
]
37+
}
38+
opensearch_dashboards_user = {
39+
description = "Gives opensearch_dashboards_user Opensearch permission"
40+
backend_roles = [
41+
"78912-abcd" // <AWS_SSO_DEVELOPERS_GROUP_ID>
42+
]
43+
}
44+
}
45+
}
46+
47+
module "opensearch_iam_role" {
48+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
49+
version = "5.10.0"
50+
51+
trusted_role_arns = [
52+
"arn:aws:iam::${var.aws_account_id}:root",
53+
]
54+
create_role = true
55+
role_name = "${var.name_prefix}-opensearch-admin"
56+
role_requires_mfa = false
57+
custom_role_policy_arns = [
58+
"arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
59+
]
60+
}

0 commit comments

Comments
 (0)