Terraform module to setup all resources needed for setting up an AWS Elasticsearch Service domain.

module "elasticsearch" {
  source        = "github.com/skyscrapers/terraform-awselasticsearch//elasticsearch?ref=4.0.0"
  name           = "es"
  project        = var.project
  environment    = terraform.workspace
  instance_count = 3
  instance_type  = "m5.large.elasticsearch"
  volume_size    = 100
  vpc_id         = data.terraform_remote_state.networking.outputs.vpc_id
  subnet_ids     = data.terraform_remote_state.networking.outputs.private_db_subnets
}

resource "aws_elasticsearch_domain_policy" "es_policy" {
  domain_name = "${module.elasticsearch.domain_name}"

  access_policies = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "es:*",
            "Principal": [
              "AWS": "${aws_iam_user.es_user.arn}"
            ],
            "Effect": "Allow",
            "Resource": "${module.elasticsearch.arn}/*"
        }
    ]
}
POLICY
}

The AWS Elasticsearch Service handles backups automatically via daily snapshots. You can control when this happens by setting snapshot_start_hour.

It's possible to create a custom backup schedule by using the normal Elasticsearch API for snapshotting. This module can create an S3 bucket and IAM role allowing such scenario's (snapshot_bucket_enabled = true). More info on how to create custom snapshots can be found in the AWS documentation.

This module by default creates Cloudwatch Log Groups & IAM permissions for ElasticSearch slow logging, but we don't enable these logs by default. You can control logging behavior via the logging_enabled and logging_retention parameters. When enabling this, make sure you also enable this on Elasticsearch side, following the AWS documentation.

This module generates a Helm values file which can be used for the elasticsearch/monitoring chart.

The file, helm_values.yaml needs to be created in the same folder as the Terraform code that is calling this module.

This module will not work without the ES default role AWSServiceRoleForAmazonElasticsearchService. This service role needs to be created per-account so you will need to add it if not present (just once per AWS account).

Here is a code sample you can use:

resource "aws_iam_service_linked_role" "es" {
  aws_service_name = "es.amazonaws.com"
}

This module deploys our elasticsearch/monitoring chart on Kubernetes.

| elasticsearch_monitoring_chart_version | elasticsearch-monitoring Helm chart version to deploy | string | "0.2.5" | no | | elasticsearch_endpoint | Endpoint of the AWS Elasticsearch domain | string | n/a | yes | | elasticsearch_domain_name | Domain name of the AWS Elasticsearch domain | string | n/a | yes | | elasticsearch_domain_region | Region of the AWS Elasticsearch domain | string | n/a | yes | | kubernetes_namespace | Kubernetes namespace where to deploy the skyscrapers/elasticsearch-monitoring chart | string | n/a | yes | | kubernetes_worker_instance_role_arns | Role ARNs of the Kubernetes nodes to attach the kube2iam assume_role to | list(string) | n/a | yes | | force_helm_update | Modify this variable to trigger an update on all Helm charts (you can set any value). Due to current limitations of the Helm provider, it doesn't detect drift on | string | "1" | no |

This module deploys an Ingress with external authentication on Kubernetes to reach the AWS Elasticsearch Kibana endpoint.

This module deploys keycloack-gatekeeper as OIDC proxy on Kubernetes to reach the AWS Elasticsearch Kibana endpoint.