From a259cce9afeb84ddd90fc383d62e56115e16f7a1 Mon Sep 17 00:00:00 2001 From: "docs-sourcer[bot]" <99042413+docs-sourcer[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 01:49:45 +0000 Subject: [PATCH] Updated with the [latest changes](https://github.com/gruntwork-io/terraform-aws-service-catalog/pull/2399) from the `terraform-aws-service-catalog@james/lib-5245-opensearch-wrapper` source branch. --- .../services/data-storage/amazon-aurora.md | 59 +- .../data-storage/amazon-elasticsearch.md | 21 +- .../data-storage/amazon-open-search.md | 1918 +++++++++++++++++ .../services/data-storage/amazon-rds.md | 59 +- 4 files changed, 2054 insertions(+), 3 deletions(-) create mode 100644 docs/reference/services/data-storage/amazon-open-search.md diff --git a/docs/reference/services/data-storage/amazon-aurora.md b/docs/reference/services/data-storage/amazon-aurora.md index f9e8db12e..2aee83624 100644 --- a/docs/reference/services/data-storage/amazon-aurora.md +++ b/docs/reference/services/data-storage/amazon-aurora.md @@ -162,6 +162,12 @@ module "aurora" { # the engine is allowed. Default value is true. auto_minor_version_upgrade = true + # The amount of time in minutes before a backup job is canceled if it does not + # complete successfully. Maps to the backup plan rule's completion_window. + # Must be at least 60 minutes greater than var.backup_start_window. If null, + # AWS Backup uses its default. + backup_completion_window = null + # The number of days to retain recovery points in the destination backup vault # before automatic deletion. Only used if var.backup_destination_vault_arn is # set. @@ -171,6 +177,10 @@ module "aurora" { # copies. If null, no cross-account copy is configured. backup_destination_vault_arn = null + # A map of tags to assign to the recovery points (backups) created by the + # backup plan rule. If null, no recovery point tags are applied. + backup_recovery_point_tags = null + # How many days to keep backup snapshots around before cleaning them up. Max: # 35 backup_retention_period = 30 @@ -188,6 +198,11 @@ module "aurora" { # before automatic deletion. backup_source_retention_days = 30 + # The amount of time in minutes before a backup job is canceled if it does not + # start successfully. Maps to the backup plan rule's start_window. If null, + # AWS Backup uses its default. + backup_start_window = null + # The ARN of a KMS key used to encrypt the backup vault. If null, the default # AWS Backup encryption will be used. backup_vault_kms_key_arn = null @@ -677,6 +692,12 @@ inputs = { # the engine is allowed. Default value is true. auto_minor_version_upgrade = true + # The amount of time in minutes before a backup job is canceled if it does not + # complete successfully. Maps to the backup plan rule's completion_window. + # Must be at least 60 minutes greater than var.backup_start_window. If null, + # AWS Backup uses its default. + backup_completion_window = null + # The number of days to retain recovery points in the destination backup vault # before automatic deletion. Only used if var.backup_destination_vault_arn is # set. @@ -686,6 +707,10 @@ inputs = { # copies. If null, no cross-account copy is configured. backup_destination_vault_arn = null + # A map of tags to assign to the recovery points (backups) created by the + # backup plan rule. If null, no recovery point tags are applied. + backup_recovery_point_tags = null + # How many days to keep backup snapshots around before cleaning them up. Max: # 35 backup_retention_period = 30 @@ -703,6 +728,11 @@ inputs = { # before automatic deletion. backup_source_retention_days = 30 + # The amount of time in minutes before a backup job is canceled if it does not + # start successfully. Maps to the backup plan rule's start_window. If null, + # AWS Backup uses its default. + backup_start_window = null + # The ARN of a KMS key used to encrypt the backup vault. If null, the default # AWS Backup encryption will be used. backup_vault_kms_key_arn = null @@ -1216,6 +1246,15 @@ Configure the auto minor version upgrade behavior. This is applied to the cluste + + + +The amount of time in minutes before a backup job is canceled if it does not complete successfully. Maps to the backup plan rule's completion_window. Must be at least 60 minutes greater than backup_start_window. If null, AWS Backup uses its default. + + + + + @@ -1234,6 +1273,15 @@ The ARN of a destination backup vault for cross-account or cross-region copies. + + + +A map of tags to assign to the recovery points (backups) created by the backup plan rule. If null, no recovery point tags are applied. + + + + + @@ -1270,6 +1318,15 @@ The number of days to retain recovery points in the source backup vault before a + + + +The amount of time in minutes before a backup job is canceled if it does not start successfully. Maps to the backup plan rule's start_window. If null, AWS Backup uses its default. + + + + + @@ -2600,6 +2657,6 @@ ID of security group created by aurora module. "https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/v2.11.0/modules/data-stores/aurora/outputs.tf" ], "sourcePlugin": "service-catalog-api", - "hash": "9805e5c705ea16bd09f81ee3033f556c" + "hash": "c478a742a0092aa4a0285bcdddb4de8e" } ##DOCS-SOURCER-END --> diff --git a/docs/reference/services/data-storage/amazon-elasticsearch.md b/docs/reference/services/data-storage/amazon-elasticsearch.md index 89861a38e..03fc7011b 100644 --- a/docs/reference/services/data-storage/amazon-elasticsearch.md +++ b/docs/reference/services/data-storage/amazon-elasticsearch.md @@ -20,6 +20,25 @@ import { HclListItem, HclListItemDescription, HclListItemTypeDetails, HclListIte # Amazon Elasticsearch Service +> \[!WARNING] +> **Deprecated.** AWS has renamed Amazon Elasticsearch Service to Amazon OpenSearch Service, and this module +> (which manages the legacy `aws_elasticsearch_domain` resource) is deprecated in favor of the +> [`opensearch`](/reference/services/data-storage/amazon-open-search) module, which manages `aws_opensearch_domain`. New deployments should use +> `opensearch`. This module remains for existing consumers and will be removed in a future major release. +> +> **Migrating an existing domain:** `aws_elasticsearch_domain` and `aws_opensearch_domain` manage the same +> underlying AWS OpenSearch Service domain, so migration relocates Terraform state without touching AWS. After +> switching your module `source` to `opensearch` and mapping inputs to the new variable names (e.g. +> `elasticsearch_version` -> `engine_version`, `is_public`/`iam_principal_arns` -> `access_policies`), move the +> domain in state: +> +> ```bash +> terraform state rm 'module..aws_elasticsearch_domain.cluster' +> terraform import 'module..module.domain.aws_opensearch_domain.domain' +> ``` +> +> Run `terraform plan` afterward and confirm it shows no destroy/recreate of the domain. + View Source Release Notes @@ -1598,6 +1617,6 @@ Domain-specific endpoint for Kibana without https scheme. "https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/v2.11.0/modules/data-stores/elasticsearch/outputs.tf" ], "sourcePlugin": "service-catalog-api", - "hash": "9eeffde7b37d0c0ba68c841389278cd0" + "hash": "f755e074bab200c79241d7ddce5f4056" } ##DOCS-SOURCER-END --> diff --git a/docs/reference/services/data-storage/amazon-open-search.md b/docs/reference/services/data-storage/amazon-open-search.md new file mode 100644 index 000000000..6b88f5a0d --- /dev/null +++ b/docs/reference/services/data-storage/amazon-open-search.md @@ -0,0 +1,1918 @@ +--- +type: "service" +name: "Amazon OpenSearch" +description: "Deploy and manage an Amazon OpenSearch Service domain." +category: "nosql" +cloud: "aws" +tags: ["analytics","data"] +license: "gruntwork" +built-with: "terraform" +title: "Amazon OpenSearch Service" +hide_title: true +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; +import VersionBadge from '../../../../src/components/VersionBadge.tsx'; +import { HclListItem, HclListItemDescription, HclListItemTypeDetails, HclListItemDefaultValue, HclGeneralListItem } from '../../../../src/components/HclListItem.tsx'; + + + +# Amazon OpenSearch Service + +View Source + +Release Notes + +## Overview + +This service deploys an [Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/) domain (the successor +to Amazon Elasticsearch Service). It wraps the [terraform-aws-data-storage opensearch +module](https://github.com/gruntwork-io/terraform-aws-data-storage/tree/main/modules/opensearch) and adds CloudWatch +alarms for monitoring the health of the domain. It replaces the legacy self-contained +[elasticsearch module](/reference/services/data-storage/amazon-elasticsearch). + +## Features + +* A fully-managed OpenSearch domain in a VPC (or with a public endpoint) +* A fully functional OpenSearch Dashboards (formerly Kibana) UI +* VPC-based security +* Encryption at rest and node-to-node encryption +* Fine-grained access control, SAML, Cognito, and IAM Identity Center authentication +* Zone awareness, UltraWarm, and cold storage +* CloudWatch Alarms for alerting when CPU, memory, and disk metrics exceed certain thresholds + +## Learn + +:::note + +This repo is a part of the [Gruntwork Service Catalog](https://github.com/gruntwork-io/terraform-aws-service-catalog/), +a collection of reusable, battle-tested, production ready infrastructure code. +If you’ve never used the Service Catalog before, make sure to read +[How to use the Gruntwork Service Catalog](https://docs.gruntwork.io/reference/services/intro/overview)! + +::: + +* [About Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/) +* [Developer Guide](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html): + Contains the main documentation on how to use Amazon OpenSearch Service. + +## Deploy + +### Non-production deployment (quick start for learning) + +If you just want to try this repo out for experimenting and learning, check out the following resources: + +* [examples/for-learning-and-testing folder](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/v2.11.0/examples/for-learning-and-testing): The + `examples/for-learning-and-testing` folder contains standalone sample code optimized for learning, experimenting, and + testing (but not direct production usage). + +### Production deployment + +If you want to deploy this repo in production, check out the following resources: + +* [examples/for-production folder](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/v2.11.0/examples/for-production): The `examples/for-production` folder contains sample code + optimized for direct usage in production. This is code from the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), + and it shows you how we build an end-to-end, integrated tech stack on top of the Gruntwork Service Catalog. + +* [Amazon OpenSearch Service pricing](https://aws.amazon.com/opensearch-service/pricing/) + + +## Sample Usage + + + + +```hcl title="main.tf" + +# ------------------------------------------------------------------------------------------------------ +# DEPLOY GRUNTWORK'S OPENSEARCH MODULE +# +# NOTE: This module uses some sensitive variables marked inline with "# SENSITIVE". +# When using values other than defaults for these variables, set them through environment variables or +# another secure method. +# +# ------------------------------------------------------------------------------------------------------ + +module "opensearch" { + + source = "git::git@github.com:gruntwork-io/terraform-aws-service-catalog.git//modules/data-stores/opensearch?ref=v2.11.0" + + # ---------------------------------------------------------------------------------------------------- + # REQUIRED VARIABLES + # ---------------------------------------------------------------------------------------------------- + + # The name of the OpenSearch domain. Must be between 3 and 28 characters, + # start with a lowercase letter, and contain only lowercase letters, numbers, + # and hyphens. + domain_name = + + # The engine version for the OpenSearch domain (e.g. 'OpenSearch_2.11' or + # 'Elasticsearch_7.10'). + engine_version = + + # The number of data nodes in the OpenSearch domain. + instance_count = + + # The instance type for the OpenSearch domain data nodes (e.g. + # 'm6g.large.search'). + instance_type = + + # The size of the EBS volume in GB for each data node. + volume_size = + + # The type of EBS volume to use (gp3, gp2, io1, or standard). + volume_type = + + # ---------------------------------------------------------------------------------------------------- + # OPTIONAL VARIABLES + # ---------------------------------------------------------------------------------------------------- + + # IAM policy document specifying the access policies for the domain. If null, + # no access policy is applied. + access_policies = null + + # Key-value pairs of advanced configuration options (e.g. + # 'rest.action.multi.allow_explicit_index' = 'true'). + advanced_options = null + + # Whether to enable fine-grained access control (FGAC). Requires + # enforce_https, node_to_node_encryption, and encrypt_at_rest to be true. + advanced_security_options_enabled = false + + # ARNs of the SNS topics associated with the CloudWatch alarms for the + # OpenSearch domain. + alarms_sns_topic_arns = [] + + # A list of CIDR-formatted IP address ranges that can connect to this + # OpenSearch domain over HTTPS (port 443). + allow_connections_from_cidr_blocks = [] + + # A list of IPv6 CIDR-formatted IP address ranges that can connect to this + # OpenSearch domain over HTTPS (port 443). + allow_connections_from_ipv6_cidr_blocks = [] + + # A list of security group IDs that can connect to this OpenSearch domain. + allow_connections_from_security_groups = [] + + # Whether to enable anonymous authentication. Only relevant when + # advanced_security_options_enabled is true. + anonymous_auth_enabled = false + + # Whether automatic software updates are enabled for the domain. + auto_software_update_enabled = false + + # The Auto-Tune desired state. Valid values are 'ENABLED' and 'DISABLED'. + auto_tune_desired_state = "ENABLED" + + # Whether to enable Auto-Tune for the domain. + auto_tune_enabled = false + + # A list of Auto-Tune maintenance schedules. + auto_tune_maintenance_schedules = [] + + # Whether to roll back Auto-Tune settings when disabling. Valid values are + # 'NO_ROLLBACK' and 'DEFAULT_ROLLBACK'. + auto_tune_rollback_on_disable = "NO_ROLLBACK" + + # The hour (0-23) during which the service takes an automated daily snapshot + # of the indices. Set to null to omit. + automated_snapshot_start_hour = null + + # The number of availability zones for zone-aware domains. Valid values are 2 + # or 3. Only used when zone_awareness_enabled is true. + availability_zone_count = 2 + + # The period, in seconds, over which to measure the CPU utilization percentage + cluster_high_cpu_utilization_period = 60 + + # Trigger an alarm if the OpenSearch domain has a CPU utilization percentage + # above this threshold + cluster_high_cpu_utilization_threshold = 90 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_high_cpu_utilization_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the JVM heap usage percentage + cluster_high_jvm_memory_pressure_period = 60 + + # Trigger an alarm if the JVM heap usage percentage goes above this threshold + cluster_high_jvm_memory_pressure_threshold = 90 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_high_jvm_memory_pressure_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, that ClusterIndexWritesBlocked can + # be in red status before triggering an alarm + cluster_index_writes_blocked_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_index_writes_blocked_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the CPU credit balance + cluster_low_cpu_credit_balance_period = 60 + + # Trigger an alarm if the CPU credit balance drops below this threshold. Only + # used if var.instance_type is t2.xxx. + cluster_low_cpu_credit_balance_threshold = 10 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_low_cpu_credit_balance_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the available free storage + # space + cluster_low_free_storage_space_period = 60 + + # Trigger an alarm if the amount of free storage space, in Megabytes, on the + # OpenSearch domain drops below this threshold + cluster_low_free_storage_space_threshold = 1024 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_low_free_storage_space_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during with the + # AutomatedSnapshotFailure can be in red status before triggering an alarm + cluster_snapshot_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_snapshot_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during which the cluster can be in + # red status before triggering an alarm + cluster_status_red_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_status_red_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during which the cluster can be in + # yellow status before triggering an alarm + cluster_status_yellow_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_status_yellow_treat_missing_data = "missing" + + # Cognito authentication options for OpenSearch Dashboards. Set to null to + # disable Cognito. + cognito_options = null + + # Whether cold storage is enabled. Requires UltraWarm to be enabled. + cold_storage_enabled = false + + # Whether to create the AWSServiceRoleForAmazonOpenSearchService + # service-linked role. Only needed once per AWS account. + create_service_linked_role = false + + # Timeout for creating the OpenSearch domain. + creating_timeout = "60m" + + # The fully qualified domain name for a custom endpoint (e.g. + # 'search.example.com'). If null, custom endpoints are disabled. + custom_endpoint = null + + # The ACM certificate ARN for the custom endpoint. Required when + # custom_endpoint is set. + custom_endpoint_certificate_arn = null + + # A map of custom tags to apply to the OpenSearch domain and security group. + # The key is the tag name and the value is the tag value. + custom_tags = {} + + # The number of dedicated master nodes in the cluster. + dedicated_master_count = null + + # Whether dedicated master nodes are enabled for the cluster. + dedicated_master_enabled = false + + # The instance type for the dedicated master nodes (e.g. 'm6g.large.search'). + dedicated_master_type = null + + # Timeout for deleting the OpenSearch domain. + deleting_timeout = "60m" + + # Whether EBS volumes are attached to data nodes. + ebs_enabled = true + + # Set to true to enable several basic CloudWatch alarms around CPU usage, + # memory usage, and disk space usage. If set to true, make sure to specify SNS + # topics to send notifications to using var.alarms_sns_topic_arns. + enable_cloudwatch_alarms = true + + # Whether to enable encryption at rest for the OpenSearch domain. + encrypt_at_rest = true + + # Whether to require HTTPS for all traffic to the domain. + enforce_https = true + + # IAM Identity Center options for the OpenSearch domain. Set to null to + # disable. Requires fine-grained access control + # (advanced_security_options_enabled must be true). + # identity_center_instance_arn is required when enabled_api_access is true. + # Valid values for subject_key are 'UserName', 'UserId' (default), and + # 'Email'; valid values for roles_key are 'GroupName' and 'GroupId' (default). + identity_center_options = null + + # Whether to enable the internal user database for fine-grained access + # control. + internal_user_database_enabled = false + + # The baseline I/O performance of EBS volumes attached to data nodes. Only + # applicable for io1 and gp3 volume types. + iops = null + + # The type of IP addresses supported by the endpoint. Valid values are 'ipv4' + # and 'dualstack'. + ip_address_type = null + + # The maximum amount of time, in seconds, that KMSKeyError can be in red + # status before triggering an alarm + kms_key_error_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + kms_key_error_treat_missing_data = "missing" + + # The KMS key ID to use for encryption at rest. If not specified, the default + # OpenSearch KMS key is used. + kms_key_id = null + + # The maximum amount of time, in seconds, that KMSKeyInaccessible can be in + # red status before triggering an alarm + kms_key_inaccessible_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + kms_key_inaccessible_treat_missing_data = "missing" + + # A list of log publishing options. Each entry specifies a log type and a + # CloudWatch Log Group ARN. + log_publishing_options = [] + + # The period, in seconds, over which to measure the master nodes' CPU + # utilization + master_cpu_utilization_period = 900 + + # Trigger an alarm if the OpenSearch domain master nodes have a CPU + # utilization percentage above this threshold + master_cpu_utilization_threshold = 50 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + master_cpu_utilization_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the master nodes' JVM memory + # pressure + master_jvm_memory_pressure_period = 900 + + # Trigger an alarm if the OpenSearch domain master nodes have a JVM memory + # pressure percentage above this threshold + master_jvm_memory_pressure_threshold = 80 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + master_jvm_memory_pressure_treat_missing_data = "missing" + + # The ARN of the IAM user to use as the master user for FGAC. Conflicts with + # master_user_name and master_user_password. + master_user_arn = null + + # The master username for fine-grained access control. Requires + # internal_user_database_enabled to be true. + master_user_name = null + + # The master password for fine-grained access control. Requires + # internal_user_database_enabled to be true. Must be at least 8 characters + # with at least one uppercase letter, one lowercase letter, one digit, and one + # special character. + master_user_password = null # SENSITIVE + + # Whether to monitor KMS key statistics + monitor_kms_key = false + + # Whether to monitor master node statistics + monitor_master_nodes = false + + # Whether a multi-AZ domain is turned on with a standby AZ. Requires zone + # awareness and at least 3 AZs. + multi_az_with_standby_enabled = false + + # The period, in seconds, over which to measure the master nodes' CPU + # utilization + node_count_period = 86400 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + node_count_treat_missing_data = "missing" + + # Whether to enable node-to-node encryption. + node_to_node_encryption = true + + # Whether the off-peak window is enabled. Set to null to omit the block + # entirely. + off_peak_window_enabled = null + + # The start time of the off-peak window. + off_peak_window_start_time = null + + # SAML authentication options for OpenSearch Dashboards. Set to null to + # disable SAML. + saml_options = null + + # The description of the security group created for the OpenSearch domain. + # Defaults to 'Security group for the OpenSearch domain' if not + # specified. + security_group_description = null + + # The name of the security group created for the OpenSearch domain. Defaults + # to var.domain_name if not specified. + security_group_name = null + + # A list of subnet IDs for the OpenSearch domain to use for VPC endpoints. If + # empty, the domain is created with a public endpoint. + subnet_ids = [] + + # The throughput (in MiB/s) of the EBS volumes attached to data nodes. Only + # applicable for gp3 volume types. + throughput = null + + # The TLS security policy to apply to the HTTPS endpoint. Valid values are + # 'Policy-Min-TLS-1-0-2019-07' and 'Policy-Min-TLS-1-2-2019-07'. + tls_security_policy = "Policy-Min-TLS-1-2-2019-07" + + # Timeout for updating the OpenSearch domain. + updating_timeout = "60m" + + # The ID of the VPC in which to create the security group. Required when + # subnet_ids is provided. + vpc_id = null + + # The number of UltraWarm nodes in the cluster. + warm_count = null + + # Whether UltraWarm storage is enabled. + warm_enabled = false + + # The instance type for UltraWarm nodes (e.g. 'ultrawarm1.medium.search'). + warm_type = null + + # Whether zone awareness is enabled. If true, nodes are distributed across + # availability zones. + zone_awareness_enabled = false + +} + + +``` + + + + +```hcl title="terragrunt.hcl" + +# ------------------------------------------------------------------------------------------------------ +# DEPLOY GRUNTWORK'S OPENSEARCH MODULE +# +# NOTE: This module uses some sensitive variables marked inline with "# SENSITIVE". +# When using values other than defaults for these variables, set them through environment variables or +# another secure method. +# +# ------------------------------------------------------------------------------------------------------ + +terraform { + source = "git::git@github.com:gruntwork-io/terraform-aws-service-catalog.git//modules/data-stores/opensearch?ref=v2.11.0" +} + +inputs = { + + # ---------------------------------------------------------------------------------------------------- + # REQUIRED VARIABLES + # ---------------------------------------------------------------------------------------------------- + + # The name of the OpenSearch domain. Must be between 3 and 28 characters, + # start with a lowercase letter, and contain only lowercase letters, numbers, + # and hyphens. + domain_name = + + # The engine version for the OpenSearch domain (e.g. 'OpenSearch_2.11' or + # 'Elasticsearch_7.10'). + engine_version = + + # The number of data nodes in the OpenSearch domain. + instance_count = + + # The instance type for the OpenSearch domain data nodes (e.g. + # 'm6g.large.search'). + instance_type = + + # The size of the EBS volume in GB for each data node. + volume_size = + + # The type of EBS volume to use (gp3, gp2, io1, or standard). + volume_type = + + # ---------------------------------------------------------------------------------------------------- + # OPTIONAL VARIABLES + # ---------------------------------------------------------------------------------------------------- + + # IAM policy document specifying the access policies for the domain. If null, + # no access policy is applied. + access_policies = null + + # Key-value pairs of advanced configuration options (e.g. + # 'rest.action.multi.allow_explicit_index' = 'true'). + advanced_options = null + + # Whether to enable fine-grained access control (FGAC). Requires + # enforce_https, node_to_node_encryption, and encrypt_at_rest to be true. + advanced_security_options_enabled = false + + # ARNs of the SNS topics associated with the CloudWatch alarms for the + # OpenSearch domain. + alarms_sns_topic_arns = [] + + # A list of CIDR-formatted IP address ranges that can connect to this + # OpenSearch domain over HTTPS (port 443). + allow_connections_from_cidr_blocks = [] + + # A list of IPv6 CIDR-formatted IP address ranges that can connect to this + # OpenSearch domain over HTTPS (port 443). + allow_connections_from_ipv6_cidr_blocks = [] + + # A list of security group IDs that can connect to this OpenSearch domain. + allow_connections_from_security_groups = [] + + # Whether to enable anonymous authentication. Only relevant when + # advanced_security_options_enabled is true. + anonymous_auth_enabled = false + + # Whether automatic software updates are enabled for the domain. + auto_software_update_enabled = false + + # The Auto-Tune desired state. Valid values are 'ENABLED' and 'DISABLED'. + auto_tune_desired_state = "ENABLED" + + # Whether to enable Auto-Tune for the domain. + auto_tune_enabled = false + + # A list of Auto-Tune maintenance schedules. + auto_tune_maintenance_schedules = [] + + # Whether to roll back Auto-Tune settings when disabling. Valid values are + # 'NO_ROLLBACK' and 'DEFAULT_ROLLBACK'. + auto_tune_rollback_on_disable = "NO_ROLLBACK" + + # The hour (0-23) during which the service takes an automated daily snapshot + # of the indices. Set to null to omit. + automated_snapshot_start_hour = null + + # The number of availability zones for zone-aware domains. Valid values are 2 + # or 3. Only used when zone_awareness_enabled is true. + availability_zone_count = 2 + + # The period, in seconds, over which to measure the CPU utilization percentage + cluster_high_cpu_utilization_period = 60 + + # Trigger an alarm if the OpenSearch domain has a CPU utilization percentage + # above this threshold + cluster_high_cpu_utilization_threshold = 90 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_high_cpu_utilization_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the JVM heap usage percentage + cluster_high_jvm_memory_pressure_period = 60 + + # Trigger an alarm if the JVM heap usage percentage goes above this threshold + cluster_high_jvm_memory_pressure_threshold = 90 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_high_jvm_memory_pressure_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, that ClusterIndexWritesBlocked can + # be in red status before triggering an alarm + cluster_index_writes_blocked_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_index_writes_blocked_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the CPU credit balance + cluster_low_cpu_credit_balance_period = 60 + + # Trigger an alarm if the CPU credit balance drops below this threshold. Only + # used if var.instance_type is t2.xxx. + cluster_low_cpu_credit_balance_threshold = 10 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_low_cpu_credit_balance_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the available free storage + # space + cluster_low_free_storage_space_period = 60 + + # Trigger an alarm if the amount of free storage space, in Megabytes, on the + # OpenSearch domain drops below this threshold + cluster_low_free_storage_space_threshold = 1024 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_low_free_storage_space_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during with the + # AutomatedSnapshotFailure can be in red status before triggering an alarm + cluster_snapshot_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_snapshot_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during which the cluster can be in + # red status before triggering an alarm + cluster_status_red_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_status_red_treat_missing_data = "missing" + + # The maximum amount of time, in seconds, during which the cluster can be in + # yellow status before triggering an alarm + cluster_status_yellow_period = 300 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + cluster_status_yellow_treat_missing_data = "missing" + + # Cognito authentication options for OpenSearch Dashboards. Set to null to + # disable Cognito. + cognito_options = null + + # Whether cold storage is enabled. Requires UltraWarm to be enabled. + cold_storage_enabled = false + + # Whether to create the AWSServiceRoleForAmazonOpenSearchService + # service-linked role. Only needed once per AWS account. + create_service_linked_role = false + + # Timeout for creating the OpenSearch domain. + creating_timeout = "60m" + + # The fully qualified domain name for a custom endpoint (e.g. + # 'search.example.com'). If null, custom endpoints are disabled. + custom_endpoint = null + + # The ACM certificate ARN for the custom endpoint. Required when + # custom_endpoint is set. + custom_endpoint_certificate_arn = null + + # A map of custom tags to apply to the OpenSearch domain and security group. + # The key is the tag name and the value is the tag value. + custom_tags = {} + + # The number of dedicated master nodes in the cluster. + dedicated_master_count = null + + # Whether dedicated master nodes are enabled for the cluster. + dedicated_master_enabled = false + + # The instance type for the dedicated master nodes (e.g. 'm6g.large.search'). + dedicated_master_type = null + + # Timeout for deleting the OpenSearch domain. + deleting_timeout = "60m" + + # Whether EBS volumes are attached to data nodes. + ebs_enabled = true + + # Set to true to enable several basic CloudWatch alarms around CPU usage, + # memory usage, and disk space usage. If set to true, make sure to specify SNS + # topics to send notifications to using var.alarms_sns_topic_arns. + enable_cloudwatch_alarms = true + + # Whether to enable encryption at rest for the OpenSearch domain. + encrypt_at_rest = true + + # Whether to require HTTPS for all traffic to the domain. + enforce_https = true + + # IAM Identity Center options for the OpenSearch domain. Set to null to + # disable. Requires fine-grained access control + # (advanced_security_options_enabled must be true). + # identity_center_instance_arn is required when enabled_api_access is true. + # Valid values for subject_key are 'UserName', 'UserId' (default), and + # 'Email'; valid values for roles_key are 'GroupName' and 'GroupId' (default). + identity_center_options = null + + # Whether to enable the internal user database for fine-grained access + # control. + internal_user_database_enabled = false + + # The baseline I/O performance of EBS volumes attached to data nodes. Only + # applicable for io1 and gp3 volume types. + iops = null + + # The type of IP addresses supported by the endpoint. Valid values are 'ipv4' + # and 'dualstack'. + ip_address_type = null + + # The maximum amount of time, in seconds, that KMSKeyError can be in red + # status before triggering an alarm + kms_key_error_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + kms_key_error_treat_missing_data = "missing" + + # The KMS key ID to use for encryption at rest. If not specified, the default + # OpenSearch KMS key is used. + kms_key_id = null + + # The maximum amount of time, in seconds, that KMSKeyInaccessible can be in + # red status before triggering an alarm + kms_key_inaccessible_period = 60 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + kms_key_inaccessible_treat_missing_data = "missing" + + # A list of log publishing options. Each entry specifies a log type and a + # CloudWatch Log Group ARN. + log_publishing_options = [] + + # The period, in seconds, over which to measure the master nodes' CPU + # utilization + master_cpu_utilization_period = 900 + + # Trigger an alarm if the OpenSearch domain master nodes have a CPU + # utilization percentage above this threshold + master_cpu_utilization_threshold = 50 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + master_cpu_utilization_treat_missing_data = "missing" + + # The period, in seconds, over which to measure the master nodes' JVM memory + # pressure + master_jvm_memory_pressure_period = 900 + + # Trigger an alarm if the OpenSearch domain master nodes have a JVM memory + # pressure percentage above this threshold + master_jvm_memory_pressure_threshold = 80 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + master_jvm_memory_pressure_treat_missing_data = "missing" + + # The ARN of the IAM user to use as the master user for FGAC. Conflicts with + # master_user_name and master_user_password. + master_user_arn = null + + # The master username for fine-grained access control. Requires + # internal_user_database_enabled to be true. + master_user_name = null + + # The master password for fine-grained access control. Requires + # internal_user_database_enabled to be true. Must be at least 8 characters + # with at least one uppercase letter, one lowercase letter, one digit, and one + # special character. + master_user_password = null # SENSITIVE + + # Whether to monitor KMS key statistics + monitor_kms_key = false + + # Whether to monitor master node statistics + monitor_master_nodes = false + + # Whether a multi-AZ domain is turned on with a standby AZ. Requires zone + # awareness and at least 3 AZs. + multi_az_with_standby_enabled = false + + # The period, in seconds, over which to measure the master nodes' CPU + # utilization + node_count_period = 86400 + + # Sets how this alarm should handle entering the INSUFFICIENT_DATA state. + # Based on + # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. + # Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + node_count_treat_missing_data = "missing" + + # Whether to enable node-to-node encryption. + node_to_node_encryption = true + + # Whether the off-peak window is enabled. Set to null to omit the block + # entirely. + off_peak_window_enabled = null + + # The start time of the off-peak window. + off_peak_window_start_time = null + + # SAML authentication options for OpenSearch Dashboards. Set to null to + # disable SAML. + saml_options = null + + # The description of the security group created for the OpenSearch domain. + # Defaults to 'Security group for the OpenSearch domain' if not + # specified. + security_group_description = null + + # The name of the security group created for the OpenSearch domain. Defaults + # to var.domain_name if not specified. + security_group_name = null + + # A list of subnet IDs for the OpenSearch domain to use for VPC endpoints. If + # empty, the domain is created with a public endpoint. + subnet_ids = [] + + # The throughput (in MiB/s) of the EBS volumes attached to data nodes. Only + # applicable for gp3 volume types. + throughput = null + + # The TLS security policy to apply to the HTTPS endpoint. Valid values are + # 'Policy-Min-TLS-1-0-2019-07' and 'Policy-Min-TLS-1-2-2019-07'. + tls_security_policy = "Policy-Min-TLS-1-2-2019-07" + + # Timeout for updating the OpenSearch domain. + updating_timeout = "60m" + + # The ID of the VPC in which to create the security group. Required when + # subnet_ids is provided. + vpc_id = null + + # The number of UltraWarm nodes in the cluster. + warm_count = null + + # Whether UltraWarm storage is enabled. + warm_enabled = false + + # The instance type for UltraWarm nodes (e.g. 'ultrawarm1.medium.search'). + warm_type = null + + # Whether zone awareness is enabled. If true, nodes are distributed across + # availability zones. + zone_awareness_enabled = false + +} + + +``` + + + + + + +## Reference + + + + + +### Required + + + + +The name of the OpenSearch domain. Must be between 3 and 28 characters, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. + + + + + + + +The engine version for the OpenSearch domain (e.g. 'OpenSearch_2.11' or 'Elasticsearch_7.10'). + + + + + + + +The number of data nodes in the OpenSearch domain. + + + + + + + +The instance type for the OpenSearch domain data nodes (e.g. 'm6g.large.search'). + + + + + + + +The size of the EBS volume in GB for each data node. + + + + + + + +The type of EBS volume to use (gp3, gp2, io1, or standard). + + + + +### Optional + + + + +IAM policy document specifying the access policies for the domain. If null, no access policy is applied. + + + + + + + + +Key-value pairs of advanced configuration options (e.g. 'rest.action.multi.allow_explicit_index' = 'true'). + + + + + + + + +Whether to enable fine-grained access control (FGAC). Requires enforce_https, node_to_node_encryption, and encrypt_at_rest to be true. + + + + + + + + +ARNs of the SNS topics associated with the CloudWatch alarms for the OpenSearch domain. + + + + + + + + +A list of CIDR-formatted IP address ranges that can connect to this OpenSearch domain over HTTPS (port 443). + + + + + + + + +A list of IPv6 CIDR-formatted IP address ranges that can connect to this OpenSearch domain over HTTPS (port 443). + + + + + + + + +A list of security group IDs that can connect to this OpenSearch domain. + + + + + + + + +Whether to enable anonymous authentication. Only relevant when advanced_security_options_enabled is true. + + + + + + + + +Whether automatic software updates are enabled for the domain. + + + + + + + + +The Auto-Tune desired state. Valid values are 'ENABLED' and 'DISABLED'. + + + + + + + + +Whether to enable Auto-Tune for the domain. + + + + + + + + +A list of Auto-Tune maintenance schedules. + + + + +```hcl +list(object({ + start_at = string + cron_expression_for_recurrence = string + duration_value = number + duration_unit = string + })) +``` + + + + + + + + +Whether to roll back Auto-Tune settings when disabling. Valid values are 'NO_ROLLBACK' and 'DEFAULT_ROLLBACK'. + + + + + + + + +The hour (0-23) during which the service takes an automated daily snapshot of the indices. Set to null to omit. + + + + + + + + +The number of availability zones for zone-aware domains. Valid values are 2 or 3. Only used when zone_awareness_enabled is true. + + + + + + + + +The period, in seconds, over which to measure the CPU utilization percentage + + + + + + + + +Trigger an alarm if the OpenSearch domain has a CPU utilization percentage above this threshold + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The period, in seconds, over which to measure the JVM heap usage percentage + + + + + + + + +Trigger an alarm if the JVM heap usage percentage goes above this threshold + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The maximum amount of time, in seconds, that ClusterIndexWritesBlocked can be in red status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The period, in seconds, over which to measure the CPU credit balance + + + + + + + + +Trigger an alarm if the CPU credit balance drops below this threshold. Only used if instance_type is t2.xxx. + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The period, in seconds, over which to measure the available free storage space + + + + + + + + +Trigger an alarm if the amount of free storage space, in Megabytes, on the OpenSearch domain drops below this threshold + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The maximum amount of time, in seconds, during with the AutomatedSnapshotFailure can be in red status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The maximum amount of time, in seconds, during which the cluster can be in red status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The maximum amount of time, in seconds, during which the cluster can be in yellow status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +Cognito authentication options for OpenSearch Dashboards. Set to null to disable Cognito. + + + + +```hcl +object({ + user_pool_id = string + identity_pool_id = string + role_arn = string + }) +``` + + + + + + + + +Whether cold storage is enabled. Requires UltraWarm to be enabled. + + + + + + + + +Whether to create the AWSServiceRoleForAmazonOpenSearchService service-linked role. Only needed once per AWS account. + + + + + + + + +Timeout for creating the OpenSearch domain. + + + + + + + + +The fully qualified domain name for a custom endpoint (e.g. 'search.example.com'). If null, custom endpoints are disabled. + + + + + + + + +The ACM certificate ARN for the custom endpoint. Required when custom_endpoint is set. + + + + + + + + +A map of custom tags to apply to the OpenSearch domain and security group. The key is the tag name and the value is the tag value. + + + + + + + + +The number of dedicated master nodes in the cluster. + + + + + + + + +Whether dedicated master nodes are enabled for the cluster. + + + + + + + + +The instance type for the dedicated master nodes (e.g. 'm6g.large.search'). + + + + + + + + +Timeout for deleting the OpenSearch domain. + + + + + + + + +Whether EBS volumes are attached to data nodes. + + + + + + + + +Set to true to enable several basic CloudWatch alarms around CPU usage, memory usage, and disk space usage. If set to true, make sure to specify SNS topics to send notifications to using alarms_sns_topic_arns. + + + + + + + + +Whether to enable encryption at rest for the OpenSearch domain. + + + + + + + + +Whether to require HTTPS for all traffic to the domain. + + + + + + + + +IAM Identity Center options for the OpenSearch domain. Set to null to disable. Requires fine-grained access control (advanced_security_options_enabled must be true). identity_center_instance_arn is required when enabled_api_access is true. Valid values for subject_key are 'UserName', 'UserId' (default), and 'Email'; valid values for roles_key are 'GroupName' and 'GroupId' (default). + + + + +```hcl +object({ + enabled_api_access = optional(bool, true) + identity_center_instance_arn = optional(string) + subject_key = optional(string) + roles_key = optional(string) + }) +``` + + + + + + + + +Whether to enable the internal user database for fine-grained access control. + + + + + + + + +The baseline I/O performance of EBS volumes attached to data nodes. Only applicable for io1 and gp3 volume types. + + + + + + + + +The type of IP addresses supported by the endpoint. Valid values are 'ipv4' and 'dualstack'. + + + + + + + + +The maximum amount of time, in seconds, that KMSKeyError can be in red status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The KMS key ID to use for encryption at rest. If not specified, the default OpenSearch KMS key is used. + + + + + + + + +The maximum amount of time, in seconds, that KMSKeyInaccessible can be in red status before triggering an alarm + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +A list of log publishing options. Each entry specifies a log type and a CloudWatch Log Group ARN. + + + + +```hcl +list(object({ + log_type = string + cloudwatch_log_group_arn = string + enabled = optional(bool, true) + })) +``` + + + + + + + + +The period, in seconds, over which to measure the master nodes' CPU utilization + + + + + + + + +Trigger an alarm if the OpenSearch domain master nodes have a CPU utilization percentage above this threshold + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The period, in seconds, over which to measure the master nodes' JVM memory pressure + + + + + + + + +Trigger an alarm if the OpenSearch domain master nodes have a JVM memory pressure percentage above this threshold + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +The ARN of the IAM user to use as the master user for FGAC. Conflicts with master_user_name and master_user_password. + + + + + + + + +The master username for fine-grained access control. Requires internal_user_database_enabled to be true. + + + + + + + + +The master password for fine-grained access control. Requires internal_user_database_enabled to be true. Must be at least 8 characters with at least one uppercase letter, one lowercase letter, one digit, and one special character. + + + + + + + + +Whether to monitor KMS key statistics + + + + + + + + +Whether to monitor master node statistics + + + + + + + + +Whether a multi-AZ domain is turned on with a standby AZ. Requires zone awareness and at least 3 AZs. + + + + + + + + +The period, in seconds, over which to measure the master nodes' CPU utilization + + + + + + + + +Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'. + + + + + + + + +Whether to enable node-to-node encryption. + + + + + + + + +Whether the off-peak window is enabled. Set to null to omit the block entirely. + + + + + + + + +The start time of the off-peak window. + + + + +```hcl +object({ + hours = number + minutes = number + }) +``` + + + + + + + + +SAML authentication options for OpenSearch Dashboards. Set to null to disable SAML. + + + + +```hcl +object({ + idp_entity_id = string + idp_metadata_content = string + subject_key = optional(string) + roles_key = optional(string) + session_timeout_minutes = optional(number) + master_backend_role = optional(string) + master_user_name = optional(string) + }) +``` + + + + + + + + +The description of the security group created for the OpenSearch domain. Defaults to 'Security group for the <domain_name> OpenSearch domain' if not specified. + + + + + + + + +The name of the security group created for the OpenSearch domain. Defaults to domain_name if not specified. + + + + + + + + +A list of subnet IDs for the OpenSearch domain to use for VPC endpoints. If empty, the domain is created with a public endpoint. + + + + + + + + +The throughput (in MiB/s) of the EBS volumes attached to data nodes. Only applicable for gp3 volume types. + + + + + + + + +The TLS security policy to apply to the HTTPS endpoint. Valid values are 'Policy-Min-TLS-1-0-2019-07' and 'Policy-Min-TLS-1-2-2019-07'. + + + + + + + + +Timeout for updating the OpenSearch domain. + + + + + + + + +The ID of the VPC in which to create the security group. Required when subnet_ids is provided. + + + + + + + + +The number of UltraWarm nodes in the cluster. + + + + + + + + +Whether UltraWarm storage is enabled. + + + + + + + + +The instance type for UltraWarm nodes (e.g. 'ultrawarm1.medium.search'). + + + + + + + + +Whether zone awareness is enabled. If true, nodes are distributed across availability zones. + + + + + + + + + + + +The domain-specific endpoint for OpenSearch Dashboards (formerly Kibana). + + + + + + + +The ARN of the OpenSearch domain. + + + + + + + +The domain-specific endpoint used to submit index, search, and data upload requests. + + + + + + + +The unique identifier for the OpenSearch domain. + + + + + + + +The name of the OpenSearch domain. + + + + + + + +The ID of the security group created for the OpenSearch domain. Null if not in VPC mode. + + + + + + + + diff --git a/docs/reference/services/data-storage/amazon-rds.md b/docs/reference/services/data-storage/amazon-rds.md index 775a031af..08a6b8a31 100644 --- a/docs/reference/services/data-storage/amazon-rds.md +++ b/docs/reference/services/data-storage/amazon-rds.md @@ -192,6 +192,12 @@ module "rds" { # if not specified. aws_db_security_group_name = null + # The amount of time in minutes before a backup job is canceled if it does not + # complete successfully. Maps to the backup plan rule's completion_window. + # Must be at least 60 minutes greater than var.backup_start_window. If null, + # AWS Backup uses its default. + backup_completion_window = null + # The number of days to retain recovery points in the destination backup vault # before automatic deletion. Only used if var.backup_destination_vault_arn is # set. @@ -201,6 +207,10 @@ module "rds" { # copies. If null, no cross-account copy is configured. backup_destination_vault_arn = null + # A map of tags to assign to the recovery points (backups) created by the + # backup plan rule. If null, no recovery point tags are applied. + backup_recovery_point_tags = null + # How many days to keep backup snapshots around before cleaning them up. Must # be 1 or greater to support read replicas. backup_retention_period = 30 @@ -218,6 +228,11 @@ module "rds" { # before automatic deletion. backup_source_retention_days = 30 + # The amount of time in minutes before a backup job is canceled if it does not + # start successfully. Maps to the backup plan rule's start_window. If null, + # AWS Backup uses its default. + backup_start_window = null + # The ARN of a KMS key used to encrypt the backup vault. If null, the default # AWS Backup encryption will be used. backup_vault_kms_key_arn = null @@ -788,6 +803,12 @@ inputs = { # if not specified. aws_db_security_group_name = null + # The amount of time in minutes before a backup job is canceled if it does not + # complete successfully. Maps to the backup plan rule's completion_window. + # Must be at least 60 minutes greater than var.backup_start_window. If null, + # AWS Backup uses its default. + backup_completion_window = null + # The number of days to retain recovery points in the destination backup vault # before automatic deletion. Only used if var.backup_destination_vault_arn is # set. @@ -797,6 +818,10 @@ inputs = { # copies. If null, no cross-account copy is configured. backup_destination_vault_arn = null + # A map of tags to assign to the recovery points (backups) created by the + # backup plan rule. If null, no recovery point tags are applied. + backup_recovery_point_tags = null + # How many days to keep backup snapshots around before cleaning them up. Must # be 1 or greater to support read replicas. backup_retention_period = 30 @@ -814,6 +839,11 @@ inputs = { # before automatic deletion. backup_source_retention_days = 30 + # The amount of time in minutes before a backup job is canceled if it does not + # start successfully. Maps to the backup plan rule's start_window. If null, + # AWS Backup uses its default. + backup_start_window = null + # The ARN of a KMS key used to encrypt the backup vault. If null, the default # AWS Backup encryption will be used. backup_vault_kms_key_arn = null @@ -1431,6 +1461,15 @@ The name of the aws_db_security_group that is created. Defaults to + + + +The amount of time in minutes before a backup job is canceled if it does not complete successfully. Maps to the backup plan rule's completion_window. Must be at least 60 minutes greater than backup_start_window. If null, AWS Backup uses its default. + + + + + @@ -1449,6 +1488,15 @@ The ARN of a destination backup vault for cross-account or cross-region copies. + + + +A map of tags to assign to the recovery points (backups) created by the backup plan rule. If null, no recovery point tags are applied. + + + + + @@ -1485,6 +1533,15 @@ The number of days to retain recovery points in the source backup vault before a + + + +The amount of time in minutes before a backup job is canceled if it does not start successfully. Maps to the backup plan rule's start_window. If null, AWS Backup uses its default. + + + + + @@ -2961,6 +3018,6 @@ The ID of the Security Group that controls access to the RDS DB instance. "https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/v2.11.0/modules/data-stores/rds/outputs.tf" ], "sourcePlugin": "service-catalog-api", - "hash": "85d67190ae373ada4aa82ca72097bd67" + "hash": "55e90e8cc75d83b3572eb0a6b7eb2ea8" } ##DOCS-SOURCER-END -->