Skip to content

Commit 15b16a7

Browse files
fdmsantosfdmsantos
committed
feat: Add Opensearch Collection and policies (encryption, network, data access)
1 parent 1c8ed8b commit 15b16a7

17 files changed

+927
-2
lines changed

‎.github/workflows/pre-commit.yml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Pre-Commit
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
- master
8+
9+
env:
10+
TERRAFORM_DOCS_VERSION: v0.16.0
11+
TFLINT_VERSION: v0.44.1
12+
13+
jobs:
14+
collectInputs:
15+
name: Collect workflow inputs
16+
runs-on: ubuntu-latest
17+
outputs:
18+
directories: ${{ steps.dirs.outputs.directories }}
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v3
22+
23+
- name: Get root directories
24+
id: dirs
25+
uses: clowdhaus/terraform-composite-actions/[email protected]
26+
27+
preCommitMinVersions:
28+
name: Min TF pre-commit
29+
needs: collectInputs
30+
runs-on: ubuntu-latest
31+
strategy:
32+
matrix:
33+
directory: ${{ fromJson(needs.collectInputs.outputs.directories) }}
34+
steps:
35+
- name: Checkout
36+
uses: actions/checkout@v3
37+
38+
- name: Terraform min/max versions
39+
id: minMax
40+
uses: clowdhaus/[email protected]
41+
with:
42+
directory: ${{ matrix.directory }}
43+
44+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
45+
# Run only validate pre-commit check on min version supported
46+
if: ${{ matrix.directory != '.' }}
47+
uses: clowdhaus/terraform-composite-actions/[email protected]
48+
with:
49+
terraform-version: ${{ steps.minMax.outputs.minVersion }}
50+
tflint-version: ${{ env.TFLINT_VERSION }}
51+
args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*'
52+
53+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
54+
# Run only validate pre-commit check on min version supported
55+
if: ${{ matrix.directory == '.' }}
56+
uses: clowdhaus/terraform-composite-actions/[email protected]
57+
with:
58+
terraform-version: ${{ steps.minMax.outputs.minVersion }}
59+
tflint-version: ${{ env.TFLINT_VERSION }}
60+
args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'
61+
62+
preCommitMaxVersion:
63+
name: Max TF pre-commit
64+
runs-on: ubuntu-latest
65+
needs: collectInputs
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v3
69+
with:
70+
ref: ${{ github.event.pull_request.head.ref }}
71+
repository: ${{github.event.pull_request.head.repo.full_name}}
72+
73+
- name: Terraform min/max versions
74+
id: minMax
75+
uses: clowdhaus/[email protected]
76+
77+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
78+
uses: clowdhaus/terraform-composite-actions/[email protected]
79+
with:
80+
terraform-version: ${{ steps.minMax.outputs.maxVersion }}
81+
tflint-version: ${{ env.TFLINT_VERSION }}
82+
terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
83+
install-hcledit: true

‎.github/workflows/release.yml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- '**/*.tf'
10+
- '.github/workflows/release.yml'
11+
12+
jobs:
13+
release:
14+
name: Release
15+
runs-on: ubuntu-latest
16+
# Skip running release workflow on forks
17+
if: github.repository_owner == 'fdmsantos'
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v3
21+
with:
22+
persist-credentials: false
23+
fetch-depth: 0
24+
25+
- name: Release
26+
uses: cycjimmy/semantic-release-action@v3
27+
with:
28+
semantic_version: 18.0.0
29+
extra_plugins: |
30+
@semantic-release/[email protected]
31+
@semantic-release/[email protected]
32+
[email protected]
33+
env:
34+
GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,6 @@ override.tf.json
3232
# Ignore CLI configuration files
3333
.terraformrc
3434
terraform.rc
35+
36+
# Ignore Lock Files
37+
.terraform.lock.hcl

‎.pre-commit-config.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
repos:
2+
- repo: https://github.com/antonbabenko/pre-commit-terraform
3+
rev: v1.71.0
4+
hooks:
5+
- id: terraform_fmt
6+
- id: terraform_validate
7+
- id: terraform_docs
8+
args:
9+
- '--args=--lockfile=false'
10+
- id: terraform_tflint
11+
args:
12+
- '--args=--only=terraform_deprecated_interpolation'
13+
- '--args=--only=terraform_deprecated_index'
14+
- '--args=--only=terraform_unused_declarations'
15+
- '--args=--only=terraform_comment_syntax'
16+
- '--args=--only=terraform_documented_outputs'
17+
- '--args=--only=terraform_documented_variables'
18+
- '--args=--only=terraform_typed_variables'
19+
- '--args=--only=terraform_module_pinned_source'
20+
- '--args=--only=terraform_naming_convention'
21+
- '--args=--only=terraform_required_version'
22+
- '--args=--only=terraform_required_providers'
23+
- '--args=--only=terraform_standard_module_structure'
24+
- '--args=--only=terraform_workspace_remote'
25+
- repo: https://github.com/pre-commit/pre-commit-hooks
26+
rev: v4.2.0
27+
hooks:
28+
- id: check-merge-conflict
29+
- id: end-of-file-fixer

‎.releaserc.json

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"branches": [
3+
"main"
4+
],
5+
"ci": false,
6+
"plugins": [
7+
[
8+
"@semantic-release/commit-analyzer",
9+
{
10+
"preset": "conventionalcommits"
11+
}
12+
],
13+
[
14+
"@semantic-release/release-notes-generator",
15+
{
16+
"preset": "conventionalcommits"
17+
}
18+
],
19+
[
20+
"@semantic-release/github",
21+
{
22+
"successComment": "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:",
23+
"labels": false,
24+
"releasedLabels": false
25+
}
26+
],
27+
[
28+
"@semantic-release/changelog",
29+
{
30+
"changelogFile": "CHANGELOG.md",
31+
"changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file."
32+
}
33+
],
34+
[
35+
"@semantic-release/git",
36+
{
37+
"assets": [
38+
"CHANGELOG.md"
39+
],
40+
"message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
41+
}
42+
]
43+
]
44+
}

‎CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.

‎README.md

+184-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,184 @@
1-
# terraform-aws-opensearch-serverless
2-
Dynamic Terraform module, which creates a Opensearch Serverless Collection
1+
# AWS Opensearch Serverless Terraform module
2+
3+
[![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/semantic-release/semantic-release)
4+
5+
Dynamic Terraform module, which creates a Opensearch Serverless Collection and related resources.
6+
7+
## Table of Contents
8+
9+
- [AWS Opensearch Serverless Terraform module](#aws-opensearch-serverless-terraform-module)
10+
* [Table of Contents](#table-of-contents)
11+
* [Module versioning rule](#module-versioning-rule)
12+
* [Features](#features)
13+
* [How to Use](#how-to-use)
14+
+ [Basic Example](#basic-example)
15+
+ [Encryption Policy](#encryption-policy)
16+
+ [Network Policy](#network-policy)
17+
- [VPC Access](#vpc-access)
18+
+ [Data Access Policy](#data-access-policy)
19+
* [Examples](#examples)
20+
* [Requirements](#requirements)
21+
* [Providers](#providers)
22+
* [Modules](#modules)
23+
* [Resources](#resources)
24+
* [Inputs](#inputs)
25+
* [Outputs](#outputs)
26+
* [License](#license)
27+
28+
29+
## Module versioning rule
30+
31+
| Module version | AWS Provider version |
32+
|----------------|----------------------|
33+
| >= 1.x.x | => 5.31 |
34+
35+
## Features
36+
37+
- Encryption Policy
38+
- Network Policy
39+
- Data Access Policy
40+
- Opensearch Serverless VPCE
41+
42+
## How to Use
43+
44+
### Basic Example
45+
46+
This example will create:
47+
* Opensearch Serverless Collection
48+
* Encryption Policy with AWS Managed KMS Key
49+
* Public Network Policy to Both Endpoints
50+
* Data Access Policy with all permissions to collection and all indexes
51+
52+
```hcl
53+
module "firehose" {
54+
source = "fdmsantos/opensearch-serverless/aws"
55+
version = "x.x.x"
56+
name = "demo-collection"
57+
access_policy_rules = [
58+
{
59+
type = "collection"
60+
permissions = ["All"]
61+
principals = [data.aws_caller_identity.current.arn]
62+
},
63+
{
64+
type = "index"
65+
permissions = ["All"]
66+
indexes = ["*"]
67+
principals = [data.aws_caller_identity.current.arn]
68+
}
69+
]
70+
}
71+
```
72+
73+
### Encryption Policy
74+
75+
By default, the encryption policy use AWS managed KMS Key. To Use Customer Managed KMS Key use the variable `encryption_policy_kms_key_arn`
76+
77+
### Network Policy
78+
79+
By default, the network policy is created with public access to dashboard and collection endpoints.
80+
To change the network policy use variable `network_policy_type`. The supported values are:
81+
82+
| Value | Description |
83+
|----------------------------------|--------------------------------------------------------------------|
84+
| AllPublic | Public endpoints for Dashboard and Collection |
85+
| AllPrivate | Private endpoints for Dashboard and Collection |
86+
| PublicCollectionPrivateDashboard | Public endpoint for Collection and Private endpoint for Collection |
87+
| PrivateCollectionPublicDashboard | Private endpoint for Collection and Public endpoint forCollection |
88+
89+
#### VPC Access
90+
91+
If the variable `network_policy_type` is different from "AllPublic", the module will create Opensearch Serverless Endpoint to private access.
92+
In this case it's necessary configure the following variables: `vpce_subnet_ids` and `vpce_vpc_id`. `vpce_security_group_ids` is optional.
93+
94+
### Data Access Policy
95+
96+
To configure data access policy use variable `access_policy_rules`. This variable is a list of data access rules.
97+
Each rule contains the following fields:
98+
99+
| Field | Supported Values |
100+
|-------------|----------------------------------------------------------------------------------------------------------------------|
101+
| type | collection;index |
102+
| permissions | Collection Type: All;Create;Read;Update;Delete. Index Type: All;Create;Read;Update;Delete;ReadDocument;WriteDocument |
103+
| principals | IAM Users;IAM Roles;SAML users;SAML Groups |
104+
| principals | IAM Users;IAM Roles;SAML users;SAML Groups |
105+
| indexes | List of indexes to be used on policy rule |
106+
107+
## Examples
108+
109+
- [Complete](https://github.com/fdmsantos/terraform-aws-opensearch-serverless/tree/main/examples/complete) - Creates an opensearch serverless collection with all features.
110+
111+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
112+
## Requirements
113+
114+
| Name | Version |
115+
|------|---------|
116+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
117+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.31 |
118+
119+
## Providers
120+
121+
| Name | Version |
122+
|------|---------|
123+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.31 |
124+
125+
## Modules
126+
127+
No modules.
128+
129+
## Resources
130+
131+
| Name | Type |
132+
|------|------|
133+
| [aws_opensearchserverless_access_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_access_policy) | resource |
134+
| [aws_opensearchserverless_collection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_collection) | resource |
135+
| [aws_opensearchserverless_security_policy.encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy) | resource |
136+
| [aws_opensearchserverless_security_policy.network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy) | resource |
137+
| [aws_opensearchserverless_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_vpc_endpoint) | resource |
138+
139+
## Inputs
140+
141+
| Name | Description | Type | Default | Required |
142+
|------|-------------|------|---------|:--------:|
143+
| <a name="input_access_policy_description"></a> [access\_policy\_description](#input\_access\_policy\_description) | Description of the access policy. | `string` | `null` | no |
144+
| <a name="input_access_policy_name"></a> [access\_policy\_name](#input\_access\_policy\_name) | The name of the data access policy. | `string` | `null` | no |
145+
| <a name="input_access_policy_rules"></a> [access\_policy\_rules](#input\_access\_policy\_rules) | Rules to apply on access policy. | <pre>list(object({<br> type = string<br> permissions = list(string)<br> principals = list(string)<br> indexes = optional(list(string), [])<br> }))</pre> | `[]` | no |
146+
| <a name="input_create_access_policy"></a> [create\_access\_policy](#input\_create\_access\_policy) | Controls if data access policy should be created. | `bool` | `true` | no |
147+
| <a name="input_create_encryption_policy"></a> [create\_encryption\_policy](#input\_create\_encryption\_policy) | Controls if encryption policy should be created. | `bool` | `true` | no |
148+
| <a name="input_create_network_policy"></a> [create\_network\_policy](#input\_create\_network\_policy) | Controls if network policy should be created. | `bool` | `true` | no |
149+
| <a name="input_description"></a> [description](#input\_description) | Description of the collection. | `string` | `null` | no |
150+
| <a name="input_encryption_policy_description"></a> [encryption\_policy\_description](#input\_encryption\_policy\_description) | Description of the encryption policy. | `string` | `null` | no |
151+
| <a name="input_encryption_policy_kms_key_arn"></a> [encryption\_policy\_kms\_key\_arn](#input\_encryption\_policy\_kms\_key\_arn) | MS Customer managed key arn to use in the encryption policy. | `string` | `null` | no |
152+
| <a name="input_encryption_policy_name"></a> [encryption\_policy\_name](#input\_encryption\_policy\_name) | The name of the encryption policy. | `string` | `null` | no |
153+
| <a name="input_name"></a> [name](#input\_name) | Name of the collection. | `string` | n/a | yes |
154+
| <a name="input_network_policy_description"></a> [network\_policy\_description](#input\_network\_policy\_description) | Description of the network policy. | `string` | `null` | no |
155+
| <a name="input_network_policy_name"></a> [network\_policy\_name](#input\_network\_policy\_name) | The name of the network policy. | `string` | `null` | no |
156+
| <a name="input_network_policy_type"></a> [network\_policy\_type](#input\_network\_policy\_type) | Type of Network Policy. Supported Values are: AllPublic, AllPrivate, PublicCollectionPrivateDashboard, PrivateCollectionPublicDashboard | `string` | `"AllPublic"` | no |
157+
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to assign to the collection. If configured with a provider default\_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level. | `map(string)` | `{}` | no |
158+
| <a name="input_type"></a> [type](#input\_type) | Type of collection. One of SEARCH, TIMESERIES, or VECTORSEARCH. Defaults to TIMESERIES. | `string` | `"TIMESERIES"` | no |
159+
| <a name="input_use_standby_replicas"></a> [use\_standby\_replicas](#input\_use\_standby\_replicas) | Indicates whether standby replicas should be used for a collection. | `bool` | `true` | no |
160+
| <a name="input_vpce_name"></a> [vpce\_name](#input\_vpce\_name) | Name of the interface endpoint. | `string` | `null` | no |
161+
| <a name="input_vpce_security_group_ids"></a> [vpce\_security\_group\_ids](#input\_vpce\_security\_group\_ids) | One or more security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint. Up to 5 security groups can be provided. | `list(string)` | `null` | no |
162+
| <a name="input_vpce_subnet_ids"></a> [vpce\_subnet\_ids](#input\_vpce\_subnet\_ids) | One or more subnet IDs from which you'll access OpenSearch Serverless. Up to 6 subnets can be provided. | `list(string)` | `[]` | no |
163+
| <a name="input_vpce_vpc_id"></a> [vpce\_vpc\_id](#input\_vpce\_vpc\_id) | ID of the VPC from which you'll access OpenSearch Serverless. | `string` | `null` | no |
164+
165+
## Outputs
166+
167+
| Name | Description |
168+
|------|-------------|
169+
| <a name="output_collection_arn"></a> [collection\_arn](#output\_collection\_arn) | Amazon Resource Name (ARN) of the collection. |
170+
| <a name="output_collection_endpoint"></a> [collection\_endpoint](#output\_collection\_endpoint) | Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection. |
171+
| <a name="output_collection_id"></a> [collection\_id](#output\_collection\_id) | Unique identifier for the collection. |
172+
| <a name="output_dashboard_endpoint"></a> [dashboard\_endpoint](#output\_dashboard\_endpoint) | Collection-specific endpoint used to access OpenSearch Dashboards. |
173+
| <a name="output_encryption_policy_name"></a> [encryption\_policy\_name](#output\_encryption\_policy\_name) | Name of the encryption policy. |
174+
| <a name="output_encryption_policy_version"></a> [encryption\_policy\_version](#output\_encryption\_policy\_version) | Version of the encryption policy. |
175+
| <a name="output_kms_key_arn"></a> [kms\_key\_arn](#output\_kms\_key\_arn) | The ARN of the Amazon Web Services KMS key used to encrypt the collection. |
176+
| <a name="output_network_policy_name"></a> [network\_policy\_name](#output\_network\_policy\_name) | Name of the network policy. |
177+
| <a name="output_network_policy_version"></a> [network\_policy\_version](#output\_network\_policy\_version) | Version of the network policy. |
178+
| <a name="output_vpce_id"></a> [vpce\_id](#output\_vpce\_id) | Id of the vpce. |
179+
| <a name="output_vpce_name"></a> [vpce\_name](#output\_vpce\_name) | Name of the interface endpoint. |
180+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
181+
182+
## License
183+
184+
Apache 2 Licensed. See [LICENSE](https://github.com/fdmsantos/terraform-aws-opensearch-serverlesse/tree/main/LICENSE) for full details.

0 commit comments

Comments
 (0)