Skip to content

domain resource

Source: internal/service/opensearch/domain_types.go:3

Example usage:

imports: {
  aws-opensearch: 'github.com/cloudboss/unobin-library-aws//service/opensearch'
}

resources: {
  example: aws-opensearch.domain {
    # Set input fields here.
  }
}

Inputs

domain-name

string

required

access-policies

optional(string)

advanced-options

optional(map(string))

advanced-security-options

optional(object) 
optional(
  object({
    anonymous-auth-enabled: optional(boolean)
    enabled: boolean
    iam-federation-options: optional(
      object({
        enabled: optional(boolean)
        roles-key: optional(string)
        subject-key: optional(string)
      })
    )
    internal-user-database-enabled: boolean
    jwt-options: optional(
      object({
        enabled: optional(boolean)
        jwks-url: optional(string)
        public-key: optional(string)
        roles-key: optional(string)
        subject-key: optional(string)
      })
    )
    master-user-options: optional(
      object({
        master-user-arn: optional(string)
        master-user-name: optional(string)
        master-user-password: optional(string)
      })
    )
    saml-options: optional(
      object({
        enabled: boolean
        idp: optional(
          object({
            entity-id: string
            metadata-content: string
          })
        )
        master-backend-role: optional(string)
        master-user-name: optional(string)
        roles-key: optional(string)
        session-timeout-minutes: integer
        subject-key: optional(string)
      })
    )
  })
)

sensitive

aiml-options

optional(object) 
optional(
  object({
    natural-language-query-generation-options: optional(
      object({
        desired-state: string
      })
    )
    s3-vectors-engine: optional(
      object({
        enabled: optional(boolean)
      })
    )
    serverless-vector-acceleration: optional(
      object({
        enabled: optional(boolean)
      })
    )
  })
)

auto-tune-options

optional(object) 
optional(
  object({
    desired-state: string
    maintenance-schedule: optional(
      list(
        object({
          cron-expression-for-recurrence: string
          duration: object({
            unit: string
            value: integer
          })
          start-at: string
        })
      )
    )
    rollback-on-disable: optional(string)
    use-off-peak-window: boolean
  })
)

automated-snapshot-pause-options

optional(object) 
optional(
  object({
    enabled: boolean
    start-time: optional(string)
    end-time: optional(string)
  })
)

cluster-config

optional(object) 
optional(
  object({
    cold-storage-options: optional(
      object({
        enabled: optional(boolean)
      })
    )
    dedicated-master-count: optional(integer)
    dedicated-master-enabled: boolean
    dedicated-master-type: optional(string)
    instance-count: integer
    instance-type: string
    multi-az-with-standby-enabled: optional(boolean)
    node-options: optional(
      list(
        object({
          node-config: optional(
            object({
              count: optional(integer)
              enabled: optional(boolean)
              type: optional(string)
            })
          )
          node-type: string
        })
      )
    )
    warm-count: integer
    warm-enabled: optional(boolean)
    warm-type: optional(string)
    zone-awareness-config: optional(
      object({
        availability-zone-count: integer
      })
    )
    zone-awareness-enabled: optional(boolean)
  })
)

cognito-options

optional(object) 
optional(
  object({
    enabled: boolean
    identity-pool-id: string
    role-arn: string
    user-pool-id: string
  })
)

deployment-strategy-options

optional(object) 
optional(
  object({
    deployment-strategy: string
  })
)

domain-endpoint-options

optional(object) 
optional(
  object({
    custom-endpoint: optional(string)
    custom-endpoint-certificate-arn: optional(string)
    custom-endpoint-enabled: boolean
    enforce-https: boolean
    tls-security-policy: optional(string)
  })
)

ebs-options

optional(object) 
optional(
  object({
    ebs-enabled: boolean
    iops: optional(integer)
    throughput: optional(integer)
    volume-size: optional(integer)
    volume-type: optional(string)
  })
)

encrypt-at-rest

optional(object) 
optional(
  object({
    enabled: boolean
    kms-key-id: optional(string)
  })
)

engine-version

optional(string)

identity-center-options

optional(object) 
optional(
  object({
    enabled-api-access: optional(boolean)
    identity-center-instance-arn: optional(string)
    roles-key: optional(string)
    subject-key: optional(string)
  })
)

ip-address-type

optional(string)

log-publishing-options

optional(list(object)) 
optional(
  list(
    object({
      cloudwatch-log-group-arn: string
      enabled: optional(boolean)
      log-type: string
    })
  )
)

node-to-node-encryption

optional(object) 
optional(
  object({
    enabled: boolean
  })
)

off-peak-window-options

optional(object) 
optional(
  object({
    enabled: optional(boolean)
    off-peak-window: optional(
      object({
        window-start-time: optional(
          object({
            hours: integer
            minutes: integer
          })
        )
      })
    )
  })
)

snapshot-options

optional(object) 
optional(
  object({
    automated-snapshot-start-hour: integer
  })
)

software-update-options

optional(object) 
optional(
  object({
    auto-software-update-enabled: boolean
  })
)

tags

optional(map(string))

vpc-options

optional(object) 
optional(
  object({
    egress-enabled: optional(boolean)
    security-group-ids: optional(list(string))
    subnet-ids: optional(list(string))
  })
)

Input Constraints

Ip address type rules

ip-address-type must be ipv4 or dualstack.

Rule logic
When
input.ip-address-type != null
Require
input.ip-address-type == 'ipv4'
|| input.ip-address-type == 'dualstack'

Deployment strategy options rules

deployment-strategy must be Default or CapacityOptimized.

Rule logic
When
input.deployment-strategy-options != null
Require
input.deployment-strategy-options.deployment-strategy == 'Default'
|| input.deployment-strategy-options.deployment-strategy == 'CapacityOptimized'

Domain endpoint options rules

tls-security-policy must be a supported OpenSearch policy.

Rule logic
When
input.domain-endpoint-options.tls-security-policy != null
Require
input.domain-endpoint-options.tls-security-policy == 'Policy-Min-TLS-1-0-2019-07'
|| input.domain-endpoint-options.tls-security-policy == 'Policy-Min-TLS-1-2-2019-07'
|| input.domain-endpoint-options.tls-security-policy == 'Policy-Min-TLS-1-2-PFS-2023-10'
|| input.domain-endpoint-options.tls-security-policy == 'Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08'

Snapshot options rules

automated-snapshot-start-hour must be between 0 and 23.

Rule logic
When
input.snapshot-options != null
Require
(input.snapshot-options.automated-snapshot-start-hour == null || input.snapshot-options.automated-snapshot-start-hour >= 0)
&& (input.snapshot-options.automated-snapshot-start-hour == null || input.snapshot-options.automated-snapshot-start-hour <= 23)

Advanced security options rules

session-timeout-minutes must be between 1 and 1440.

Rule logic
When
input.advanced-security-options.saml-options != null
Require
(input.advanced-security-options.saml-options.session-timeout-minutes == null || input.advanced-security-options.saml-options.session-timeout-minutes >= 1)
&& (input.advanced-security-options.saml-options.session-timeout-minutes == null || input.advanced-security-options.saml-options.session-timeout-minutes <= 1440)

enabled JWT requires jwks-url or public-key.

Rule logic
When
input.advanced-security-options.jwt-options.enabled == true
Require
input.advanced-security-options.jwt-options.jwks-url != null
|| input.advanced-security-options.jwt-options.public-key != null

enabled SAML requires idp.

Rule logic
When
input.advanced-security-options.saml-options.enabled == true
Require
input.advanced-security-options.saml-options.idp != null

Auto tune options rules

auto-tune desired-state must be ENABLED or DISABLED.

Rule logic
When
input.auto-tune-options != null
Require
input.auto-tune-options.desired-state == 'ENABLED'
|| input.auto-tune-options.desired-state == 'DISABLED'

rollback-on-disable must be NO_ROLLBACK or DEFAULT_ROLLBACK.

Rule logic
When
input.auto-tune-options.rollback-on-disable != null
Require
input.auto-tune-options.rollback-on-disable == 'NO_ROLLBACK'
|| input.auto-tune-options.rollback-on-disable == 'DEFAULT_ROLLBACK'

use-off-peak-window conflicts with maintenance-schedule.

Rule logic
When
input.auto-tune-options.use-off-peak-window == true
Require
input.auto-tune-options.maintenance-schedule == null

auto-tune duration unit must be HOURS.

Rule logic
For each
input.auto-tune-options.maintenance-schedule ?? []
Require
@each.value.duration.unit == 'HOURS'

auto-tune duration value must be greater than zero.

Rule logic
For each
input.auto-tune-options.maintenance-schedule ?? []
Require
@each.value.duration.value > 0

Cluster config rules

dedicated-master-count must be at least 1.

Rule logic
When
input.cluster-config.dedicated-master-count != null
Require
input.cluster-config.dedicated-master-count >= 1

instance-count must be at least 1.

Rule logic
When
input.cluster-config != null
Require
input.cluster-config.instance-count == null
|| input.cluster-config.instance-count >= 1

warm-count must be between 2 and 150.

Rule logic
When
input.cluster-config.warm-enabled != null
Require
(input.cluster-config.warm-count == null || input.cluster-config.warm-count >= 2)
&& (input.cluster-config.warm-count == null || input.cluster-config.warm-count <= 150)

warm-type must be a supported UltraWarm instance type.

Rule logic
When
input.cluster-config.warm-type != null
Require
input.cluster-config.warm-type == 'ultrawarm1.medium.search'
|| input.cluster-config.warm-type == 'ultrawarm1.large.search'
|| input.cluster-config.warm-type == 'ultrawarm1.xlarge.search'

availability-zone-count must be 2 or 3.

Rule logic
When
input.cluster-config.zone-awareness-config != null
Require
input.cluster-config.zone-awareness-config.availability-zone-count == 2
|| input.cluster-config.zone-awareness-config.availability-zone-count == 3

node-type must be coordinator.

Rule logic
For each
input.cluster-config.node-options ?? []
Require
@each.value.node-type == 'coordinator'

node count must be at least 1.

Rule logic
For each
input.cluster-config.node-options ?? []
When
@each.value.node-config.count != null
Require
@each.value.node-config.count >= 1

Ebs options rules

volume-type must be standard, gp2, io1, or gp3.

Rule logic
When
input.ebs-options.volume-type != null
Require
input.ebs-options.volume-type == 'standard'
|| input.ebs-options.volume-type == 'gp2'
|| input.ebs-options.volume-type == 'io1'
|| input.ebs-options.volume-type == 'gp3'

iops requires volume-type io1 or gp3.

Rule logic
When
input.ebs-options.iops != null
Require
input.ebs-options.volume-type == 'io1'
|| input.ebs-options.volume-type == 'gp3'

throughput requires gp3 and must be at least 125.

Rule logic
When
input.ebs-options.throughput != null
Require
input.ebs-options.volume-type == 'gp3'
&& input.ebs-options.throughput >= 125

volume-size must be at least 1.

Rule logic
When
input.ebs-options.volume-size != null
Require
input.ebs-options.volume-size >= 1

Log publishing options rules

log-type must be a supported OpenSearch log type.

Rule logic
For each
input.log-publishing-options ?? []
Require
@each.value.log-type == 'INDEX_SLOW_LOGS'
|| @each.value.log-type == 'SEARCH_SLOW_LOGS'
|| @each.value.log-type == 'ES_APPLICATION_LOGS'
|| @each.value.log-type == 'AUDIT_LOGS'

Outputs

domain-name

string

domain-id

string

arn

string

engine-version

string

ip-address-type

string

endpoint

optional(string)

endpoint-v2

optional(string)

endpoints

optional(map(string))

dashboard-endpoint

optional(string)

dashboard-endpoint-v2

optional(string)

domain-endpoint-v2-hosted-zone-id

optional(string)

created

boolean

deleted

boolean

processing

boolean

upgrade-processing

boolean

vpc-options

optional(object) 
optional(
  object({
    availability-zones: list(string)
    egress-enabled: optional(boolean)
    security-group-ids: list(string)
    subnet-ids: list(string)
    vpc-id: string
  })
)

service-software-options

optional(object) 
optional(
  object({
    automated-update-date: optional(string)
    cancellable: boolean
    current-version: optional(string)
    description: optional(string)
    new-version: optional(string)
    optional-deployment: boolean
    update-available: boolean
    update-status: string
  })
)

anonymous-auth-disable-date

optional(string)

identity-center-application-arn

optional(string)

identity-store-id

optional(string)

automated-snapshot-pause-options

optional(object) 
optional(
  object({
    enabled: boolean
    state: string
    start-time: optional(string)
    end-time: optional(string)
  })
)