Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(elasticsearch): L2 for ElasticsearchDomain #8369

Merged
merged 46 commits into from
Sep 30, 2020
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
46 commits
Select commit Hold shift + click to select a range
6a27aef
feat(elasticsearch): Add l2 cdk construct for Elasticsearch domain
Jun 4, 2020
7e6ff04
Add Elasticsearch Domain details to README
Jun 22, 2020
f4e84ee
Address PR feedback
stephanh Jul 9, 2020
30b9922
Add grant helper methods
Jul 19, 2020
da6ad9f
abstract out DomainBase; fromXXX members on Domain
adamdottv Jul 25, 2020
96b442f
update stability banner
adamdottv Jul 29, 2020
37e6776
initial tests
adamdottv Jul 30, 2020
f562e67
better grant methods
adamdottv Jul 30, 2020
ebc698b
more input validation
adamdottv Jul 30, 2020
01ff057
minimum instead of maximum nodes metric
adamdottv Aug 1, 2020
2eacb11
remove key read/write permissions
adamdottv Aug 1, 2020
5c8ae51
function declaration tweaks
adamdottv Aug 1, 2020
c889745
replace else if statements
adamdottv Aug 1, 2020
944a71f
remove faulty validation around snapshots
adamdottv Aug 1, 2020
454bb60
fix isEveryInstanceType logic
adamdottv Aug 1, 2020
4bd1899
address some review feedback
adamdottv Aug 1, 2020
7fceefa
elasticsearchVersion as a number
adamdottv Aug 1, 2020
6bb5bbf
Elasticsearch version as string with existing versions as constants
Aug 2, 2020
1b13c02
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
c4ec269
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
e0a61ad
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
9eb08a0
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
a9233da
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
6e13852
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
d4dd65d
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Aug 17, 2020
f2229c4
fix renamed prop references; builds successfully
adamdottv Aug 17, 2020
78e85ac
version renaming
adamdottv Aug 17, 2020
9e158cd
add ElasticsearchVersion 7.7
adamdottv Aug 17, 2020
efe6b6c
`ClusterConfig` -> capacity and zone awareness
adamdottv Aug 17, 2020
8924139
zone awareness validation
adamdottv Aug 17, 2020
aae1e3c
fix availabilityZoneCount validation
adamdottv Aug 17, 2020
0cb92eb
make log groups public
adamdottv Aug 17, 2020
841a358
Update README.md
stephanh Aug 18, 2020
a22e4d4
chore: more review feedback (#3)
adamdottv Aug 26, 2020
d24d533
fix build
adamdottv Aug 26, 2020
d99d2d3
create a PolicyDocument, not a Policy
adamdottv Aug 27, 2020
daa2b47
Updates integration test references
Aug 31, 2020
ec6dcef
Update packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
stephanh Sep 1, 2020
bd41e22
Addresses PR feedback
Sep 1, 2020
e7ad061
Enable unsigned basic auth
Sep 19, 2020
7119981
Use fromSdkCalls for log-group-resources-policy
Sep 30, 2020
7505d7f
Address PR feedback
Sep 30, 2020
ccf2eda
Remove empty code block
iliapolo Sep 30, 2020
26f2e8d
Exclude a few terminal non friendly characters in password generation…
iliapolo Sep 30, 2020
de0143a
Update expectation with new password generation property
iliapolo Sep 30, 2020
acf0089
Merge branch 'master' into elasticsearch
mergify[bot] Sep 30, 2020
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
155 changes: 153 additions & 2 deletions packages/@aws-cdk/aws-elasticsearch/README.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,163 @@
## Amazon Elasticsearch Service Construct Library

<!--BEGIN STABILITY BANNER-->
---

![cfn-resources: Stable](https://img.shields.io/badge/cfn--resources-stable-success.svg?style=for-the-badge)
| Features | Stability |
| --- | --- |
| CFN Resources | ![Stable](https://img.shields.io/badge/stable-success.svg?style=for-the-badge) |
| Higher level constructs for Domain | ![Experimental](https://img.shields.io/badge/experimental-important.svg?style=for-the-badge) |

> **CFN Resources:** All classes with the `Cfn` prefix in this module ([CFN Resources](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) are always stable and safe to use.

> All classes with the `Cfn` prefix in this module ([CFN Resources](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) are always stable and safe to use.
> **Experimental:** Higher level constructs in this module that are marked as experimental are under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---
<!--END STABILITY BANNER-->

Create a development cluster by simply specifying the version:

```ts
import * as es from '@aws-cdk/aws-elasticsearch';

const devDomain = new es.Domain(this, 'Domain', {
version: es.ElasticsearchVersion.V7_1,
});
```

Create a production grade cluster by also specifying things like capacity and az distribution

```ts
const prodDomain = new es.Domain(this, 'Domain', {
version: es.ElasticsearchVersion.V7_1,
capacity: {
masterNodes: 5,
dataNodes: 20
},
ebs: {
volumeSize: 20
},
zoneAwareness: {
availabilityZoneCount: 3
},
logging: {
slowSearchLogEnabled: true,
appLogEnabled: true,
slowIndexLogEnabled: true,
},
});
```

This creates an Elasticsearch cluster and automatically sets up log groups for
logging the domain logs and slow search logs.

stephanh marked this conversation as resolved.
Show resolved Hide resolved
### Importing existing domains

To import an existing domain into your CDK application, use the `Domain.fromDomainEndpoint` factory method.
This method accepts a domain endpoint of an already existing domain:

```ts
const domainEndpoint = 'https://my-domain-jcjotrt6f7otem4sqcwbch3c4u.us-east-1.es.amazonaws.com';
const domain = Domain.fromDomainEndpoint(this, 'ImportedDomain', domainEndpoint);
```

### Permissions

#### IAM

Helper methods also exist for managing access to the domain.

```ts
const lambda = new lambda.Function(this, 'Lambda', { /* ... */ });

// Grant write access to the app-search index
domain.grantIndexWrite('app-search', lambda);

// Grant read access to the 'app-search/_search' path
domain.grantPathRead('app-search/_search', lambda);
```

### Encryption

The domain can also be created with encryption enabled:

```ts
const domain = new es.Domain(this, 'Domain', {
version: es.ElasticsearchVersion.V7_4,
ebs: {
volumeSize: 100,
volumeType: EbsDeviceVolumeType.GENERAL_PURPOSE_SSD,
},
nodeToNodeEncryption: true,
encryptionAtRest: {
enabled: true,
},
});
```

This sets up the domain with node to node encryption and encryption at
rest. You can also choose to supply your own KMS key to use for encryption at
rest.

### Metrics

Helper methods exist to access common domain metrics for example:

```ts
const freeStorageSpace = domain.metricFreeStorageSpace();
const masterSysMemoryUtilization = domain.metric('MasterSysMemoryUtilization');
```

This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.

### Fine grained access control

The domain can also be created with a master user configured. The password can
be supplied or dynamically created if not supplied.

```ts
const domain = new es.Domain(this, 'Domain', {
version: es.ElasticsearchVersion.V7_1,
enforceHttps: true,
nodeToNodeEncryption: true,
encryptionAtRest: {
enabled: true,
},
fineGrainedAccessControl: {
masterUserName: 'master-user',
},
});

const masterUserPassword = domain.masterUserPassword;
```

### Using unsigned basic auth

For convenience, the domain can be configured to allow unsigned HTTP requests
that use basic auth. Unless the domain is configured to be part of a VPC this
means anyone can access the domain using the configured master username and
password.

To enable unsigned basic auth access the domain is configured with an access
policy that allows anyonmous requests, HTTPS required, node to node encryption,
encryption at rest and fine grained access control.

If the above settings are not set they will be configured as part of enabling
unsigned basic auth. If they are set with conflicting values, an error will be
thrown.

If no master user is configured a default master user is created with the
username `admin`.

If no password is configured a default master user password is created and
stored in the AWS Secrets Manager as secret. The secret has the prefix
`<domain id>MasterUser`.

```ts
const domain = new es.Domain(this, 'Domain', {
version: es.ElasticsearchVersion.V7_1,
useUnsignedBasicAuth: true,
});

const masterUserPassword = domain.masterUserPassword;
stephanh marked this conversation as resolved.
Show resolved Hide resolved
```
Loading