resource/aws_elasticsearch_domain DomainEndpointOptions

aws/resource_aws_elasticsearch_domain.go

@@ -86,6 +86,10 @@ func resourceAwsElasticSearchDomain() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"require_https": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
 			"endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -361,6 +365,12 @@ func resourceAwsElasticSearchDomainCreate(d *schema.ResourceData, meta interface
 		input.AdvancedOptions = stringMapToPointers(v.(map[string]interface{}))
 	}
 
+	if d.Get("require_https").(bool) {
+		input.SetDomainEndpointOptions(&elasticsearch.DomainEndpointOptions{
+			EnforceHTTPS: aws.Bool(true),
+		})
+	}
+
 	if v, ok := d.GetOk("ebs_options"); ok {
 		options := v.([]interface{})
 
@@ -642,6 +652,10 @@ func resourceAwsElasticSearchDomainRead(d *schema.ResourceData, meta interface{}
 		d.Set("log_publishing_options", m)
 	}
 
+	if *ds.DomainEndpointOptions.EnforceHTTPS {
+		d.Set("require_https", true)
+	}
+
 	d.Set("arn", ds.ARN)
 
 	listOut, err := conn.ListTags(&elasticsearch.ListTagsInput{
@@ -684,6 +698,12 @@ func resourceAwsElasticSearchDomainUpdate(d *schema.ResourceData, meta interface
 		input.AdvancedOptions = stringMapToPointers(d.Get("advanced_options").(map[string]interface{}))
 	}
 
+	if d.HasChange("require_https") {
+		input.SetDomainEndpointOptions(&elasticsearch.DomainEndpointOptions{
+			EnforceHTTPS: aws.Bool(d.Get("require_https").(bool)),
+		})
+	}
+
 	if d.HasChange("ebs_options") || d.HasChange("cluster_config") {
 		options := d.Get("ebs_options").([]interface{})
 

aws/resource_aws_elasticsearch_domain_test.go

@@ -87,6 +87,30 @@ func TestAccAWSElasticSearchDomain_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSElasticSearchDomain_RequireHTTPS(t *testing.T) {
+	var domain elasticsearch.ElasticsearchDomainStatus
+	ri := acctest.RandInt()
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckESDomainDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccESDomainConfig_RequireHTTPS(ri),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckESDomainExists("aws_elasticsearch_domain.example", &domain),
+					resource.TestCheckResourceAttr(
+						"aws_elasticsearch_domain.example", "elasticsearch_version", "1.5"),
+					resource.TestMatchResourceAttr("aws_elasticsearch_domain.example", "kibana_endpoint", regexp.MustCompile(".*es.amazonaws.com/_plugin/kibana/")),
+					resource.TestCheckResourceAttr(
+						"aws_elasticsearch_domain.example", "require_https", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSElasticSearchDomain_ClusterConfig_ZoneAwarenessConfig(t *testing.T) {
 	var domain1, domain2, domain3, domain4 elasticsearch.ElasticsearchDomainStatus
 	rName := acctest.RandomWithPrefix("tf-acc-test")[:28]
@@ -976,6 +1000,21 @@ resource "aws_elasticsearch_domain" "test" {
 `, randInt)
 }
 
+func testAccESDomainConfig_RequireHTTPS(randInt int) string {
+	return fmt.Sprintf(`
+resource "aws_elasticsearch_domain" "example" {
+  domain_name = "tf-test-%d"
+
+	require_https = true
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+}
+`, randInt)
+}
+
 func testAccESDomainConfig_ClusterConfig_ZoneAwarenessConfig_AvailabilityZoneCount(rName string, availabilityZoneCount int) string {
 	return fmt.Sprintf(`
 resource "aws_elasticsearch_domain" "test" {

website/docs/r/elasticsearch_domain.html.markdown

@@ -224,6 +224,7 @@ The following arguments are supported:
 * `vpc_options` - (Optional) VPC related options, see below. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-vpc-limitations)).
 * `log_publishing_options` - (Optional) Options for publishing slow logs to CloudWatch Logs.
 * `elasticsearch_version` - (Optional) The version of Elasticsearch to deploy. Defaults to `1.5`
+* `require_https` - (Optional) Whether the Elasticsearch domain requires HTTPS to connect
 * `tags` - (Optional) A mapping of tags to assign to the resource
 
 **ebs_options** supports the following attributes: