strange error related to the service-linked role

[FlorinAndrei]

I am using your module to create an OpenSearch cluster in AWS. I am actually invoking it from Terragrunt (as opposed to directly with OpenTofu).

Here's a gist with all the relevant code:

https://gist.github.com/FlorinAndrei/ab8a208b0444aabc188f3d47924f0935

I got this error when trying to create the cluster:

Before you can proceed, you must enable a service-linked role to give Amazon ES permissions to access your VPC.

I checked the roles, and I noticed that your module had created this role in IAM: AWSServiceRoleForAmazonOpenSearchService. However, that was not enough to quench the error - it created the role but failed to create the cluster.

I saw in the complete example in this repo that you must run this command first:

aws iam create-service-linked-role --aws-service-name es.amazonaws.com

However, that command creates a role called AWSServiceRoleForAmazonElasticsearchService. But I am not creating an ElasticSearch cluster - I am creating an OpenSearch cluster.

The Terraform documentation clearly states:

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain

The AWS-managed service-linked role for OpenSearch is called AWSServiceRoleForAmazonOpenSearchService instead of AWSServiceRoleForAmazonElasticsearchService for Elasticsearch.

There is a contradiction somewhere. Your module creates the OpenSearch role, but fails to create the OpenSearch cluster and complains about the role. It only succeeds to create the cluster if I manually create an ElasticSearch role.

Where is the conflict / mistake / etc?

[FlorinAndrei]

I wonder if it's a provider issue.

https://github.com/hashicorp/terraform-provider-aws/issues/28433

But I have not modified the domain_endpoint_options var.

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

[github-actions[bot]]

This issue was automatically closed because of stale in 10 days