search

terraform-community-modules / tf_aws_elasticsearch

[DEPRECATED] Use https://github.com/terraform-aws-modules/terraform-aws-opensearch
MIT License
79 stars 97 forks source link

Need to change the ES domain policy #25

Closed max-rocket-internet closed 5 years ago

max-rocket-internet commented 5 years ago

I am using the module within a VPC and am not able to apply a IAM access policy. This is because of the count variable here: https://github.com/terraform-community-modules/tf_aws_elasticsearch/blob/master/main_vpc.tf#L75-L76

So as I understand it there's only 2 options:

I would say it's better to let the user to just choose all the options including the policy rather than force to choose between these limited options.

A simple example is to allow a Kinesis stream to send data to ES, here's the policy: https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-es

max-rocket-internet commented 5 years ago

Actually, I'll close this.

I think if we allow setting the domain policy and VPC settings together then there's not much point in using the module, it's easier to just define the aws_elasticsearch_domain without the module.