Manage OpenSearch REST resources from AWS CDK.
Project description
Custom Resources Library for Amazon OpenSearch Service
An AWS CDK construct library to manage OpenSearch resources via CloudFormation custom resource. This is especially useful if you use fine-grained access control feature on OpenSearch, where you have to create resources such as role or role mapping via OpenSearch REST API.
Currently supported resources
You can manage any other REST resources via our low level API (ResourceBase
class).
Usage
Instal it via npm:
npm install opensearch-rest-resources
Then you can create OpenSearch resources using Domain
construct.
import { IVpc } from 'aws-cdk-lib/aws-ec2';
import { IRole } from 'aws-cdk-lib/aws-iam';
import { Domain } from 'aws-cdk-lib/aws-opensearchservice';
import { OpenSearchRole, OpenSearchRoleMapping } from 'opensearch-rest-resources';
declare const vpc: IVpc;
declare const backendRole: IRole;
declare const domain: Domain;
const role = new OpenSearchRole(this, 'Role1', {
vpc,
domain,
roleName: 'Role1',
payload: {
clusterPermissions: ['indices:data/write/bulk'],
indexPermissions: [
{
indexPatterns: ['*'],
allowedActions: ['read', 'write', 'index', 'create_index'],
},
],
}
});
const roleMapping = new OpenSearchRoleMapping(this, 'RoleMapping1', {
vpc,
domain,
roleName: 'Role1',
payload: {
backendRoles: [backendRole.roleArn],
},
removalPolicy: RemovalPolicy.RETAIN,
});
roleMapping.node.addDependency(role);
Limitation
Currently this library assumes your OpenSearch domain is configured as:
- Fine-grained access control is enabled
- Deployed within a VPC
- Use the
Domain
L2 construct - The credential for the master user (username and password) is stored in Secret Manager
- Domain access policy is permissive enough like below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:ESHttp*",
"Resource": "domain-arn/*"
}
]
}
Most of the above follow the current operational best practices of Amazon OpenSearch Service. If you want other configuration supported, please submit an issue.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for opensearch-rest-resources-0.0.6.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 121cd0ec8014896ca4d62a57b1032659358fe98b886665b283c730f07f8c0e12 |
|
MD5 | 359a8f2d19c32c01f39f2fdb57aa5a60 |
|
BLAKE2b-256 | 6fec6e8f1867fbade41841aa5f34506d9dea70181896aee1beb72bc00431886d |
Hashes for opensearch_rest_resources-0.0.6-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | c8c680ff588214576b79cfc4a5c9fb411c36185cb60fd87f767f970e722643a8 |
|
MD5 | 4b6a19e9b75a6a382ccf9ce2d828a40b |
|
BLAKE2b-256 | 3c8142239750936a1d222e22652766e8af9df979d4ca0edd07eae5e5bdf80cc3 |