From f2882f7498e0007e92321df4eaed580dfe3d6051 Mon Sep 17 00:00:00 2001 From: Bruno Ferreira Date: Sun, 5 Mar 2023 01:07:35 +0000 Subject: [PATCH 1/3] parameterize access policies json for more flexibility --- elasticsearch_domain.tf | 4 ++-- variables.tf | 9 +++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/elasticsearch_domain.tf b/elasticsearch_domain.tf index 2d3071e..9c4cc7f 100644 --- a/elasticsearch_domain.tf +++ b/elasticsearch_domain.tf @@ -3,9 +3,9 @@ # resource "aws_elasticsearch_domain_policy" "default" { - count = local.elasticsearch_enabled && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0) ? 1 : 0 + count = local.elasticsearch_enabled && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0 || length(var.access_policies) > 0) ? 1 : 0 domain_name = module.this.id - access_policies = join("", data.aws_iam_policy_document.default[*].json) + access_policies = coalesce(var.access_policies, join("", data.aws_iam_policy_document.default[*].json)) } resource "aws_elasticsearch_domain" "default" { diff --git a/variables.tf b/variables.tf index 805bf70..c70f5ee 100644 --- a/variables.tf +++ b/variables.tf @@ -448,3 +448,12 @@ variable "auto_tune" { } } +variable "access_policies" { + description = "JSON string for the IAM policy document specifying the access policies for the domain." + type = string + default = "" + validation { + condition = var.access_policies == "" || try(jsondecode(var.access_policies), null) != null + error_message = "The access_policies JSON string is not valid." + } +} From ba2a27bee0c47c65075f3abc64c2d567d1e740f9 Mon Sep 17 00:00:00 2001 From: cloudpossebot <11232728+cloudpossebot@users.noreply.github.com> Date: Sun, 5 Mar 2023 01:11:56 +0000 Subject: [PATCH 2/3] Auto Format --- README.md | 1 + docs/terraform.md | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index c3cb285..4ff9ef9 100644 --- a/README.md +++ b/README.md @@ -167,6 +167,7 @@ Available targets: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [access\_policies](#input\_access\_policies) | JSON string for the IAM policy document specifying the access policies for the domain. | `string` | `""` | no | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | | [advanced\_options](#input\_advanced\_options) | Key-value string pairs to specify advanced configuration options | `map(string)` | `{}` | no | | [advanced\_security\_options\_enabled](#input\_advanced\_security\_options\_enabled) | AWS Elasticsearch Kibana enchanced security plugin enabling (forces new resource) | `bool` | `false` | no | diff --git a/docs/terraform.md b/docs/terraform.md index 57ea59c..bb1b841 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -43,6 +43,7 @@ | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [access\_policies](#input\_access\_policies) | JSON string for the IAM policy document specifying the access policies for the domain. | `string` | `""` | no | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | | [advanced\_options](#input\_advanced\_options) | Key-value string pairs to specify advanced configuration options | `map(string)` | `{}` | no | | [advanced\_security\_options\_enabled](#input\_advanced\_security\_options\_enabled) | AWS Elasticsearch Kibana enchanced security plugin enabling (forces new resource) | `bool` | `false` | no | From 2d39018e6b5a9398af1b3eb99f9d03cec349f719 Mon Sep 17 00:00:00 2001 From: Igor Rodionov Date: Thu, 14 Aug 2025 17:54:31 +0200 Subject: [PATCH 3/3] Pull changes from bmbferreira/terraform-aws-elasticsearch/tree/master --- elasticsearch_domain.tf | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/elasticsearch_domain.tf b/elasticsearch_domain.tf index 7b823a7..da318a4 100644 --- a/elasticsearch_domain.tf +++ b/elasticsearch_domain.tf @@ -3,15 +3,9 @@ # resource "aws_elasticsearch_domain_policy" "default" { -<<<<<<< HEAD - count = local.elasticsearch_enabled && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0) ? 1 : 0 - domain_name = length(var.elasticsearch_domain_name) > 0 ? var.elasticsearch_domain_name : module.this.id - access_policies = join("", data.aws_iam_policy_document.default[*].json) -======= count = local.elasticsearch_enabled && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0 || length(var.access_policies) > 0) ? 1 : 0 - domain_name = module.this.id + domain_name = length(var.elasticsearch_domain_name) > 0 ? var.elasticsearch_domain_name : module.this.id access_policies = coalesce(var.access_policies, join("", data.aws_iam_policy_document.default[*].json)) ->>>>>>> 97f52e5ac8369f5e75495fa72a2ce89db6cebccd } resource "aws_elasticsearch_domain" "default" {