Skip to content

Commit a1126cc

Browse files
bryantbiggsbryantbiggs
committed
chore: Stash
1 parent 7050620 commit a1126cc

File tree

5 files changed

+122
-78
lines changed

5 files changed

+122
-78
lines changed

‎modules/serverless/README.md‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ No modules.
3939

4040
| Name | Type |
4141
|------|------|
42+
| [aws_opensearchserverless_access_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_access_policy) | resource |
4243
| [aws_opensearchserverless_collection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_collection) | resource |
4344
| [aws_opensearchserverless_security_policy.encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy) | resource |
4445
| [aws_opensearchserverless_security_policy.network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy) | resource |
@@ -47,17 +48,21 @@ No modules.
4748

4849
| Name | Description | Type | Default | Required |
4950
|------|-------------|------|---------|:--------:|
51+
| <a name="input_access_policy"></a> [access\_policy](#input\_access\_policy) | access policy to apply to the collection | `any` | `{}` | no |
52+
| <a name="input_access_policy_description"></a> [access\_policy\_description](#input\_access\_policy\_description) | Description of the access policy | `string` | `null` | no |
53+
| <a name="input_access_policy_name"></a> [access\_policy\_name](#input\_access\_policy\_name) | Name of the access policy | `string` | `null` | no |
5054
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
55+
| <a name="input_create_access_policy"></a> [create\_access\_policy](#input\_create\_access\_policy) | Determines whether an access policy will be created | `bool` | `true` | no |
5156
| <a name="input_create_encryption_policy"></a> [create\_encryption\_policy](#input\_create\_encryption\_policy) | Determines whether an encryption policy will be created | `bool` | `true` | no |
5257
| <a name="input_create_network_policy"></a> [create\_network\_policy](#input\_create\_network\_policy) | Determines whether an network policy will be created | `bool` | `true` | no |
5358
| <a name="input_description"></a> [description](#input\_description) | Description of the collection | `string` | `null` | no |
54-
| <a name="input_encryption_security_policy"></a> [encryption\_security\_policy](#input\_encryption\_security\_policy) | Encryption security policy to apply to the collection - this is merged with the default policy provided | `any` | `{}` | no |
55-
| <a name="input_encryption_security_policy_description"></a> [encryption\_security\_policy\_description](#input\_encryption\_security\_policy\_description) | Description of the encryption security policy | `string` | `null` | no |
56-
| <a name="input_encryption_security_policy_name"></a> [encryption\_security\_policy\_name](#input\_encryption\_security\_policy\_name) | Name of the encryption security policy | `string` | `null` | no |
59+
| <a name="input_encryption_policy"></a> [encryption\_policy](#input\_encryption\_policy) | Encryption policy to apply to the collection | `any` | `{}` | no |
60+
| <a name="input_encryption_policy_description"></a> [encryption\_policy\_description](#input\_encryption\_policy\_description) | Description of the encryption policy | `string` | `null` | no |
61+
| <a name="input_encryption_policy_name"></a> [encryption\_policy\_name](#input\_encryption\_policy\_name) | Name of the encryption policy | `string` | `null` | no |
5762
| <a name="input_name"></a> [name](#input\_name) | Name of the collection | `string` | `""` | no |
58-
| <a name="input_network_security_policy"></a> [network\_security\_policy](#input\_network\_security\_policy) | Network security policy to apply to the collection - this is merged with the default policy provided | `any` | `{}` | no |
59-
| <a name="input_network_security_policy_description"></a> [network\_security\_policy\_description](#input\_network\_security\_policy\_description) | Description of the network security policy | `string` | `null` | no |
60-
| <a name="input_network_security_policy_name"></a> [network\_security\_policy\_name](#input\_network\_security\_policy\_name) | Name of the network security policy | `string` | `null` | no |
63+
| <a name="input_network_policy"></a> [network\_policy](#input\_network\_policy) | Network policy to apply to the collection | `any` | `{}` | no |
64+
| <a name="input_network_policy_description"></a> [network\_policy\_description](#input\_network\_policy\_description) | Description of the network policy | `string` | `null` | no |
65+
| <a name="input_network_policy_name"></a> [network\_policy\_name](#input\_network\_policy\_name) | Name of the network policy | `string` | `null` | no |
6166
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
6267
| <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | Create and delete timeout configurations for the collection | `map(string)` | `{}` | no |
6368
| <a name="input_type"></a> [type](#input\_type) | Type of collection. One of `SEARCH`, `TIMESERIES`, or `VECTORSEARCH`. Defaults to `TIMESERIES` | `string` | `null` | no |
@@ -66,15 +71,17 @@ No modules.
6671

6772
| Name | Description |
6873
|------|-------------|
74+
| <a name="output_access_policy"></a> [access\_policy](#output\_access\_policy) | The JSON policy document of the access policy |
75+
| <a name="output_access_policy_version"></a> [access\_policy\_version](#output\_access\_policy\_version) | The version of the access policy |
6976
| <a name="output_arn"></a> [arn](#output\_arn) | Amazon Resource Name (ARN) of the collection |
7077
| <a name="output_dashboard_endpoint"></a> [dashboard\_endpoint](#output\_dashboard\_endpoint) | Collection-specific endpoint used to access OpenSearch Dashboards |
71-
| <a name="output_encryption_security_policy"></a> [encryption\_security\_policy](#output\_encryption\_security\_policy) | The JSON policy document of the security policy |
72-
| <a name="output_encryption_security_policy_version"></a> [encryption\_security\_policy\_version](#output\_encryption\_security\_policy\_version) | The version of the security policy |
78+
| <a name="output_encryption_policy"></a> [encryption\_policy](#output\_encryption\_policy) | The JSON policy document of the encryption policy |
79+
| <a name="output_encryption_policy_version"></a> [encryption\_policy\_version](#output\_encryption\_policy\_version) | The version of the encryption policy |
7380
| <a name="output_endpoint"></a> [endpoint](#output\_endpoint) | Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection |
7481
| <a name="output_id"></a> [id](#output\_id) | Unique identifier for the collection |
7582
| <a name="output_kms_key_arn"></a> [kms\_key\_arn](#output\_kms\_key\_arn) | The ARN of the Amazon Web Services KMS key used to encrypt the collection |
76-
| <a name="output_network_security_policy"></a> [network\_security\_policy](#output\_network\_security\_policy) | The JSON policy document of the security policy |
77-
| <a name="output_network_security_policy_version"></a> [network\_security\_policy\_version](#output\_network\_security\_policy\_version) | The version of the security policy |
83+
| <a name="output_network_policy"></a> [network\_policy](#output\_network\_policy) | The JSON policy document of the network policy |
84+
| <a name="output_network_policy_version"></a> [network\_policy\_version](#output\_network\_policy\_version) | The version of the network policy |
7885
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7986

8087
## License

‎modules/serverless/main.tf‎

Lines changed: 21 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -32,21 +32,10 @@ resource "aws_opensearchserverless_collection" "this" {
3232
resource "aws_opensearchserverless_security_policy" "encryption" {
3333
count = var.create && var.create_encryption_policy ? 1 : 0
3434

35-
description = coalesce(var.encryption_security_policy_description, "Encryption policy for ${var.name} collection")
36-
name = coalesce(var.encryption_security_policy_name, "${var.name}-encryption")
37-
policy = jsonencode(merge(
38-
{
39-
Rules = [
40-
{
41-
Resource = ["collection/${var.name}"]
42-
ResourceType = "collection"
43-
}
44-
]
45-
AWSOwnedKey = true
46-
},
47-
var.encryption_security_policy
48-
))
49-
type = "encryption"
35+
description = coalesce(var.encryption_policy_description, "Encryption policy for ${var.name} collection")
36+
name = coalesce(var.encryption_policy_name, "${var.name}-encryption")
37+
policy = var.encryption_policy
38+
type = "encryption"
5039
}
5140

5241
################################################################################
@@ -56,19 +45,21 @@ resource "aws_opensearchserverless_security_policy" "encryption" {
5645
resource "aws_opensearchserverless_security_policy" "network" {
5746
count = var.create && var.create_network_policy ? 1 : 0
5847

59-
description = coalesce(var.network_security_policy_description, "Newtwork policy for ${var.name} collection")
60-
name = coalesce(var.network_security_policy_name, "${var.name}-network")
61-
policy = jsonencode(merge(
62-
{
63-
Rules = [
64-
{
65-
Resource = ["collection/${var.name}"]
66-
ResourceType = "collection"
67-
}
68-
]
69-
AllowFromPublic = true
70-
},
71-
var.network_security_policy
72-
))
73-
type = "network"
48+
description = coalesce(var.network_policy_description, "Newtwork policy for ${var.name} collection")
49+
name = coalesce(var.network_policy_name, "${var.name}-network")
50+
policy = var.network_policy
51+
type = "network"
52+
}
53+
54+
################################################################################
55+
# Access Policy
56+
################################################################################
57+
58+
resource "aws_opensearchserverless_access_policy" "this" {
59+
count = var.create && var.create_access_policy ? 1 : 0
60+
61+
description = coalesce(var.access_policy_description, "Access policy for ${var.name} collection")
62+
name = coalesce(var.access_policy_name, "${var.name}-access")
63+
policy = var.access_policy
64+
type = "data"
7465
}

‎modules/serverless/outputs.tf‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,29 +28,43 @@ output "id" {
2828
}
2929

3030
################################################################################
31-
# Security Policy - Encryption
31+
# Encryption Policy
3232
################################################################################
3333

34-
output "encryption_security_policy_version" {
35-
description = "The version of the security policy"
34+
output "encryption_policy_version" {
35+
description = "The version of the encryption policy"
3636
value = try(aws_opensearchserverless_security_policy.encryption[0].policy_version, null)
3737
}
3838

39-
output "encryption_security_policy" {
40-
description = "The JSON policy document of the security policy"
39+
output "encryption_policy" {
40+
description = "The JSON policy document of the encryption policy"
4141
value = try(aws_opensearchserverless_security_policy.encryption[0].policy, null)
4242
}
4343

4444
################################################################################
45-
# Security Policy - Network
45+
# Network Policy
4646
################################################################################
4747

48-
output "network_security_policy_version" {
49-
description = "The version of the security policy"
48+
output "network_policy_version" {
49+
description = "The version of the network policy"
5050
value = try(aws_opensearchserverless_security_policy.network[0].policy_version, null)
5151
}
5252

53-
output "network_security_policy" {
54-
description = "The JSON policy document of the security policy"
53+
output "network_policy" {
54+
description = "The JSON policy document of the network policy"
5555
value = try(aws_opensearchserverless_security_policy.network[0].policy, null)
5656
}
57+
58+
################################################################################
59+
# Access Policy
60+
################################################################################
61+
62+
output "access_policy_version" {
63+
description = "The version of the access policy"
64+
value = try(aws_opensearchserverless_access_policy.this[0].policy_version, null)
65+
}
66+
67+
output "access_policy" {
68+
description = "The JSON policy document of the access policy"
69+
value = try(aws_opensearchserverless_access_policy.this[0].policy, null)
70+
}

‎modules/serverless/variables.tf‎

Lines changed: 42 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ variable "timeouts" {
3939
}
4040

4141
################################################################################
42-
# Security Policy - Encryption
42+
# Encryption Policy
4343
################################################################################
4444

4545
variable "create_encryption_policy" {
@@ -48,26 +48,26 @@ variable "create_encryption_policy" {
4848
default = true
4949
}
5050

51-
variable "encryption_security_policy_description" {
52-
description = "Description of the encryption security policy"
51+
variable "encryption_policy_description" {
52+
description = "Description of the encryption policy"
5353
type = string
5454
default = null
5555
}
5656

57-
variable "encryption_security_policy_name" {
58-
description = "Name of the encryption security policy"
57+
variable "encryption_policy_name" {
58+
description = "Name of the encryption policy"
5959
type = string
6060
default = null
6161
}
6262

63-
variable "encryption_security_policy" {
64-
description = "Encryption security policy to apply to the collection - this is merged with the default policy provided"
63+
variable "encryption_policy" {
64+
description = "Encryption policy to apply to the collection"
6565
type = any
6666
default = {}
6767
}
6868

6969
################################################################################
70-
# Security Policy - Network
70+
# Network Policy
7171
################################################################################
7272

7373
variable "create_network_policy" {
@@ -76,20 +76,48 @@ variable "create_network_policy" {
7676
default = true
7777
}
7878

79-
variable "network_security_policy_description" {
80-
description = "Description of the network security policy"
79+
variable "network_policy_description" {
80+
description = "Description of the network policy"
8181
type = string
8282
default = null
8383
}
8484

85-
variable "network_security_policy_name" {
86-
description = "Name of the network security policy"
85+
variable "network_policy_name" {
86+
description = "Name of the network policy"
8787
type = string
8888
default = null
8989
}
9090

91-
variable "network_security_policy" {
92-
description = "Network security policy to apply to the collection - this is merged with the default policy provided"
91+
variable "network_policy" {
92+
description = "Network policy to apply to the collection"
93+
type = any
94+
default = {}
95+
}
96+
97+
################################################################################
98+
# Access Policy
99+
################################################################################
100+
101+
variable "create_access_policy" {
102+
description = "Determines whether an access policy will be created"
103+
type = bool
104+
default = true
105+
}
106+
107+
variable "access_policy_description" {
108+
description = "Description of the access policy"
109+
type = string
110+
default = null
111+
}
112+
113+
variable "access_policy_name" {
114+
description = "Name of the access policy"
115+
type = string
116+
default = null
117+
}
118+
119+
variable "access_policy" {
120+
description = "access policy to apply to the collection"
93121
type = any
94122
default = {}
95123
}

‎wrappers/serverless/main.tf‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,22 @@ module "wrapper" {
33

44
for_each = var.items
55

6-
create = try(each.value.create, var.defaults.create, true)
7-
create_encryption_policy = try(each.value.create_encryption_policy, var.defaults.create_encryption_policy, true)
8-
create_network_policy = try(each.value.create_network_policy, var.defaults.create_network_policy, true)
9-
description = try(each.value.description, var.defaults.description, null)
10-
encryption_security_policy = try(each.value.encryption_security_policy, var.defaults.encryption_security_policy, {})
11-
encryption_security_policy_description = try(each.value.encryption_security_policy_description, var.defaults.encryption_security_policy_description, null)
12-
encryption_security_policy_name = try(each.value.encryption_security_policy_name, var.defaults.encryption_security_policy_name, null)
13-
name = try(each.value.name, var.defaults.name, "")
14-
network_security_policy = try(each.value.network_security_policy, var.defaults.network_security_policy, {})
15-
network_security_policy_description = try(each.value.network_security_policy_description, var.defaults.network_security_policy_description, null)
16-
network_security_policy_name = try(each.value.network_security_policy_name, var.defaults.network_security_policy_name, null)
17-
tags = try(each.value.tags, var.defaults.tags, {})
18-
timeouts = try(each.value.timeouts, var.defaults.timeouts, {})
19-
type = try(each.value.type, var.defaults.type, null)
6+
access_policy = try(each.value.access_policy, var.defaults.access_policy, {})
7+
access_policy_description = try(each.value.access_policy_description, var.defaults.access_policy_description, null)
8+
access_policy_name = try(each.value.access_policy_name, var.defaults.access_policy_name, null)
9+
create = try(each.value.create, var.defaults.create, true)
10+
create_access_policy = try(each.value.create_access_policy, var.defaults.create_access_policy, true)
11+
create_encryption_policy = try(each.value.create_encryption_policy, var.defaults.create_encryption_policy, true)
12+
create_network_policy = try(each.value.create_network_policy, var.defaults.create_network_policy, true)
13+
description = try(each.value.description, var.defaults.description, null)
14+
encryption_policy = try(each.value.encryption_policy, var.defaults.encryption_policy, {})
15+
encryption_policy_description = try(each.value.encryption_policy_description, var.defaults.encryption_policy_description, null)
16+
encryption_policy_name = try(each.value.encryption_policy_name, var.defaults.encryption_policy_name, null)
17+
name = try(each.value.name, var.defaults.name, "")
18+
network_policy = try(each.value.network_policy, var.defaults.network_policy, {})
19+
network_policy_description = try(each.value.network_policy_description, var.defaults.network_policy_description, null)
20+
network_policy_name = try(each.value.network_policy_name, var.defaults.network_policy_name, null)
21+
tags = try(each.value.tags, var.defaults.tags, {})
22+
timeouts = try(each.value.timeouts, var.defaults.timeouts, {})
23+
type = try(each.value.type, var.defaults.type, null)
2024
}

0 commit comments

Comments
 (0)