Skip to content

Latest commit

 

History

History
94 lines (64 loc) · 3.75 KB

README.md

File metadata and controls

94 lines (64 loc) · 3.75 KB
Raw

Terraform module - AWS Elasticsearch Service Single Node

Example of a minimal Terraform module to deploy an AWS Elasticsearch Service instance with a single node.

Minimal doesn't have to be unsecure 😄

It supports encryption at rest with a custom KMS key and IAM Access Policy that gives access only to your public IP.

This module has been made to provide an example but in a real world scenario, it will be better to run your Elasticsearch instance under a custom VPC with only access from your EC2 instance(s) or AWS services instead of facing to Internet. Kibana can be available thru a NGINX reverse-proxy in this case, to expose the 443 port.

Includes

  • Create an AWS Elasticsearch Service instance (managed by AWS)
  • Encryption with a KMS CMK (let you manage the usage of the KMS key)
  • Accessible only from your public IP
  • Under a custom VPC (minimal-vpc module) or default VPC (minimal module)

Usage

Input

Name Description Type Default Required
my_public_ip Your public IP String Yes
aws_region The AWS region where you want to deploy your Elasticsearch instance String us-east-1 No
domain_name Elasticsearch cluster name String elasticsearch-single-node No
elasticsearch_version Elasticsearch version String 6.3 No
instance_type Elasticsearch instance type (t2 family doesn't support encryption at rest) String m4.large.elasticsearch No
volume_size Elasticsearch volume size String 10 No
tags Default tags you want to add Map Terraform=true No

Output

Name Description Type
elasticsearch_endpoint Elasticsearch public endpoint String
elasticsearch_kibana_endpoint Elasticsearch Kibana public endpoint String

Examples

Under the default VPC

module "es-single-node" {
  source = "github.com/timoa/terraform-elasticsearch-single-node/minimal"

  # Your public IP to secure your Elasticsearch instance (required)
  my_public_ip    = "1.2.3.4"

  # AWS Region where you want to deploy your Elasticsearch single node
  aws_region      = "eu-west-2"

}

Under a new custom VPC

module "es-single-node" {
  source = "github.com/timoa/terraform-elasticsearch-single-node/minimal-vpc"

  # Your public IP to secure your Elasticsearch instance (required)
  my_public_ip    = "1.2.3.4"

  # AWS Region where you want to deploy your Elasticsearch single node
  aws_region      = "eu-west-2"

}

Improvements

This Terraform module can also be improved by adding this changes:

  • Support for multiple environments (distinct name and tags between environment)
  • Support for Route 53 (by adding an alias to an existing Route 53 zone)

References

Security/Compliance

Cloud Conformity

Description Risk level Link
Elasticsearch Domain open to Internet High Elasticsearch Domain IP-Based Access
Elasticsearch Domain without encryption at rest High Enable AWS ElasticSearch Encryption At Rest
Elasticsearch Domain encryption with AWS managed-keys High Elasticsearch Domain Encrypted with KMS CMKs
Elasticsearch Domain outside custom VPC High AWS Elasticsearch Domain In VPC