Try SpotterCreates OpenSearch or ElasticSearch domain
| "added in version" 4.0.0 of community.aws"
Authors: Sebastien Rosset (@sebastien-rosset)
Install with ansible-galaxy collection install community.aws:==5.1.0
collections:
- name: community.aws
version: 5.1.0Creates or modify a Amazon OpenSearch Service domain.
- name: Create OpenSearch domain for dev environment, no zone awareness, no dedicated masters
community.aws.opensearch:
domain_name: "dev-cluster"
engine_version: Elasticsearch_1.1
cluster_config:
instance_type: "t2.small.search"
instance_count: 2
zone_awareness: false
dedicated_master: false
ebs_options:
ebs_enabled: true
volume_type: "gp2"
volume_size: 10
access_policies: "{{ lookup('file', 'policy.json') | from_json }}"
- name: Create OpenSearch domain with dedicated masters
community.aws.opensearch:
domain_name: "my-domain"
engine_version: OpenSearch_1.1
cluster_config:
instance_type: "t2.small.search"
instance_count: 12
dedicated_master: true
zone_awareness: true
availability_zone_count: 2
dedicated_master_instance_type: "t2.small.search"
dedicated_master_instance_count: 3
warm_enabled: true
warm_type: "ultrawarm1.medium.search"
warm_count: 1
cold_storage_options:
enabled: false
ebs_options:
ebs_enabled: true
volume_type: "io1"
volume_size: 10
iops: 1000
vpc_options:
subnets:
- "subnet-e537d64a"
- "subnet-e537d64b"
security_groups:
- "sg-dd2f13cb"
- "sg-dd2f13cc"
snapshot_options:
automated_snapshot_start_hour: 13
access_policies: "{{ lookup('file', 'policy.json') | from_json }}"
encryption_at_rest_options:
enabled: false
node_to_node_encryption_options:
enabled: false
auto_tune_options:
enabled: true
maintenance_schedules:
- start_at: "2025-01-12"
duration:
value: 1
unit: "HOURS"
cron_expression_for_recurrence: "cron(0 12 * * ? *)"
- start_at: "2032-01-12"
duration:
value: 2
unit: "HOURS"
cron_expression_for_recurrence: "cron(0 12 * * ? *)"
tags:
Environment: Development
Application: Search
wait: true
- name: Increase size of EBS volumes for existing cluster
community.aws.opensearch:
domain_name: "my-domain"
ebs_options:
volume_size: 5
wait: true
- name: Increase instance count for existing cluster
community.aws.opensearch:
domain_name: "my-domain"
cluster_config:
instance_count: 40
wait: true
tags:
aliases:
- resource_tags
description:
- A dictionary representing the tags to be applied to the resource.
- If the I(tags) parameter is not set then tags will not be modified.
required: false
type: dict
wait:
default: false
description:
- Whether or not to wait for completion of OpenSearch creation, modification or deletion.
type: bool
state:
choices:
- present
- absent
default: present
description:
- Creates or modifies an existing OpenSearch domain.
- Deletes an OpenSearch domain.
required: false
type: str
region:
aliases:
- aws_region
- ec2_region
description:
- The AWS region to use.
- For global services such as IAM, Route53 and CloudFront, I(region) is ignored.
- The C(AWS_REGION) or C(EC2_REGION) environment variables may also be used.
- See the Amazon AWS documentation for more information U(http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region).
- The C(ec2_region) alias has been deprecated and will be removed in a release after
2024-12-01
- Support for the C(EC2_REGION) environment variable has been deprecated and will
be removed in a release after 2024-12-01.
type: str
profile:
aliases:
- aws_profile
description:
- A named AWS profile to use for authentication.
- See the AWS documentation for more information about named profiles U(https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html).
- The C(AWS_PROFILE) environment variable may also be used.
- The I(profile) option is mutually exclusive with the I(aws_access_key), I(aws_secret_key)
and I(security_token) options.
type: str
access_key:
aliases:
- aws_access_key_id
- aws_access_key
- ec2_access_key
description:
- AWS access key ID.
- See the AWS documentation for more information about access tokens U(https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).
- The C(AWS_ACCESS_KEY_ID), C(AWS_ACCESS_KEY) or C(EC2_ACCESS_KEY) environment variables
may also be used in decreasing order of preference.
- The I(aws_access_key) and I(profile) options are mutually exclusive.
- The I(aws_access_key_id) alias was added in release 5.1.0 for consistency with the
AWS botocore SDK.
- The I(ec2_access_key) alias has been deprecated and will be removed in a release
after 2024-12-01.
- Support for the C(EC2_ACCESS_KEY) environment variable has been deprecated and will
be removed in a release after 2024-12-01.
type: str
aws_config:
description:
- A dictionary to modify the botocore configuration.
- Parameters can be found in the AWS documentation U(https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html#botocore.config.Config).
type: dict
purge_tags:
default: true
description:
- If I(purge_tags=true) and I(tags) is set, existing tags will be purged from the
resource to match exactly what is defined by I(tags) parameter.
- If the I(tags) parameter is not set then tags will not be modified, even if I(purge_tags=True).
- Tag keys beginning with C(aws:) are reserved by Amazon and can not be modified. As
such they will be ignored for the purposes of the I(purge_tags) parameter. See
the Amazon documentation for more information U(https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html#tag-conventions).
required: false
type: bool
secret_key:
aliases:
- aws_secret_access_key
- aws_secret_key
- ec2_secret_key
description:
- AWS secret access key.
- See the AWS documentation for more information about access tokens U(https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).
- The C(AWS_SECRET_ACCESS_KEY), C(AWS_SECRET_KEY), or C(EC2_SECRET_KEY) environment
variables may also be used in decreasing order of preference.
- The I(secret_key) and I(profile) options are mutually exclusive.
- The I(aws_secret_access_key) alias was added in release 5.1.0 for consistency with
the AWS botocore SDK.
- The I(ec2_secret_key) alias has been deprecated and will be removed in a release
after 2024-12-01.
- Support for the C(EC2_SECRET_KEY) environment variable has been deprecated and will
be removed in a release after 2024-12-01.
type: str
domain_name:
description:
- The name of the Amazon OpenSearch/ElasticSearch Service domain.
- Domain names are unique across the domains owned by an account within an AWS region.
required: true
type: str
ebs_options:
description:
- Parameters to configure EBS-based storage for an OpenSearch Service domain.
suboptions:
ebs_enabled:
description:
- Specifies whether EBS-based storage is enabled.
required: false
type: bool
iops:
description:
- The IOPD for a Provisioned IOPS EBS volume (SSD).
required: false
type: int
volume_size:
description:
- Integer to specify the size of an EBS volume.
required: false
type: int
volume_type:
description:
- Specifies the volume type for EBS-based storage. "standard"|"gp2"|"io1"
required: false
type: str
type: dict
vpc_options:
description:
- Options to specify the subnets and security groups for a VPC endpoint.
suboptions:
security_groups:
description:
- Specifies the security group ids for VPC endpoint.
elements: str
required: false
type: list
subnets:
description:
- Specifies the subnet ids for VPC endpoint.
elements: str
required: false
type: list
type: dict
endpoint_url:
aliases:
- ec2_url
- aws_endpoint_url
- s3_url
description:
- URL to connect to instead of the default AWS endpoints. While this can be used
to connection to other AWS-compatible services the amazon.aws and community.aws
collections are only tested against AWS.
- The C(AWS_URL) or C(EC2_URL) environment variables may also be used, in decreasing
order of preference.
- The I(ec2_url) and I(s3_url) aliases have been deprecated and will be removed in
a release after 2024-12-01.
- Support for the C(EC2_URL) environment variable has been deprecated and will be
removed in a release after 2024-12-01.
type: str
wait_timeout:
default: 300
description:
- how long before wait gives up, in seconds.
type: int
aws_ca_bundle:
description:
- The location of a CA Bundle to use when validating SSL certificates.
- The C(AWS_CA_BUNDLE) environment variable may also be used.
type: path
session_token:
aliases:
- aws_session_token
- security_token
- aws_security_token
- access_token
description:
- AWS STS session token for use with temporary credentials.
- See the AWS documentation for more information about access tokens U(https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).
- The C(AWS_SESSION_TOKEN), C(AWS_SECURITY_TOKEN) or C(EC2_SECURITY_TOKEN) environment
variables may also be used in decreasing order of preference.
- The I(security_token) and I(profile) options are mutually exclusive.
- Aliases I(aws_session_token) and I(session_token) were added in release 3.2.0, with
the parameter being renamed from I(security_token) to I(session_token) in release
6.0.0.
- The I(security_token), I(aws_security_token), and I(access_token) aliases have been
deprecated and will be removed in a release after 2024-12-01.
- Support for the C(EC2_SECRET_KEY) and C(AWS_SECURITY_TOKEN) environment variables
has been deprecated and will be removed in a release after 2024-12-01.
type: str
cluster_config:
description:
- Parameters for the cluster configuration of an OpenSearch Service domain.
suboptions:
availability_zone_count:
description:
- 'An integer value to indicate the number of availability zones for a domain
when zone awareness is enabled. This should be equal to number of subnets if
VPC endpoints is enabled.
'
required: false
type: int
cold_storage_options:
description:
- Specifies the ColdStorageOptions config for a Domain.
suboptions:
enabled:
description:
- True to enable cold storage. Supported on Elasticsearch 7.9 or above.
required: false
type: bool
type: dict
dedicated_master:
description:
- A boolean value to indicate whether a dedicated master node is enabled.
required: false
type: bool
dedicated_master_instance_count:
description:
- Total number of dedicated master nodes, active and on standby, for the domain.
required: false
type: int
dedicated_master_instance_type:
description:
- The instance type for a dedicated master node.
required: false
type: str
instance_count:
description:
- Number of instances for the domain.
required: false
type: int
instance_type:
description:
- Type of the instances to use for the domain.
required: false
type: str
warm_count:
description:
- The number of UltraWarm nodes in the domain.
required: false
type: int
warm_enabled:
description:
- True to enable UltraWarm storage.
required: false
type: bool
warm_type:
description:
- The instance type for the OpenSearch domain's warm nodes.
required: false
type: str
zone_awareness:
description:
- A boolean value to indicate whether zone awareness is enabled.
required: false
type: bool
type: dict
engine_version:
description: -> The engine version to use. For example, 'ElasticSearch_7.10' or 'OpenSearch_1.1'.
-> If the currently running version is not equal to I(engine_version), a cluster
upgrade is triggered. -> It may not be possible to upgrade directly from the currently
running version to I(engine_version). In that case, the upgrade is performed incrementally
by upgrading to the highest compatible version, then repeat the operation until
the cluster is running at the target version. -> The upgrade operation fails if
there is no path from current version to I(engine_version). -> See OpenSearch documentation
for upgrade compatibility.
required: false
type: str
validate_certs:
default: true
description:
- When set to C(false), SSL certificates will not be validated for communication with
the AWS APIs.
- Setting I(validate_certs=false) is strongly discouraged, as an alternative, consider
setting I(aws_ca_bundle) instead.
type: bool
access_policies:
description:
- IAM access policy as a JSON-formatted string.
required: false
type: dict
cognito_options:
description:
- Parameters to configure OpenSearch Service to use Amazon Cognito authentication
for OpenSearch Dashboards.
suboptions:
enabled:
description:
- The option to enable Cognito for OpenSearch Dashboards authentication.
required: false
type: bool
identity_pool_id:
description:
- The Cognito identity pool ID for OpenSearch Dashboards authentication.
required: false
type: str
role_arn:
description:
- The role ARN that provides OpenSearch permissions for accessing Cognito resources.
required: false
type: str
user_pool_id:
description:
- The Cognito user pool ID for OpenSearch Dashboards authentication.
required: false
type: str
type: dict
snapshot_options:
description:
- Option to set time, in UTC format, of the daily automated snapshot.
suboptions:
automated_snapshot_start_hour:
description:
- 'Integer value from 0 to 23 specifying when the service takes a daily automated
snapshot of the specified Elasticsearch domain.
'
required: false
type: int
type: dict
auto_tune_options:
description:
- Specifies Auto-Tune options.
suboptions:
desired_state:
choices:
- ENABLED
- DISABLED
description:
- The Auto-Tune desired state. Valid values are ENABLED and DISABLED.
type: str
maintenance_schedules:
description:
- A list of maintenance schedules.
elements: dict
suboptions:
cron_expression_for_recurrence:
description:
- A cron expression for a recurring maintenance schedule.
type: str
duration:
description:
- Specifies maintenance schedule duration, duration value and duration unit.
suboptions:
unit:
choices:
- HOURS
description:
- The unit of a maintenance schedule duration. Valid value is HOURS.
type: str
value:
description:
- Integer to specify the value of a maintenance schedule duration.
type: int
type: dict
start_at:
description:
- The timestamp at which the Auto-Tune maintenance schedule starts.
type: str
type: list
type: dict
domain_endpoint_options:
description:
- Options to specify configuration that will be applied to the domain endpoint.
suboptions:
custom_endpoint:
description:
- The fully qualified domain for your custom endpoint.
type: str
custom_endpoint_certificate_arn:
description:
- The ACM certificate ARN for your custom endpoint.
type: str
custom_endpoint_enabled:
description:
- Whether to enable a custom endpoint for the domain.
type: bool
enforce_https:
description:
- Whether only HTTPS endpoint should be enabled for the domain.
type: bool
tls_security_policy:
description:
- Specify the TLS security policy to apply to the HTTPS endpoint of the domain.
type: str
type: dict
advanced_security_options:
description:
- Specifies advanced security options.
suboptions:
enabled:
description:
- True if advanced security is enabled.
- You must enable node-to-node encryption to use advanced security options.
type: bool
internal_user_database_enabled:
description:
- True if the internal user database is enabled.
type: bool
master_user_options:
description:
- Credentials for the master user, username and password, ARN, or both.
suboptions:
master_user_arn:
description:
- ARN for the master user (if IAM is enabled).
type: str
master_user_name:
description:
- The username of the master user, which is stored in the Amazon OpenSearch
Service domain internal database.
type: str
master_user_password:
description:
- The password of the master user, which is stored in the Amazon OpenSearch
Service domain internal database.
type: str
type: dict
saml_options:
description:
- The SAML application configuration for the domain.
suboptions:
enabled:
description:
- True if SAML is enabled.
- To use SAML authentication, you must enable fine-grained access control.
- You can only enable SAML authentication for OpenSearch Dashboards on existing
domains, not during the creation of new ones.
- Domains only support one Dashboards authentication method at a time. If
you have Amazon Cognito authentication for OpenSearch Dashboards enabled,
you must disable it before you can enable SAML.
type: bool
idp:
description:
- The SAML Identity Provider's information.
suboptions:
entity_id:
description:
- The unique entity ID of the application in SAML identity provider.
type: str
metadata_content:
description:
- The metadata of the SAML application in XML format.
type: str
type: dict
master_backend_role:
description:
- The backend role that the SAML master user is mapped to.
type: str
master_user_name:
description:
- The SAML master username, which is stored in the Amazon OpenSearch Service
domain internal database.
type: str
roles_key:
description:
- Element of the SAML assertion to use for backend roles. Default is roles.
type: str
session_timeout_minutes:
description:
- The duration, in minutes, after which a user session becomes inactive. Acceptable
values are between 1 and 1440, and the default value is 60.
type: int
subject_key:
description:
- Element of the SAML assertion to use for username. Default is NameID.
type: str
type: dict
type: dict
encryption_at_rest_options:
description:
- Parameters to enable encryption at rest.
suboptions:
enabled:
description:
- Should data be encrypted while at rest.
required: false
type: bool
kms_key_id:
description:
- If encryption at rest enabled, this identifies the encryption key to use.
- The value should be a KMS key ARN. It can also be the KMS key id.
required: false
type: str
type: dict
allow_intermediate_upgrades:
default: true
description:
- 'If true, allow OpenSearch domain to be upgraded through one or more intermediate
versions.
'
- 'If false, do not allow OpenSearch domain to be upgraded through intermediate versions.
The upgrade operation fails if it''s not possible to ugrade to I(engine_version)
directly.
'
required: false
type: bool
debug_botocore_endpoint_logs:
default: false
description:
- Use a C(botocore.endpoint) logger to parse the unique (rather than total) C("resource:action")
API calls made during a task, outputing the set to the resource_actions key in the
task results. Use the C(aws_resource_action) callback to output to total list made
during a playbook.
- The C(ANSIBLE_DEBUG_BOTOCORE_LOGS) environment variable may also be used.
type: bool
node_to_node_encryption_options:
description:
- Node-to-node encryption options.
suboptions:
enabled:
description:
- True to enable node-to-node encryption.
required: false
type: bool
type: dict