基于 Amazon OpenSearch 的 Apache Solr 的迁移方案设计及实现

  resource "random_password" "admin" {
  length = 16
}

resource "aws_security_group" "security_group" {
  name        = "opensearch-mydomain-sg"
  description = "Managed by Terraform"
  vpc_id      = data.aws_vpc.opensearch_vpc.id

  ingress {
    from_port = 443
    to_port   = 443
    protocol  = "tcp"

    cidr_blocks = [
      data.aws_vpc.opensearch_vpc.cidr_block,
    ]
  }
}
resource "aws_iam_service_linked_role" "opensearch_service_link_role" {
  aws_service_name = "opensearchservice.amazon.com"
}

resource "aws_cloudwatch_log_group" "log_groups" {
  for_each = local.log_groups
  name     = format("/aws/OpenSearch/mydomain/%s", each.key)
}


resource "aws_cloudwatch_log_resource_policy" "opensearch_log_policy" {
  policy_name = "opensearch_log_policy"

  policy_document = <<CONFIG
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "es.amazonaws.com"
      },
      "Action": [
        "logs:PutLogEvents",
        "logs:PutLogEventsBatch",
        "logs:CreateLogStream"
      ],
      "Resource": "arn:aws:logs:*"
    }
  ]
}
CONFIG
}

resource "aws_opensearch_domain" "opensearch" {
  domain_name    = "mydomain"
  engine_version = "OpenSearch_1.3"
  cluster_config {
    dedicated_master_enabled = true
    dedicated_master_count   = 3
    dedicated_master_type    = "m5.large.search"

    instance_count = 3
    instance_type  = "m5.large.search"
  }

  vpc_options {
    subnet_ids         = [data.aws_subnets.subnets.ids[0], data.aws_subnets.subnets.ids[1]]
    security_group_ids = [aws_security_group.security_group.id]
  }

  access_policies = <<CONFIG
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "es:*",
            "Principal": "*",
            "Effect": "Allow",
            "Resource": "arn:aws:es:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:domain/mydomain/*"
        }
    ]
}
CONFIG

  advanced_security_options {
    enabled                        = true
    internal_user_database_enabled = true
    master_user_options {
      master_user_name     = "admin"
      master_user_password = random_password.admin.result
    }
  }

  encrypt_at_rest {
    enabled = true
  }

  node_to_node_encryption {
    enabled = true
  }

  domain_endpoint_options {
    enforce_https = true
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.log_groups["index_slow_logs"].arn
    log_type                 = "INDEX_SLOW_LOGS"
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.log_groups["search_slow_logs"].arn
    log_type                 = "SEARCH_SLOW_LOGS"
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.log_groups["application_logs"].arn
    log_type                 = "ES_APPLICATION_LOGS"
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.log_groups["audit_logs"].arn
    log_type                 = "AUDIT_LOGS"
  }

  snapshot_options {
    automated_snapshot_start_hour = 24
  }

  ebs_options {
    ebs_enabled = true
    volume_size = 100
    volume_type = "gp3"
  }

  depends_on = [
    aws_iam_service_linked_role.opensearch_service_link_role
  ]
}

resource "aws_secretsmanager_secret" "opensearch_admin" {
  name = "opensearch_admin"
}

resource "aws_secretsmanager_secret_version" "secret_version" {
  secret_id = aws_secretsmanager_secret.opensearch_admin.id
  secret_string = jsonencode({
    "domain" : aws_opensearch_domain.opensearch.domain_name,
    "user" : "admin",
    "password" : random_password.admin.result,
    "endpoint" : aws_opensearch_domain.opensearch.endpoint
  })

  lifecycle {
    ignore_changes = [secret_string]
  }
}

 terraform {
  backend "s3" {
    bucket = "terraform-opensearch"
    key    = "opensearch/terraform.tfstate"
    region = "ap-southeast-1"
  }
}

locals {
  log_groups = {
    "index_slow_logs"  = "index_slow_logs"
    "search_slow_logs" = "search_slow_logs"
    "application_logs" = "application_logs"
    "audit_logs"       = "audit_logs"
  }
}

data "aws_region" "current" {}

data "aws_caller_identity" "current" {}

data "aws_vpc" "opensearch_vpc" {
  filter {
    name   = "tag:Name"
    values = ["opensearch"]
  }
}

data "aws_subnets" "subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.opensearch_vpc.id]
  }
}

output "openseach_endpoint" {
  description = "opensearch endpoint"
  value       = aws_opensearch_domain.opensearch.endpoint
}