OpenSearch Addons template

[huanjani]

Thank you, @coopsmoss!! 🙇🏼
#3006 (comment)

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  # Security group to add OS to the VPC,
  # and to allow the Fargate containers to talk to OS
  OpenSearchSecurityGroup:
    Metadata:
      'aws:copilot:description': 'A security group to access OS'
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub 'The Security Group for ${Name} to access OpenSearch.'
      VpcId:
        'Fn::ImportValue':
          !Sub '${App}-${Env}-VpcId'
      Tags:
        - Key: Name
          Value: !Sub 'copilot-${App}-${Env}-${Name}-OpenSearch-SecurityGroup'

  # Enable ingress from other ECS services created within the environment.
  OpenSearchIngress:
    Metadata:
      'aws:copilot:description': 'Allow ingress from containers in my application to the OpenSearch cluster'
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress Security Group from Fargate containers
      GroupId: !Ref 'OpenSearchSecurityGroup'
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      SourceSecurityGroupId: { 'Fn::ImportValue': !Sub '${App}-${Env}-EnvironmentSecurityGroup' }
  # The cluster itself.
  OpenSearchDomain:
    Type: 'AWS::OpenSearchService::Domain'
    Properties:
      AccessPolicies:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS: '*'
          Action:
          - 'es:ESHttp*'
          Resource: !Sub 'arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/opensearch-${Env}/*'
      DomainName: !Sub opensearch-${Env}
      EngineVersion: 'OpenSearch_1.1'
      EBSOptions:
        EBSEnabled: true
        VolumeSize: 10
        VolumeType: gp2
      ClusterConfig:
        DedicatedMasterEnabled: false
        InstanceCount: 2
        InstanceType: c6g.large.search # probably overkill
      VPCOptions:
        SecurityGroupIds:
        - !Ref OpenSearchSecurityGroup
        SubnetIds:
          - !Select [0, !Split [ ',', { 'Fn::ImportValue': !Sub '${App}-${Env}-PrivateSubnets' } ] ]
      Tags:
        - Key: Name
          Value: !Sub 'copilot-${App}-${Env}-${Name}-OpenSearch-Domain'
  OpenSearchEndpointAddressParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/copilot/${App}/${Env}/secrets/OPENSEARCH_ENDPOINT"
      Type: String
      Value: !GetAtt OpenSearchDomain.DomainEndpoint
Outputs:
  OpenSearchSecurityGroup:
    Description: Security group for OpenSearch
    Value: !Ref OpenSearchSecurityGroup

And then in your manifest.yml you can do this (assuming your environments are 'test' and 'prod'):

variables:
  OPENSEARCH_PORT: "80"

environments:
  prod:
    secrets: # these correspond to the property in the addon
      OPENSEARCH_ENDPOINT: /copilot/api/prod/secrets/OPENSEARCH_ENDPOINT
  test:
    secrets:
      OPENSEARCH_ENDPOINT: /copilot/api/test/secrets/OPENSEARCH_ENDPOINT

[thomaswitt]

I wanted to use this template, but on Env level, so that its not tied to a service. It took my hours and hours to find out the correct syntax. FInally I found out that (after finding #4754) addons parameters have to be defined. Thanks AWS team for wasting hours because of your insufficient documentation which makes you crawling through every issue.

Here's the correct configuration, in my case for a 1 machine clusters for test reasons. You need a addons.parameters.yml

# addons.parameters.yml

Parameters:
  EnvironmentSecurityGroup: !Ref EnvironmentSecurityGroup
  PrivateSubnets: !Join [",", [!Ref PrivateSubnet1, !Ref PrivateSubnet2]]
  ServiceDiscoveryNamespace: !Ref ServiceDiscoveryNamespace
  VpcId: !Ref VPC

And here is the correct addon. If you use multiple machine clusters, you need to change the subnetids section

# copilot/environments/addons/opensearch.yml
#
#  Prerequisite (once per account/region):
#    aws iam create-service-linked-role \
#         --aws-service-name opensearchservice.amazonaws.com
#
#  Check before going into production (and change subnet ids)
#  https://docs.aws.amazon.com/opensearch-service/latest/developerguide/bp.html

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The name of the environment being deployed.
  VpcId:
    Type: String
    Description: The ID of the VPC in which to create the OpenSearch cluster.
    Default: ""
  PrivateSubnets:
    Type: String
    Description: The IDs of the private subnets 1 for single node cluster.
  EnvironmentSecurityGroup:
    Type: String
    Description: The default environment security group.
  ServiceDiscoveryNamespace:
    Type: String
    Description: A private DNS namespace for discovering services within the environment.

Resources:
  OpenSearchSecurityGroup:
    Metadata:
      "aws:copilot:description": "Security group for OpenSearch domain"
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub "The Security Group for ${App} to access OpenSearch."
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: !Sub "copilot-${App}-${Env}-OpenSearch-SecurityGroup"

  OpenSearchIngress:
    Metadata:
      "aws:copilot:description": "Allow Copilot tasks to reach OpenSearch :80"
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress from Copilot tasks
      GroupId: !Ref OpenSearchSecurityGroup
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      SourceSecurityGroupId: !Ref EnvironmentSecurityGroup

  OpenSearchLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete # So everything remains self-contained
    Properties:
      RetentionInDays: 30
      # LogGroupName: !Sub "/copilot/${App}/${Env}/opensearch/logs"

  OpenSearchDomain:
    Metadata:
      "aws:copilot:description": "Single-node OpenSearch domain (dev/test)"
    Type: AWS::OpenSearchService::Domain
    DeletionPolicy: Delete
    UpdateReplacePolicy: Retain # avoid accidental reprovisioning
    UpdatePolicy:
      EnableVersionUpgrade: true
    Properties:
      DomainName: !Sub "opensearch-${App}-${Env}"
      EngineVersion: OpenSearch_2.19

      ClusterConfig:
        InstanceType: t3.small.search
        InstanceCount: 1
        DedicatedMasterEnabled: false
        ZoneAwarenessEnabled: false

      EBSOptions:
        EBSEnabled: true
        VolumeSize: 20
        VolumeType: gp2

      VPCOptions:
        SecurityGroupIds: [!Ref OpenSearchSecurityGroup]
        SubnetIds:
          - !Select [0, !Split [",", !Ref PrivateSubnets]]
          # - !Select [1, !Split [",", !Ref PrivateSubnets]]
          # - !Select [2, !Split [",", !Ref PrivateSubnets]]

      EncryptionAtRestOptions:
        Enabled: false
      NodeToNodeEncryptionOptions:
        Enabled: false
      DomainEndpointOptions:
        EnforceHTTPS: false # set true in prod
        # TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07"
      AdvancedSecurityOptions:
        Enabled: false
        InternalUserDatabaseEnabled: false
        # MasterUserOptions:
        #   MasterUserName: admin
        #   MasterUserPassword: !Ref "OpenSearchMasterUserPassword"

      LogPublishingOptions:
        ES_APPLICATION_LOGS:
          CloudWatchLogsLogGroupArn: !GetAtt OpenSearchLogGroup.Arn
          Enabled: true
        INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: !GetAtt OpenSearchLogGroup.Arn
          Enabled: true
        SEARCH_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: !GetAtt OpenSearchLogGroup.Arn
          Enabled: true

      AccessPolicies:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowAllInsideVPC # tighten for production!
            Effect: Allow
            Principal: "*"
            Action: "es:ESHttp*"
            Resource: !Sub "arn:${AWS::Partition}:es:${AWS::Region}:${AWS::AccountId}:domain/opensearch-${App}-${Env}/*"

      Tags:
        - Key: Name
          Value: !Sub "copilot-${App}-${Env}-opensearch"

  OSLogGroupPolicy:
    Type: AWS::Logs::ResourcePolicy
    DependsOn: OpenSearchLogGroup
    Properties:
      PolicyName: !Sub "AllowOpenSearch-${App}-${Env}"
      PolicyDocument: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "OpenSearchToCloudWatchLogs",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "opensearchservice.amazonaws.com",
                  "es.amazonaws.com"
                ]
              },
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:PutLogEventsBatch",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams"
              ],
              "Resource": [
                "${OpenSearchLogGroup.Arn}:*",
                "${OpenSearchLogGroup.Arn}/*"
              ]
            }
          ]
        }

  ## Important parameter set for Rails App ###############################################
  OpenSearchEndpointParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/copilot/${App}/${Env}/secrets/OPENSEARCH_ENDPOINT"
      Type: String
      Value: !GetAtt OpenSearchDomain.DomainEndpoint

  ## Optional IAM policy for tasks ###########################################
  OpenSearchDomainAccessPolicy:
    Metadata:
      "aws:copilot:description": "Attach to a task-role for ES HTTP access"
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: !Sub "es:ESHttp* on opensearch-${App}-${Env}"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: ESHttpActions
            Effect: Allow
            Action:
              - es:ESHttpDelete
              - es:ESHttpGet
              - es:ESHttpHead
              - es:ESHttpPatch
              - es:ESHttpPost
              - es:ESHttpPut
            Resource: !Sub "arn:${AWS::Partition}:es:${AWS::Region}:${AWS::AccountId}:domain/opensearch-${App}-${Env}/*"

Outputs:
  OpenSearchDomainArn:
    Description: OpenSearch domain ARN
    Value: !GetAtt OpenSearchDomain.Arn
    Export:
      Name: !Sub "${App}-${Env}-OpenSearchDomainArn"

  OpenSearchDomainEndpoint:
    Description: HTTP/HTTPS endpoint
    Value: !GetAtt OpenSearchDomain.DomainEndpoint
    Export:
      Name: !Sub "${App}-${Env}-OpenSearchDomainEndpoint"

  OpenSearchSecurityGroup:
    Description: Security-group ID
    Value: !Ref OpenSearchSecurityGroup

  OpenSearchDomainAccessPolicyArn:
    Description: Managed-policy ARN
    Value: !Ref OpenSearchDomainAccessPolicy