如何从 kibana 中的所有 ip 创建完全访问权限并创建登录名和密码以使用 terraform 登录 cab

Question

我正在使用 terraform 创建测试 elasticsearch aws，我无法从所有 IP 地址授予完全访问权限 + 如何自动添加用户名和密码以登录 kibana？我在 github 上阅读了手册，但我不明白该怎么做请帮助我

resource "aws_elasticsearch_domain" "es" {
  domain_name           = var.domain
  elasticsearch_version = var.version_elasticsearch

  cluster_config {
    instance_type = var.instance_type
  }
  snapshot_options {
    automated_snapshot_start_hour = var.automated_snapshot_start_hour
  }
  ebs_options {
    ebs_enabled = var.ebs_volume_size > 0 ? true : false
    volume_size = var.ebs_volume_size
    volume_type = var.volume_type
  }

  tags = {
    Domain = var.tag_domain
  }
}

resource "aws_iam_service_linked_role" "es" {
  aws_service_name = "es.amazonaws.com"
  description      = "Allows Amazon ES to manage AWS resources for a domain on your behalf."
}


resource "aws_elasticsearch_domain_policy" "main" {
  domain_name     = aws_elasticsearch_domain.es.domain_name
  access_policies = <<POLICIES
  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "*"
          ]
        }
      },
      "Resource": "${aws_elasticsearch_domain.es.arn}/*""
    }
  ]
}
POLICIES
}

Answer 1

AWS Opensearch 的访问控制记录在 https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html and the kind of access you are looking to achieve is called 'fine-grained-access-control' which is explained in detail at https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html。

我知道这个 terraform 资源没有很好的文档来解释这些不同的访问类型，这就是为什么我要共享您的代码的修改版本以使您的任务继续执行您缺少代码的其他参数。

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

variable "master_user_password" {
  type    = string
}

# Elasticsearch domain
resource "aws_elasticsearch_domain" "es_example" {
  domain_name           = "example-domain"
  elasticsearch_version = "OpenSearch_1.0"

  cluster_config {
    instance_type = "t3.small.elasticsearch"
  }

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "gp2"
  }

  encrypt_at_rest {
    enabled = true
  }

  node_to_node_encryption {
    enabled = true
  }

  # This is required for using advanced security options
  domain_endpoint_options {
    enforce_https       = true
    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
  }

  # Authentication
  advanced_security_options {
    enabled                        = true
    internal_user_database_enabled = true
    master_user_options {
      master_user_name     = "es-admin"
      master_user_password = var.master_user_password
      # You can also use IAM role/user ARN
      # master_user_arn = var.es_master_user_arn
    }
  }

  tags = {
    Domain = "es_example"
  }
}

resource "aws_elasticsearch_domain_policy" "main" {
  domain_name     = aws_elasticsearch_domain.es_example.domain_name
  access_policies = <<POLICIES
  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "${aws_elasticsearch_domain.es_example.arn}/*"
    }
  ]
}
POLICIES
}

此代码对我有用，我能够从我的浏览器访问 OpenSearch Dashboard，并且能够使用我在 terraform 代码中指定的凭据登录。

如何从 kibana 中的所有 ip 创建完全访问权限并创建登录名和密码以使用 terraform 登录 cab

How to create full access from all ip in kibana and create a login and password to log in to the cab using terraform

amazon-web-services

terraform

terraform-provider-aws

amazon-elasticsearch