Using autogenerated password and outputs to SSM

README.md

@@ -87,6 +87,7 @@ Here is a working example of using this Terraform module:
 | Name | Version |
 |------|---------|
 | aws | > 4.0 |
+| random | n/a |
 
 ## Inputs
 
@@ -121,14 +122,15 @@ Here is a working example of using this Terraform module:
 | master\_instance\_type | The type of EC2 instances to run for each master node. A list of available instance types can you find at https://aws.amazon.com/en/opensearch-service/pricing/#On-Demand_instance_pricing | `string` | `"r6gd.large.elasticsearch"` | no |
 | master\_user\_arn | The ARN for the master user of the cluster. If not specified, then it defaults to using the IAM user that is making the request. | `string` | `""` | no |
 | master\_user\_name | enable user auth | `string` | `"test"` | no |
-| master\_user\_password | enable pass auth | `string` | `"test"` | no |
+| master\_user\_password | enable pass auth | `string` | `""` | no |
 | saml\_entity\_id | The unique Entity ID of the application in SAML Identity Provider. | `string` | n/a | yes |
 | saml\_master\_backend\_role | SAML Master backend role. | `string` | `""` | no |
 | saml\_master\_user\_name | SAML master user name | `string` | `""` | no |
 | saml\_metadata\_content | The metadata of the SAML application in xml format. | `string` | n/a | yes |
 | saml\_roles\_key | Element of the SAML assertion to use for backend roles. | `string` | `""` | no |
 | saml\_session\_timeout | Duration of a session in minutes after a user logs in. Default is 60. Maximum value is 1,440. | `number` | `60` | no |
 | saml\_subject\_key | Element of the SAML assertion to use for username. | `string` | `""` | no |
+| secret\_method | Use ssm or secretsmangaer | `string` | `"ssm"` | no |
 | subnets\_id | Subnets | `list(string)` | n/a | yes |
 | tags | A map of tags to add to all resources. | `map(string)` | `{}` | no |
 | vpc\_id | VPC | `string` | n/a | yes |

_variables.tf

@@ -260,5 +260,11 @@ variable "master_user_name" {
 variable "master_user_password" {
   description = "enable pass auth"
   type        = string
-  default     = "test"
-}      
+  default     = ""
+}
+
+variable "secret_method" {
+  description = "Use ssm or secretsmangaer"
+  type        = string
+  default     = "ssm"
+}

main.tf

@@ -5,6 +5,10 @@ resource "aws_iam_service_linked_role" "es" {
   aws_service_name = "es.amazonaws.com"
 }
 
+resource "random_string" "password" {
+  count  = var.master_user_password == "" ? 1 : 0
+  length = 34
+}
 
 resource "aws_elasticsearch_domain" "opensearch" {
   domain_name           = var.cluster_name
@@ -49,10 +53,10 @@ resource "aws_elasticsearch_domain" "opensearch" {
 
     master_user_options {
       master_user_arn = (var.master_user_arn != "") ? var.master_user_arn : null //data.aws_caller_identity.current.arn
-      
+
       // cerate user and pass
       master_user_name     = var.master_user_name
-      master_user_password = var.master_user_password
+      master_user_password = var.master_user_password == "" ? random_string.password[0].result : var.master_user_password
     }
 
   }

secretsmanager.tf

@@ -0,0 +1,21 @@
+resource "aws_secretsmanager_secret" "opensearch" {
+  count                   = var.secret_method == "secretsmanager" ? 1 : 0
+  name                    = "/opensearch/${var.cluster_name}"
+  recovery_window_in_days = 0
+}
+
+locals {
+  secrets = {
+    VPC_ENDPOINT     = try(aws_elasticsearch_domain.opensearch.endpoint, "")
+    CLUSTER_ENDPOINT = "https://${aws_route53_record.opensearch.fqdn}"
+    KIBANA_ENDPOINT  = "https://${aws_route53_record.opensearch.fqdn}/_dashboards/"
+    USERNAME         = var.master_user_name
+    PASSWORD         = var.master_user_password == "" ? random_string.password[0].result : var.master_user_password
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "opensearch" {
+  count         = var.secret_method == "secretsmanager" ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.opensearch[0].id
+  secret_string = jsonencode(local.secrets)
+}

ssm.tf

@@ -0,0 +1,43 @@
+resource "aws_ssm_parameter" "vpc_endpoint" {
+  count       = var.secret_method == "ssm" ? 1 : 0
+  name        = "/opensearch/${var.cluster_name}/VPC_ENDPOINT"
+  description = "OpenSearch VPC Endpoint"
+  type        = "String"
+  value       = try(aws_elasticsearch_domain.opensearch.endpoint, "")
+}
+
+resource "aws_ssm_parameter" "cluster_endpoint" {
+  count       = var.secret_method == "ssm" ? 1 : 0
+  name        = "/opensearch/${var.cluster_name}/CLUSTER_ENDPOINT"
+  description = "OpenSearch Cluster Endpoint"
+  type        = "String"
+  value       = "https://${aws_route53_record.opensearch.fqdn}"
+}
+
+resource "aws_ssm_parameter" "kibana_endpoint" {
+  count       = var.secret_method == "ssm" ? 1 : 0
+  name        = "/opensearch/${var.cluster_name}/KIBANA_ENDPOINT"
+  description = "OpenSearch Kibana Endpoint"
+  type        = "String"
+  value       = "https://${aws_route53_record.opensearch.fqdn}/_dashboards/"
+}
+
+resource "aws_ssm_parameter" "username" {
+  count       = var.secret_method == "ssm" ? 1 : 0
+  name        = "/opensearch/${var.cluster_name}/USERNAME"
+  description = "OpenSearch Password"
+  type        = "SecureString"
+  value       = var.master_user_name
+}
+
+resource "aws_ssm_parameter" "password" {
+  count       = var.secret_method == "ssm" ? 1 : 0
+  name        = "/opensearch/${var.cluster_name}/PASSWORD"
+  description = "OpenSearch Password"
+  type        = "SecureString"
+  value       = var.master_user_password == "" ? random_string.password[0].result : var.master_user_password
+
+  lifecycle {
+    ignore_changes = [value]
+  }
+}