elasticsearch.yaml

#
#  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  SPDX-License-Identifier: Apache-2.0
#

Resources:
  KibanaUserPool:
    Type: AWS::Cognito::UserPool
    Condition: isDev
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      AutoVerifiedAttributes:
        - email
      UserPoolName: !Sub '${AWS::StackName}-Kibana'
      Schema:
        - AttributeDataType: String
          Name: email
          Required: true
        - AttributeDataType: String
          Name: cc_confirmed
  KibanaUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Condition: isDev
    Properties:
      UserPoolId: !Ref KibanaUserPool
      Domain: !Join ['-', [kibana, !Ref Stage, !Ref AWS::AccountId]]
  KibanaUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Condition: isDev
    Properties:
      ClientName: !Sub '${AWS::StackName}-KibanaClient'
      GenerateSecret: false
      UserPoolId: !Ref KibanaUserPool
      ExplicitAuthFlows:
        - ADMIN_NO_SRP_AUTH
        - USER_PASSWORD_AUTH
      PreventUserExistenceErrors: ENABLED
  KibanaIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Condition: isDev
    Properties:
      IdentityPoolName: !Sub '${AWS::StackName}-KibanaIDPool'
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref KibanaUserPoolClient
          ProviderName: !GetAtt KibanaUserPool.ProviderName
  KibanaCognitoRole:
    Type: AWS::IAM::Role
    Condition: isDev
    Properties:
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AmazonESCognitoAccess'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service: 'es.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
  AdminKibanaAccessRole:
    Type: 'AWS::IAM::Role'
    Condition: isDev
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Federated: 'cognito-identity.amazonaws.com'
            Action:
              - 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                'cognito-identity.amazonaws.com:aud': !Ref KibanaIdentityPool
              'ForAnyValue:StringLike':
                'cognito-identity.amazonaws.com:amr': authenticated
  IdentityPoolRoleAttachment:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Condition: isDev
    Properties:
      IdentityPoolId: !Ref KibanaIdentityPool
      Roles:
        authenticated: !GetAtt AdminKibanaAccessRole.Arn
  SearchLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '${AWS::StackName}-search-logs'
  SearchLogResourcePolicy:
    Type: AWS::Logs::ResourcePolicy
    DependsOn: SearchLogs
    Properties:
      PolicyDocument: !Sub '{ "Version": "2012-10-17", "Statement": [{ "Sid": "", "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com"}, "Action":[ "logs:PutLogEvents","logs:CreateLogStream"],"Resource": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${AWS::StackName}-search-logs:*"}]}'
      PolicyName: !Sub '${AWS::StackName}-search-logs-resource-policy'
  ElasticSearchDomain:
    Type: AWS::Elasticsearch::Domain
    DependsOn: SearchLogResourcePolicy
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W90
            reason: 'We do not want a VPC for ElasticSearch. We are controlling access to ES using IAM roles'
    UpdatePolicy:
      EnableVersionUpgrade: true
    Properties:
      EBSOptions:
        # Assuming ~100GB storage requirement for PROD; min storage requirement is ~290GB https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/sizing-domains.html
        # If you change the size of the Elasticsearch Domain, consider also updating the NUMBER_OF_SHARDS on the updateSearchMappings resource
        EBSEnabled: true
        VolumeType: gp2
        VolumeSize: !If [isDev, 10, 73]
      ElasticsearchClusterConfig:
        InstanceType:
          !If [
            isDev,
            !FindInMap [RegionMap, !Ref AWS::Region, smallEc2],
            !FindInMap [RegionMap, !Ref AWS::Region, largeEc2],
          ]
        InstanceCount: !If [isDev, 1, 4]
        DedicatedMasterEnabled: !If [isDev, false, true]
        DedicatedMasterCount: !If [isDev, !Ref AWS::NoValue, 3]
        DedicatedMasterType: !If [isDev, !Ref AWS::NoValue, !FindInMap [RegionMap, !Ref AWS::Region, smallEc2]]
        ZoneAwarenessEnabled: !If [isDev, false, true]
      ElasticsearchVersion: '7.10'
      EncryptionAtRestOptions:
        Enabled: true
        KmsKeyId: !Ref ElasticSearchKMSKey
      NodeToNodeEncryptionOptions:
        Enabled: true
      SnapshotOptions: !If [isDev, !Ref AWS::NoValue, { AutomatedSnapshotStartHour: 0 }]
      CognitoOptions: !If
        - isDev
        - Enabled: true
          IdentityPoolId: !Ref KibanaIdentityPool
          UserPoolId: !Ref KibanaUserPool
          RoleArn: !GetAtt KibanaCognitoRole.Arn
        - !Ref AWS::NoValue
      AccessPolicies: !If
        - isDev
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                AWS:
                  - !GetAtt AdminKibanaAccessRole.Arn
              Action: 'es:*'
              Resource:
                - !Sub 'arn:${AWS::Partition}:es:${AWS::Region}:${AWS::AccountId}:domain/*'
            - Effect: Allow
              Principal:
                AWS:
                  - !Join [
                      '/',
                      [
                        !Sub 'arn:${AWS::Partition}:sts::${AWS::AccountId}:assumed-role',
                        !Ref KibanaCognitoRole,
                        CognitoIdentityCredentials,
                      ],
                    ]
              Action: es:*
              Resource:
                Fn::Sub: arn:${AWS::Partition}:es:${AWS::Region}:${AWS::AccountId}:domain/*
        - !Ref AWS::NoValue
      LogPublishingOptions:
        ES_APPLICATION_LOGS:
          CloudWatchLogsLogGroupArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${AWS::StackName}-search-logs:*"
          Enabled: true
        SEARCH_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${AWS::StackName}-search-logs:*"
          Enabled: true
        INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${AWS::StackName}-search-logs:*"
          Enabled: true
  UpdateSearchMappingsCustomResource:
    DependsOn: ElasticSearchDomain
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt UpdateSearchMappingsLambdaFunction.Arn # serverless by convention capitalizes first letter and suffixes with "LambdaFunction"
      RandomValue: ${sls:instanceId} # This forces the upload to happen on every deployment