[Issue #2327] Allow access to opensearch

infra/api/database/main.tf

@@ -1,12 +1,12 @@
-# docs: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc
+data "aws_caller_identity" "current" {}
+
 data "aws_vpc" "network" {
   filter {
     name   = "tag:Name"
     values = [module.project_config.network_configs[var.environment_name].vpc_name]
   }
 }
 
-# docs: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet
 data "aws_subnets" "database" {
   filter {
     name   = "vpc-id"

infra/api/database/search.tf

@@ -1,20 +1,20 @@
 locals {
   search_config = local.environment_config.search_config
+  service_name  = "${local.prefix}${module.app_config.app_name}-${var.environment_name}"
 }
 
 module "search" {
   count = local.search_config != null ? 1 : 0
 
   source = "../../modules/search"
 
-  service_name                  = "${local.prefix}${module.app_config.app_name}-${var.environment_name}"
+  service_name                  = local.service_name
   availability_zone_count       = 3
   zone_awareness_enabled        = var.environment_name == "prod" ? true : false
   multi_az_with_standby_enabled = var.environment_name == "prod" ? true : false
   dedicated_master_enabled      = var.environment_name == "prod" ? true : false
   dedicated_master_count        = var.environment_name == "prod" ? 3 : 1
   subnet_ids                    = slice(data.aws_subnets.database.ids, 0, var.environment_name == "prod" ? 3 : 1)
-  cidr_block                    = data.aws_vpc.network.cidr_block
   instance_count                = local.search_config.instance_count
   engine_version                = local.search_config.engine_version
   dedicated_master_type         = local.search_config.dedicated_master_type

infra/modules/search/authentication.tf

@@ -166,3 +166,24 @@ data "aws_iam_policy_document" "opensearch_cloudwatch" {
     resources = ["arn:aws:logs:*"]
   }
 }
+
+data "aws_iam_policy_document" "allow_all_aws_access" {
+  # checkov:skip=CKV_AWS_109: TODO: https://github.com/HHS/simpler-grants-gov/issues/2472
+  # checkov:skip=CKV_AWS_111: TODO: https://github.com/HHS/simpler-grants-gov/issues/2472
+  # checkov:skip=CKV_AWS_283: TODO: https://github.com/HHS/simpler-grants-gov/issues/2472
+  # checkov:skip=CKV_AWS_356: TODO: https://github.com/HHS/simpler-grants-gov/issues/2472
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    actions   = ["es:*"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_opensearch_domain_policy" "main" {
+  domain_name     = aws_opensearch_domain.opensearch.domain_name
+  access_policies = data.aws_iam_policy_document.allow_all_aws_access.json
+}

infra/modules/search/networking.tf

@@ -1,3 +1,7 @@
+data "aws_vpc" "vpc" {
+  id = var.vpc_id
+}
+
 resource "aws_security_group" "opensearch" {
   name_prefix = "opensearch-${var.service_name}"
   description = "Security group for OpenSearch domain ${var.service_name}"
@@ -7,10 +11,10 @@ resource "aws_security_group" "opensearch" {
     from_port   = 443
     to_port     = 443
     protocol    = "tcp"
-    description = "Allow inbound HTTPS traffic"
+    description = "Allow inbound HTTPS traffic from the VPC"
 
     cidr_blocks = [
-      var.cidr_block,
+      data.aws_vpc.vpc.cidr_block,
     ]
   }
 

infra/modules/search/outputs.tf

@@ -0,0 +1,3 @@
+output "endpoint" {
+  value = aws_opensearch_domain.opensearch.endpoint
+}

infra/modules/search/variables.tf

@@ -3,11 +3,6 @@ variable "availability_zone_count" {
   type        = number
 }
 
-variable "cidr_block" {
-  description = "The CIDR block of the VPC"
-  type        = string
-}
-
 variable "dedicated_master_enabled" {
   description = "Whether to enable dedicated master nodes"
   type        = bool