feat(elasticsearch): L2 for ElasticsearchDomain

[stephanh]

I was using cdk to stand up an Elasticsearch domain and thought I might as well generalise the effort.

Can I please get some feedback on the current implementation and if it is something you are happy to accept?

This implementation is still missing tests, more documentation and features like importing the resource. I will add them once I know I'm on the right track.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[iliapolo]

Hi @stephanh - Thanks for submitting this!

It looks good, definitely a good starting point. Before you continue though, i'd like to ask two things:

1. Create a README file for the common patterns and usage. This will give us a good window into the API ergonomics.

2. Please add a comment on the PR detailing two or three benefits this API offers over the naive Cfn* resources. For example the automatic creation of the LogGroupResourcePolicy, and easy access to metrics. This will serve us for posterity and also justify the effort taking place here. P.S if you can somehow incorporate this into the README itself, that would be even better.

Looking forward to it :)

[stephanh]

I have updated the readme to provide more usage information (I haven't implemented the IAM permission management part yet).

Advantages this will provide over CfnDomain:

• Nicer ergonomics for configuration. For example:
  • nodeToNodeEncription: true vs nodeToNodeEncryption: { enabled: true }
  • Setting enabled to true for ebsOptions if ebsConfiguration has been supplied.
  • Using a struct for log configuration instead of a hashtable.
• Automatically creating log groups with the right permissions (requires custom resource) for any of the three supported log types if requested.
• Helper for accessing most common metrics and other ES metrics by name. (Is there a way to avoid having to supply the account id to get the metric?)
• Helper for granting IAM permissions to the cluster and indecies (grant methods). I still need to add those.

I think having the fundamentals in place will also make it easier for others to incrementally add improvements later.

[iliapolo]

First round. I think we are on the right track but there are still some API changes i'm thinking about towards the next round.

Pull request has been modified.

[iliapolo]

@stephanh See #8920.

Lets add a README section about this?

[stephanh]

I have added some grant helper methods.

I think the remaining 2 items are:

• tests
• fromXXX methods to import existing domains.

[stephanh]

@iliapolo thanks to @adamelmore major contribution I think we now have everything and this PR is ready.

[iliapolo]

@stephanh Awesome, love the cooperation :)

I'll take a look this week.

[adamdottv]

@iliapolo will you have a chance to review this week?

[iliapolo]

Hi @adamelmore - Its definitely on my docket for this week, Appreciate the patience.

[hoegertn]

With AdvancedSecurityOptions being in CFN now it would be great to add them here too. What do you think?

[iliapolo]

@stephanh Very cool, lots of potential here.

I did have quite a few comments on the API, specifically around the decision to make things required and not providing default values. Let me know if i'm missing some consideration you made.

Pull request has been modified.

[iliapolo]

@stephanh Took the liberty to apply a couple of minor changes and approved it.

Thanks so much for all the work!

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: acf0089
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).