Ansible AWS ElasticSearch module
For configuring/managing aws managed elasticsearch clusters
---
- hosts: localhost
tasks:
- name: "Create ElasticSearch cluster"
ec2_elasticsearch:
name: "my-cluster"
elasticsearch_version: "2.3"
region: "us-west-1"
instance_type: "m3.medium.elasticsearch"
instance_count: 2
dedicated_master: True
zone_awareness: True
dedicated_master_instance_type: "t2.micro.elasticsearch"
dedicated_master_instance_count: 2
ebs: True
volume_type: "standard"
volume_size: 10
vpc_subnets: "subnet-e537d64a"
vpc_security_groups: "sg-dd2f13cb"
snapshot_hour: 13
access_policies: "{{ lookup('file', 'cluster_policies.json') | from_json }}"
profile: "myawsaccount"
register: response
VPC Configuration
Endpoints
Non VPC clusters give endpoints at DomainStatus.Endpoint, however VPC clusters return it at DomainStatus.Endpoints.vpc
Service Roles
AWS currently provides no way to create the correct service role for a vpc limited elasticsearch cluster. To get the correct role configured in your account, create a test cluster in your vpc using the aws console. You can delete it afterwards. If you don't have this, the module will fail with this error:
Before you can proceed, you must enable a service-linked role to give Amazon ES permissions to access your VPC.
Pitfalls
Access Policies may trigger continual updates if the format in cluster_policies.json differs from the AWS
returned value. To debug this, you can use the cli to get the policy back so you can compare or replace the contents
of your cluster_policies.json file.
aws es describe-elasticsearch-domain --domain-name my-cluster --query DomainStatus.AccessPolicies --output text