AwsOpensearchArgs

interface AwsOpensearchArgs extends Omit<aws.opensearch.DomainArgs, 'domainName' | 'accessPolicies' | 'tags' | 'advancedSecurityOptions' | 'cognitoOptions' | 'identityCenterOptions' | 'nodeToNodeEncryption' | 'encryptAtRest' | 'domainEndpointOptions' | 'ipAddressType' | 'offPeakWindowOptions' | 'autoTuneOptions' | 'softwareUpdateOptions' | 'logPublishingOptions'> {
accessPolicy?: AwsOpensearchAccessPolicyArgs;
advancedOptions?: Record<string, Input<string>>;
aimlOptions?: Input<DomainAimlOptions | undefined>;
autoSoftwareUpdateEnabled?: Input<boolean>;
clusterConfig?: Input<DomainClusterConfig | undefined>;
deploymentStrategyOptions?: Input<DomainDeploymentStrategyOptions | undefined>;
ebsOptions?: Input<DomainEbsOptions | undefined>;
engineVersion?: Input<string | undefined>;
kmsKey?: AwsKmsKeyInput;
logPublishing?: AwsOpensearchLogPublishingArgs;
maintenance?: AwsOpensearchMaintenanceArgs;
name: string;
region?: Input<string | undefined>;
snapshotOptions?: Input<DomainSnapshotOptions | undefined>;
tags?: Input<Record<string, Input<string>>>;
vpcOptions?: Input<DomainVpcOptions | undefined>;
}

Input arguments for AwsOpensearch.

Remarks

Security posture enforced by this component:

IAM access policy model only.
HTTPS enforced with strong TLS policy.
Encryption at rest and node-to-node encryption always enabled.
Dashboards user-management integrations are intentionally not exposed (for example Cognito, SAML, IAM Identity Center, or internal user DB settings).

Boundary note: The historical Ansible flow included snapshot repository and snapshot management policy setup through direct OpenSearch plugin HTTP APIs. That behaviour is not modelled here because it is outside the native @pulumi/aws OpenSearch domain resource contract.

KMS behaviour:

kmsKey accepts either a key reference exposing keyArn or an explicit external identifier.
External identifiers are resolved to the target key ARN.
When kmsKey is omitted, encryption at rest remains enabled with provider-managed default key behaviour.

Example

CODE

const args: AwsOpensearchArgs = {
  name: 'ordersSearch',
  engineVersion: 'OpenSearch_2.17',
  clusterConfig: {
    instanceType: 't3.small.search',
    instanceCount: 1,
  },
  ebsOptions: {
    ebsEnabled: true,
    volumeType: 'gp3',
    volumeSize: 20,
  },
  kmsKey: { identifier: 'alias/platform/opensearch' },
  accessPolicy: {
    path: './policy/opensearch-access-policy.json',
    variables: {
      principalArn: readerRole.arn,
    },
  },
};

Hierarchy

DomainArgs, "domainName" | "accessPolicies" | "tags" | "advancedSecurityOptions" | "cognitoOptions" | "identityCenterOptions" | "nodeToNodeEncryption" | "encryptAtRest" | "domainEndpointOptions" | "ipAddressType" | "offPeakWindowOptions" | "autoTuneOptions" | "softwareUpdateOptions" | "logPublishingOptions">
AwsOpensearchArgs

Properties

`accessPolicy: AwsOpensearchAccessPolicyArgs`

Optional JSON-template IAM access policy input for the domain.

`advancedOptions: Record<string, Input<string>>`

Overrides advancedOptions

Optional advanced options map forwarded to the domain.

`aimlOptions: Input<DomainAimlOptions | undefined>`

Inherited from aimlOptions

Configuration block for parameters required to enable all machine learning features. Detailed below.

`autoSoftwareUpdateEnabled: Input<boolean>`

Optional automatic software update flag.

`clusterConfig: Input<DomainClusterConfig | undefined>`

Inherited from clusterConfig

Configuration block for the cluster of the domain. Detailed below.

`deploymentStrategyOptions: Input<DomainDeploymentStrategyOptions | undefined>`

Inherited from deploymentStrategyOptions

Configuration block for the deployment strategy options of the domain. Detailed below.

`ebsOptions: Input<DomainEbsOptions | undefined>`

Inherited from ebsOptions

Configuration block for EBS related options, may be required based on chosen instance size. Detailed below.

`engineVersion: Input<string | undefined>`

Inherited from engineVersion

Either Elasticsearch_X.Y or OpenSearch_X.Y to specify the engine version for the Amazon OpenSearch Service domain. For example, OpenSearch_1.0 or Elasticsearch_7.9. See Creating and managing Amazon OpenSearch Service domains. Defaults to the lastest version of OpenSearch.

`kmsKey: AwsKmsKeyInput`

Optional customer-managed KMS key used for encryption at rest.

`logPublishing: AwsOpensearchLogPublishingArgs`

Optional log publishing configuration by log type.

`maintenance: AwsOpensearchMaintenanceArgs`

Optional maintenance and Auto-Tune settings.

`name: string`

Required synchronous plain-string identity and AWS naming-purpose input.

This value drives both:

the Pulumi logical component identity ${environmentCode}-${projectHash}-opensearch-<name>
the AWS OpenSearch domain naming-purpose input (domainName stackAndPurpose pattern)

Pulumi Output, promise, and other asynchronous values are not accepted.

`region: Input<string | undefined>`

Inherited from region

Region where this resource will be managed. Defaults to the Region set in the provider configuration.

`snapshotOptions: Input<DomainSnapshotOptions | undefined>`

Inherited from snapshotOptions

Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.

`tags: Input<Record<string, Input<string>>>`

Optional custom tags merged with repository default tags.

`vpcOptions: Input<DomainVpcOptions | undefined>`

Inherited from vpcOptions

Configuration block for VPC related options. Adding or removing this configuration forces a new resource (documentation). Detailed below.