Amazon web services AWS ElasticSearch服务-从CF模板设置加密选项

我正在创建一个云形成模板，以便在AWS中提供elasticsearch服务域

我想将加密下的此属性设置为true “域的所有流量都需要HTTPS”，但我在AWS文档中找不到这样做的方法

用于设置加密属性的其他选项，如 “启用静态数据加密”和“节点到节点加密”都有很好的文档记录

---

有人知道如何从CF模板设置“域的所有流量都需要HTTPS”属性吗？

我这样做的方式是确保安全组只允许HTTPS（443）访问群集

不完全确定这是否是你想要的，但如果不是，请告诉我更多细节，我会看看是否能帮你

  mySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VpcId
      GroupName: !Ref SecurityGroup
      GroupDescription: !Ref GroupDescription
      SecurityGroupIngress:
        - FromPort: '443'
          IpProtocol: tcp
          ToPort: '443'
          CidrIp: 0.0.0.0/0

---

以下是我为Rest加密和节点到节点加密准备的内容：

现在，我必须添加/编辑大量的活动部件，因此我将在这里发布整个模板，以便您可以看到我在不同部分中所做的操作，以便您可以提取出您需要/想要的内容。我使用了条件句，因为您可以选择是否启用它。我还确保在这里和那里添加一些评论。如果您愿意，可以随意删除这些内容，但它们根本不会影响模板

编辑：我知道模板中有几个部分是不需要的，但我喜欢使我的模板看起来漂亮且有条理（在使用时）。我知道我需要在模板本身内部进行组织工作，但它就在那里P

edit2：下面的模板假设您将使用现有的VPC/子网/安全组，您可以查看my repo（在下面的评论中）以了解此模板的其他版本

我确实验证了这个模板，并且能够成功地构建域

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  **NOTE** In order to create Elastisearch Domain in AWS using CloudFormation
  verify you have the following Service Role created in IAM!!
  -- AWSServiceRoleForAmazonElasticsearchService --
  If you do not have this Role, create it using the following CLi Command -- 
  aws iam create-service-linked-role --aws-service-name es.amazonaws.com

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Configure Cluster"
        Parameters:
          - DomainName
          - ElasticsearchVersion
          - ZoneAwareness
          - SnapShotHour
      -
        Label:
          default: "Data Instances"
        Parameters:
          - InstanceType
          - DataInstanceCount
      -
        Label:
          default: "Dedicated Master Instances"
        Parameters:
          - DedicatedMaster
          - MasterInstanceType
          - MasterInstanceCount
      -
        Label:
          default: "Storage Config"
        Parameters:
          - StorageSize
      -
        Label:
          default: "Network Config"
        Parameters:
          - VpcId
          - SubNet1
          - SubNet2
          - SecurityGroup
      -
        Label:
          default: "Encryption Settings"
        Parameters:
          - EncryptionAtRest
          - KmsKey
          - NodetoNode
      -
        Label:
          default: "IAM User Restriction Policy"
        Parameters:
          - IamUserArn
    ParameterLabels:
      DomainName:
        default: "Name of the ElasticSearch Domain (lowecase, no spaces) - If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the domain name"
      ElasticsearchVersion:
        default: "Select the ElasticSearch version desired"
      InstanceType:
        default: "Instance Size of Data Instances"
      DataInstanceCount:
        default: "Number of Data Instances Required"
      DedicatedMaster:
        default: "Select if a Dedicated Master Instance is required"
      MasterInstanceType:
        default: "Instance Size of Master Instances"
      MasterInstanceCount:
        default: "How many Dedicated Master Instances are needed? (0, 3 or 5)"
      StorageSize:
        default: "Storage Size in GB"
      VpcId:
        default: "Select the VPC to deploy into (must already exist)"
      SubNet1:
        default: "Select the First Subnet"
      SubNet2:
        default: "Select the Second Subnet"
      SecurityGroup:
        default: "Select the Security Group"
      IamUserArn:
        default: "Enter the ARN for the IAM User to give initial access to the stack"
      ZoneAwareness:
        default: "Enable Zone Awareness (Availability Zone Replication) (recommended)"
      SnapShotHour:
        default: "Set the hour to run the Automated Snapshot (0-23) (Default: UTC Timezone)"
      EncryptionAtRest:
        default: "Enable Encryption at Rest"
      KmsKey:
        default: "If Encryption at Rest is enabled, supply the KMS Key used for encryption"
      NodetoNode:
        default: "Enable Node to Node Encryption"

Parameters:
  DomainName:
    Type: String
    Default: "elasticsearchstack-cf"
    MaxLength: '128' 
    ConstraintDescription: "Must be lowercase, numbers/letters and/or a dash"
  SnapShotHour:
    Type: Number
    Default: 0
    MinValue: 0
    MaxValue: 23
  ElasticsearchVersion:
    Type: String
    Default: 7.1
    AllowedValues: [7.1, 6.8, 6.7, 6.6, 6.5] # Remove this line for free-form number entry
  InstanceType:
    Type: String
    Default: r5.large.elasticsearch
    AllowedValues: [t2.small.elasticsearch, t2.medium.elasticsearch,
      c4.large.elasticsearch, c4.xlarge.elasticsearch, c4.2xlarge.elasticsearch, c4.4xlarge.elasticsearch, c4.8xlarge.elasticsearch,
      c5.large.elasticsearch, c5.xlarge.elasticsearch, c5.2xlarge.elasticsearch, c5.4xlarge.elasticsearch, c5.9xlarge.elasticsearch, c5.18xlarge.elasticsearch,
      m3.medium.elasticsearch, m3.large.elasticsearch, m3.xlarge.elasticsearch, m3.2xlarge.elasticsearch,
      m4.large.elasticsearch, m4.xlarge.elasticsearch, m4.2xlarge.elasticsearch, m4.4xlarge.elasticsearch, m4.10xlarge.elasticsearch,
      m5.large.elasticsearch, m5.xlarge.elasticsearch, m5.2xlarge.elasticsearch, m5.4xlarge.elasticsearch, m5.12xlarge.elasticsearch,
      r3.large.elasticsearch, r3.xlarge.elasticsearch, r3.2xlarge.elasticsearch, r3.4xlarge.elasticsearch, r3.8xlarge.elasticsearch,
      r4.large.elasticsearch, r4.xlarge.elasticsearch, r4.2xlarge.elasticsearch, r4.4xlarge.elasticsearch, r4.16xlarge.elasticsearch,
      r5.large.elasticsearch, r5.xlarge.elasticsearch, r5.2xlarge.elasticsearch, r5.4xlarge.elasticsearch, r5.12xlarge.elasticsearch,
      i2.xlarge.elasticsearch, i2.2xlarge.elasticsearch,
      i3.large.elasticsearch, i3.xlarge.elasticsearch, i3.2xlarge.elasticsearch, i3.4xlarge.elasticsearch, i3.8xlarge.elasticsearch, i3.16xlarge.elasticsearch]
    ConstraintDescription: "Must be a valid EC2 Elasticsearch instance type."
  DataInstanceCount:
    Type: Number
    Default: 2
    AllowedValues: [2, 4, 6, 8, 10] # Remove this line for free-form number entry
  MasterInstanceType:
    Type: String
    Default: r5.large.elasticsearch
    AllowedValues: [t2.small.elasticsearch, t2.medium.elasticsearch,
      c4.large.elasticsearch, c4.xlarge.elasticsearch, c4.2xlarge.elasticsearch, c4.4xlarge.elasticsearch, c4.8xlarge.elasticsearch,
      c5.large.elasticsearch, c5.xlarge.elasticsearch, c5.2xlarge.elasticsearch, c5.4xlarge.elasticsearch, c5.9xlarge.elasticsearch, c5.18xlarge.elasticsearch,
      m3.medium.elasticsearch, m3.large.elasticsearch, m3.xlarge.elasticsearch, m3.2xlarge.elasticsearch,
      m4.large.elasticsearch, m4.xlarge.elasticsearch, m4.2xlarge.elasticsearch, m4.4xlarge.elasticsearch, m4.10xlarge.elasticsearch,
      m5.large.elasticsearch, m5.xlarge.elasticsearch, m5.2xlarge.elasticsearch, m5.4xlarge.elasticsearch, m5.12xlarge.elasticsearch,
      r3.large.elasticsearch, r3.xlarge.elasticsearch, r3.2xlarge.elasticsearch, r3.4xlarge.elasticsearch, r3.8xlarge.elasticsearch,
      r4.large.elasticsearch, r4.xlarge.elasticsearch, r4.2xlarge.elasticsearch, r4.4xlarge.elasticsearch, r4.16xlarge.elasticsearch,
      r5.large.elasticsearch, r5.xlarge.elasticsearch, r5.2xlarge.elasticsearch, r5.4xlarge.elasticsearch, r5.12xlarge.elasticsearch,
      i2.xlarge.elasticsearch, i2.2xlarge.elasticsearch,
      i3.large.elasticsearch, i3.xlarge.elasticsearch, i3.2xlarge.elasticsearch, i3.4xlarge.elasticsearch, i3.8xlarge.elasticsearch, i3.16xlarge.elasticsearch]
    ConstraintDescription: "Must be a valid EC2 Elasticsearch instance type."
  MasterInstanceCount:
    Type: Number
    Default: 0
    AllowedValues: [0, 3, 5] # Remove this line for free-form number entry
  VpcId:
    Type: AWS::EC2::VPC::Id
    ConstraintDescription: "Must be the VPC ID of an existing Virtual Private Cloud."
  SubNet1:
    Type: AWS::EC2::Subnet::Id
    ConstraintDescription: "Must be the Subnet ID of an existing Subnet."
  SubNet2:
    Type: AWS::EC2::Subnet::Id
    ConstraintDescription: "Must be the Subnet ID of an existing Subnet."    
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup::Id
    ConstraintDescription: "Must be and existing Security Group."    
  DedicatedMaster:
    Description: True or False
    Type: String
    Default: False
    AllowedValues:
      - True
      - False
  StorageSize:
    Type: Number
    Default: 20
    MinValue: 10 # Remove this line for free-form number entry (suggested to keep this line)
    MaxValue: 1000 # Remove this line for free-form number entry
  IamUserArn:
    Type: String
    Default: "arn:aws:iam::<AccountNumber>:user/<username>"
  ZoneAwareness:
    Description: True or False
    Type: String
    Default: True
    AllowedValues:
      - True
      - False
  EncryptionAtRest:
    Description: True or False
    Type: String
    Default: False
    AllowedValues:
      - True
      - False
  KmsKey:
    Type: String
  NodetoNode:
    Description: True or False
    Type: String
    Default: False
    AllowedValues:
      - True
      - False
Conditions: # Checks to see if Conditional Values are True
  DedicatedMasterYes: !Equals [ !Ref DedicatedMaster, True]
  EncryptionAtRestYes: !Equals [ !Ref EncryptionAtRest, True]

Resources:
  ElasticsearchDomain:
    Type: AWS::Elasticsearch::Domain
    Properties:
      DomainName: !Ref DomainName
      ElasticsearchVersion: !Ref ElasticsearchVersion
      ElasticsearchClusterConfig: 
        DedicatedMasterEnabled: !Ref DedicatedMaster
        InstanceCount: !Ref DataInstanceCount
        ZoneAwarenessEnabled: !Ref ZoneAwareness
        InstanceType: !Ref InstanceType
        DedicatedMasterType: # If Dedicated Master is True, then use !Ref, if not, use NoValue (NULL) for both settings below
          !If [DedicatedMasterYes, !Ref MasterInstanceType, !Ref "AWS::NoValue"]
        DedicatedMasterCount: 
          !If [DedicatedMasterYes, !Ref MasterInstanceCount, !Ref "AWS::NoValue"]
      EBSOptions:
        EBSEnabled: True
        Iops: 0
        VolumeSize: !Ref StorageSize
        VolumeType: "gp2"
      SnapshotOptions:
        AutomatedSnapshotStartHour: !Ref SnapShotHour
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Deny
            Principal:
              AWS: !Ref IamUserArn
            Action: 'es:*'
            Resource: "*"
      AdvancedOptions: # BOTH of these settingsd are REQUIRED (regardless of what the documentation states) - Bug filed: https://forums.aws.amazon.com/thread.jspa?messageID=768527
        rest.action.multi.allow_explicit_index: 'true'
        indices.fielddata.cache.size: !Ref "AWS::NoValue"
      VPCOptions:
        SubnetIds:
          - !Ref SubNet1
          - !Ref SubNet2
        SecurityGroupIds:
          - !Ref SecurityGroup
      EncryptionAtRestOptions: # If Encryption At Rest is True, then use !Ref, if not, use NoValue (NULL) for both settings below
          !If [EncryptionAtRestYes, !Ref EncryptionAtRest, !Ref "AWS::NoValue"]
      KmsKeyId:
          !If [EncryptionAtRestYes, !Ref KmsKey, !Ref "AWS::NoValue"]
      NodeToNodeEncryptionOptions:
        Enabled: !Ref NodetoNode

Outputs:
  DomainArn:
    Value: !GetAtt ElasticsearchDomain.DomainArn
  DomainEndpoint:
    Value: !GetAtt ElasticsearchDomain.DomainEndpoint
  SecurityGroupId:
    Value: !Ref SecurityGroup
  SubnetId1:
    Value: !Ref SubNet1
  SubnetId2:
    Value: !Ref SubNet2

AWST模板格式版本：2010-09-09
说明：>-
**注**为了使用CloudFormation在AWS中创建Elastisearch域
验证您是否在IAM中创建了以下服务角色！！
--AWSServiceRoleForAmazonElasticsearchService--
如果您没有此角色，请使用以下CLi命令创建它--
aws iam创建服务链接角色--aws服务名称es.amazonaws.com
元数据：
AWS:：CloudFormation:：接口：
参数组：
-
标签：
默认值：“配置群集”
参数：
-域名
-弹性变形
-区域意识
-快照时间
-
标签：
默认值：“数据实例”
参数：
-实例类型
-数据实例计数
-
标签：
默认值：“专用主实例”
参数：
-奉献的主人
-MasterInstanceType
-主实例计数
-
标签：
默认值：“存储配置”
参数：
-存储容量
-
标签：
默认值：“网络配置”
参数：
-VpcId
-子网1
-子网2
-证券集团
-
标签：
默认值：“加密设置”
参数：
-加密专家
-KmsKey
-节点节点
-
标签：
默认值：“IAM用户限制策略”
参数：
-IamUserArn
参数标签：
域名：
默认值：“ElasticSearch域的名称（小写，无空格）-如果不指定名称，AWS CloudFormation将生成唯一的物理ID并将该ID用作域名”
弹性版本：
默认值：“选择所需的ElasticSearch版本”
实例类型：
默认值：“数据实例的实例大小”
DataInstanceCount：
默认值：“需要的数据实例数”
奉献的主人：
默认值：“如果需要专用主实例，请选择”
MasterInstanceType：
默认值：“主实例的实例大小”
主实例计数：
默认值：“需要多少个专用主实例？（0、3或5）”
存储大小：
默认值：“以GB为单位的存储大小”
VpcId：
默认值：“选择要部署到的VPC（必须已经存在）”
子网1：
默认值：“选择第一个子网”
子网2：
默认值：“选择第二个子网”
证券集团：
默认值：“选择安全组”
IamUserArn：
默认值：“输入IAM用户的ARN以授予对堆栈的初始访问权”
区域意识：
默认值：“启用区域感知（可用性区域复制）（推荐）”
快照时间：
默认值：“设置运行自动快照的小时数（0-23）（默认值：UTC时区）”
加密专家：
默认值：“在静止时启用加密”
KmsKey：
默认值：“如果启用了静态加密，请提供用于加密的KMS密钥”
节点节点：
默认值：“启用节点到节点加密”
参数：
域名：
类型：字符串
默认值：“elasticsearchstack cf”
MaxLength:'128'
约束描述：“必须是小写、数字/字母和/或破折号”
快照时间：
类型：编号
默认值：0
最小值：0
最大值：23
弹性版本：
类型：字符串
默认值：7.1
AllowedValues:[7.1,6.8,6.7,6.6,6.5]#删除此行以输入自由格式的数字
实例类型：
类型：字符串
默认值：r5.large.elasticsearch
允许值：[t2.small.elasticsearch，t2.medium.elasticsearch，
c4.large.elasticsearch，c4.xlarge.elasticsearch，c4.2xlarge.elasticsearch，c4.4xlarge.elasticsearch，c4.8xlarge.elasticsearch，
c5.large.elasticsearch，c5.xlarge.elasticsearch，c5.2xlarge.elasticsearch，c5.4xlarge.elasticsearch，c5.9xlarge.elasticsearch，c5.18xlarge.elasticsearch，
m3.medium.elasticsearch，m3.large.elasticsearch，m3.xlarge.elasticsearch，m3.2xlarge.elasticsearch，
m4.large.elasticsearch，m4.xlarge.elasticsearch，m4.2xlarge.elasticsea
mkdir sum_function
cd sum_function
pip install -t . crhelper
# on some systems pip may fail with a distutils error, if you run into this, try 
running pip with the –system argument
# pip install —system -t . crhelper
touch lambda_function.py

from crhelper import CfnResource
import boto3
import logging

logger = logging.getLogger(__name__)
helper = CfnResource()

@helper.create
@helper.update
def update_es_domain_config(event, context):
    logger.info("Updating elasticsearch domain config with HTTPS")
    es = boto3.client('es')
    response = es.update_elasticsearch_domain_config(
        DomainName=event['ResourceProperties']['ESDomainName'],
        DomainEndpointOptions={
            'EnforceHTTPS': True,
            'TLSSecurityPolicy': 'Policy-Min-TLS-1-0-2019-07'
        }
    )
    logger.info("results:", response)
@helper.delete
def no_op(_, __):
    pass

def handler(event, context):
    helper(event, context)

zip -r ../sum.zip ./

aws lambda create-function \
    --function-name "update-es-domain" \
    --handler "lambda_function.handler" \
    --timeout 900 \
    --zip-file fileb://../sum.zip \
    --runtime python3.7 \
    --role "arn:aws:iam::123412341234:role/lambda-cli-role"

  ESDomainUpdate:
    Type: "Custom::elasticsearch"
    Properties:
      ServiceToken: "arn:aws:lambda:us-east-1:123412341234:function:update-es-domain"
      ESDomainName: "advantagehelp"

AWSTemplateFormatVersion: 2010-09-09
Description: AWS CloudFormation templates to create AWS Elasticsearch Service domain.
Parameters:
  NodeType:
    Description: The node type to be provisioned for the Elasticsearch cluster
    Type: String
    Default: m4.large.elasticsearch
    AllowedValues:
      - m4.large.elasticsearch
      - m4.xlarge.elasticsearch
      - c4.large.elasticsearch
      - c4.xlarge.elasticsearch
      - r4.large.elasticsearch
      - r4.xlarge.elasticsearch
    ConstraintDescription: must be a valid Elasticsearch node type.
  NodeCount:
    Description: The number of nodes in the Elasticsearch cluster.
    Type: Number
    Default: '1'
  AllowedESGetIpList:
    Type: CommaDelimitedList
    Description: List of ip and cidr for elasticsearch retrieval
  AllowedESUpdateIpList:
    Type: CommaDelimitedList
    Description: List of ip and cidr for elasticsearch update
  ESDomainName:
    Type: String
    Description: Name of Elastic Search Domain
    Default: advantagehelp
Resources:
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Needed to name elasticsearch domain"
    Properties:
      DomainName: !Ref ESDomainName
      ElasticsearchClusterConfig:
        DedicatedMasterEnabled: false
        InstanceCount: !Ref NodeCount
        ZoneAwarenessEnabled: false
        InstanceType: !Ref NodeType
      ElasticsearchVersion: '6.4'
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Action:
              - 'es:ESHttpGet'
              - 'es:ESHttpHead'
            Principal: '*'
            Effect: Allow
            Resource: !Sub arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ESDomainName}/*
            Condition:
              IpAddress:
                'aws:SourceIp': !Ref AllowedESGetIpList
          - Action:
              - 'es:ESHttpGet'
              - 'es:ESHttpHead'
              - 'es:ESHttpPost'
              - 'es:ESHttpPut'
            Principal: '*'
            Effect: Allow
            Resource: !Sub arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ESDomainName}/*
            Condition:
              IpAddress:
                'aws:SourceIp': !Ref AllowedESUpdateIpList
      EBSOptions:
        EBSEnabled: true
        Iops: 0
        VolumeSize: 10
        VolumeType: gp2
      SnapshotOptions:
        AutomatedSnapshotStartHour: 1
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: "true"
  ESDomainUpdate:
    Type: "Custom::elasticsearch"
    Properties:
      ServiceToken: "arn:aws:lambda:us-east-1:123412341234:function:update-es-domain"
      ESDomainName: "advantagehelp"
    DependsOn: ElasticsearchDomain
Outputs:
  KibanaURL:
    Description: Kibana URL
    Value: !Join
      - ''
      - - !GetAtt
          - ElasticsearchDomain
          - DomainEndpoint
        - /_plugin/kibana/
  ElasticsearchEndpoint:
    Description: Elasticsearch domain endpoint
    Value: !GetAtt
      - ElasticsearchDomain
      - DomainEndpoint
  ElasticsearchDomainARN:
    Description: Elasticsearch domain ARN
    Value: !GetAtt
      - ElasticsearchDomain
      - DomainArn