AWS code-library documentation change
Summary
Replaced direct AWS CLI commands for OpenSearch domain creation with CloudFormation deployment. Removed manual domain status polling and reduced fine-grained access control wait time from 8 to 2 minutes.
Security assessment
The change refactors deployment to use CloudFormation but doesn't alter security configurations. Encryption settings (node-to-node, at-rest) and access policies are now managed via template (not shown). Reduced wait time may reflect optimized initialization but doesn't demonstrate security vulnerability remediation.
Diff
diff --git a/code-library/latest/ug/opensearch_example_opensearch_GettingStarted_016_section.md b/code-library/latest/ug/opensearch_example_opensearch_GettingStarted_016_section.md index d8e781333..bc3eadf25 100644 --- a//code-library/latest/ug/opensearch_example_opensearch_GettingStarted_016_section.md +++ b//code-library/latest/ug/opensearch_example_opensearch_GettingStarted_016_section.md @@ -147,25 +147,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ACCESS_POLICY="{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::${ACCOUNT_ID}:root\"},\"Action\":[\"es:ESHttpGet\",\"es:ESHttpPut\",\"es:ESHttpPost\",\"es:ESHttpDelete\",\"es:ESHttpHead\"],\"Resource\":\"arn:aws:es:${AWS_REGION}:${ACCOUNT_ID}:domain/${DOMAIN_NAME}/*\"}]}" - - echo "Access policy created for region: $AWS_REGION" - echo "Access policy: [REDACTED]" - - # Create the domain (matches tutorial command exactly) - echo "Creating domain $DOMAIN_NAME..." - CREATE_OUTPUT=$(aws opensearch create-domain \ - --domain-name "$DOMAIN_NAME" \ - --engine-version "OpenSearch_2.11" \ - --cluster-config "InstanceType=t3.small.search,InstanceCount=1,ZoneAwarenessEnabled=false" \ - --ebs-options "EBSEnabled=true,VolumeType=gp3,VolumeSize=10" \ - --node-to-node-encryption-options "Enabled=true" \ - --encryption-at-rest-options "Enabled=true" \ - --domain-endpoint-options "EnforceHTTPS=true,TLSSecurityPolicy=Policy-Min-TLS-1-2-2019-07" \ - --advanced-security-options "Enabled=true,InternalUserDatabaseEnabled=true,MasterUserOptions={MasterUserName=$MASTER_USER,MasterUserPassword=$MASTER_PASSWORD}" \ - --access-policies "$ACCESS_POLICY" \ - --tags "Key=Environment,Value=Tutorial" "Key=Purpose,Value=OpenSearchGettingStarted" 2>&1) - - # Check if domain creation was successful - if [[ $? -ne 0 ]]; then - echo "Failed to create OpenSearch domain:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation failed" - fi + # Create the domain using CloudFormation (handles the 15-20 min creation wait) + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + STACK_NAME="tutorial-opensearch-${RANDOM_ID}" + + echo "Creating domain $DOMAIN_NAME via CloudFormation..." + echo "This typically takes 15-20 minutes. CloudFormation will wait for completion." + aws cloudformation deploy \ + --template-file "$SCRIPT_DIR/cfn-opensearch-domain.yaml" \ + --stack-name "$STACK_NAME" \ + --parameter-overrides \ + DomainName="$DOMAIN_NAME" \ + MasterUserName="$MASTER_USER" \ + MasterUserPassword="$MASTER_PASSWORD" \ + --tags project=doc-smith tutorial=opensearch-service-gs \ + --no-fail-on-empty-changeset 2>&1 || handle_error "CloudFormation stack creation failed" @@ -173,3 +162,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Verify the domain was actually created by checking the output - if echo "$CREATE_OUTPUT" | grep -q "DomainStatus"; then - echo "Domain creation initiated successfully." @@ -177,49 +164 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Domain creation output:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation may have failed - no DomainStatus in response" - fi - - # Wait for domain to become active (improved logic) - echo "Waiting for domain to become active..." - RETRY_COUNT=0 - MAX_RETRIES=45 # 45 minutes with 60 second intervals - - while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do - echo "Checking domain status... (attempt $((RETRY_COUNT+1))/$MAX_RETRIES)" - - # Get domain status - DOMAIN_STATUS=$(aws opensearch describe-domain --domain-name "$DOMAIN_NAME" 2>&1) - - if [[ $? -ne 0 ]]; then - echo "Error checking domain status:" - echo "$DOMAIN_STATUS" - - # If domain not found after several attempts, it likely failed to create - if [[ $RETRY_COUNT -gt 5 ]] && echo "$DOMAIN_STATUS" | grep -q "ResourceNotFoundException"; then - handle_error "Domain not found after multiple attempts. Domain creation likely failed." - fi - - echo "Will retry in 60 seconds..." - else - # Check if domain is no longer processing - if echo "$DOMAIN_STATUS" | grep -q '"Processing": false'; then - DOMAIN_ACTIVE=true - echo "Domain is now active!" - break - else - echo "Domain is still being created. Checking again in 60 seconds..." - fi - fi - - sleep 60 - RETRY_COUNT=$((RETRY_COUNT+1)) - done - - # Verify domain is active - if [[ "$DOMAIN_ACTIVE" != "true" ]]; then - echo "Domain creation is taking longer than expected ($((MAX_RETRIES)) minutes)." - echo "You can check the status later using:" - echo "aws opensearch describe-domain --domain-name $DOMAIN_NAME" - handle_error "Domain did not become active within the expected time" - fi + echo "Domain created successfully via CloudFormation." @@ -227,3 +166,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get domain endpoint (matches tutorial) - echo "Retrieving domain endpoint..." - DOMAIN_ENDPOINT=$(aws opensearch describe-domain --domain-name "$DOMAIN_NAME" --query 'DomainStatus.Endpoint' --output text) + # Get domain endpoint from stack outputs + DOMAIN_ENDPOINT=$(aws cloudformation describe-stacks \ + --stack-name "$STACK_NAME" \ + --query 'Stacks[0].Outputs[?OutputKey==`DomainEndpoint`].OutputValue' \ + --output text) @@ -231,2 +172,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ $? -ne 0 ]] || [[ -z "$DOMAIN_ENDPOINT" ]] || [[ "$DOMAIN_ENDPOINT" == "None" ]]; then - handle_error "Failed to get domain endpoint" + if [[ -z "$DOMAIN_ENDPOINT" ]] || [[ "$DOMAIN_ENDPOINT" == "None" ]]; then + handle_error "Failed to get domain endpoint from CloudFormation outputs" @@ -237,5 +178,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Wait additional time for fine-grained access control to be fully ready - echo "Domain is active, but waiting additional time for fine-grained access control to be fully ready..." - echo "Fine-grained access control can take several minutes to initialize after domain becomes active." - echo "Waiting 8 minutes for full initialization..." - sleep 480 # Wait 8 minutes for fine-grained access control to be ready + # Wait for fine-grained access control to be fully ready + echo "Waiting for fine-grained access control to initialize..." + sleep 120 @@ -569,7 +508,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws opensearch delete-domain --domain-name "$DOMAIN_NAME" - echo "✓ Cleanup initiated. Domain deletion may take several minutes to complete." - echo "" - echo "You can check the deletion status using:" - echo "aws opensearch describe-domain --domain-name $DOMAIN_NAME" - echo "" - echo "When deletion is complete, you'll see a 'Domain not found' error." + if [ -n "${STACK_NAME:-}" ]; then + echo "Deleting CloudFormation stack $STACK_NAME..." + aws cloudformation delete-stack --stack-name "$STACK_NAME" + echo "✓ Stack deletion initiated. This may take several minutes." + echo " Monitor: aws cloudformation describe-stacks --stack-name $STACK_NAME" + else + aws opensearch delete-domain --domain-name "$DOMAIN_NAME" 2>/dev/null + echo "✓ Domain deletion initiated." + fi @@ -579,2 +520,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "To delete the domain later, use:" - echo "aws opensearch delete-domain --domain-name $DOMAIN_NAME" + echo "To delete later:" + echo " aws cloudformation delete-stack --stack-name ${STACK_NAME:-tutorial-opensearch-XXXX}" @@ -583 +523,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo " Estimated cost: ~$0.038/hour (~$0.91/day)"