Set by controls 2

Active controls fix these values.

• encrypt_at_restany, set to {"enabled":true}Configuration block for encrypting at rest
• node_to_node_encryptionany, set to {"enabled":true}Configuration block for node-to-node encryption options

Optional 45

• access_policiesstring, default nullIAM policy document specifying the access policies for the domain. Required if create_access_policy is false
• access_policy_override_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid
• access_policy_source_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. Statements must have unique sids
• access_policy_statementsany, default {}A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage
• advanced_optionsmap(string), default {}Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your Elasticsearch domain on every apply
• advanced_security_optionsany, default {...}Configuration block for [fine-grained access control](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html)
• aiml_optionsobject({...}), default nullConfiguration block for AI/ML options including Natural Language Query Generation, S3 Vectors, and Serverless Vector Acceleration
• auto_tune_optionsany, default {...}Configuration block for the Auto-Tune options of the domain
• cloudwatch_log_group_classstring, default nullSpecified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
• cloudwatch_log_group_kms_key_idstring, default nullIf a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)
• cloudwatch_log_group_retention_in_daysnumber, default 60Number of days to retain log events
• cloudwatch_log_group_skip_destroybool, default nullSet to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state
• cloudwatch_log_resource_policy_namestring, default nullName of the resource policy for OpenSearch to log to CloudWatch
• cluster_configany, default {...}Configuration block for the cluster of the domain
• cognito_optionsany, default {}Configuration block for authenticating Kibana with Cognito
• createbool, default trueDetermines whether resources will be created (affects all resources)
• create_access_policybool, default trueDetermines whether an access policy will be created
• create_cloudwatch_log_groupsbool, default trueDetermines whether log groups are created
• create_cloudwatch_log_resource_policybool, default trueDetermines whether a resource policy will be created for OpenSearch to log to CloudWatch
• create_saml_optionsbool, default falseDetermines whether SAML options will be created
• create_security_groupbool, default trueDetermines if a security group is created
• deployment_strategy_optionsobject({...}), default nullConfiguration block for deployment strategy options
• domain_endpoint_optionsany, default {...}Configuration block for domain endpoint HTTP(S) related options
• domain_namestring, default ""Name of the domain
• ebs_optionsany, default {...}Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/elasticsearch-service/pricing/)
• enable_access_policybool, default trueDetermines whether an access policy will be applied to the domain
• engine_versionstring, default nullVersion of the OpenSearch engine to use. Must follow format 'OpenSearch_X.Y' (e.g., 'OpenSearch_2.11')
• identity_center_optionsobject({...}), default nullConfiguration block for enabling and managing IAM Identity Center integration within a domain
• ip_address_typestring, default nullThe IP address type for the endpoint. Valid values are ipv4 and dualstack
• log_publishing_optionsany, default [...]Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource
• off_peak_window_optionsany, default {...}Configuration to add Off Peak update options
• outbound_connectionsany, default {}Map of AWS OpenSearch outbound connections to create
• package_associationsmap(string), default {}Map of package association IDs to associate with the domain
• regionstring, default nullRegion where this resource will be managed. Defaults to the Region set in the provider configuration
• saml_optionsany, default {}SAML authentication options for an AWS OpenSearch Domain
• security_group_descriptionstring, default nullDescription of the security group created
• security_group_namestring, default nullName to use on security group created
• security_group_rulesany, default {}Security group ingress and egress rules to add to the security group created
• security_group_tagsmap(string), default {}A map of additional tags to add to the security group created
• security_group_use_name_prefixbool, default trueDetermines whether the security group name (security_group_name) is used as a prefix
• software_update_optionsany, default {...}Software update options for the domain
• tagsmap(string), default {}A map of tags to add to all resources
• timeoutsmap(string), default {}Create and delete timeout configurations for the domain
• vpc_endpointsany, default {}Map of VPC endpoints to create for the domain
• vpc_optionsany, default {}Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-vpc-limitations))