CDK - 如何在用戶數據中使用 Opensearch Domain MasterUserPassword

Question

在Opensearch L2 構造中，如果您添加細粒度的訪問控制，Secrets Manager 中將為您創建一個 Secret（可通過masterUserPassword訪問）。

我想稍后在CloudformationInit中使用這個生成的密碼，但不確定如何使用。

from aws_cdk import aws_ec2 as ec2
from aws_cdk import aws_iam as iam
from aws_cdk import aws_opensearchservice as opensearch
from aws_cdk import aws_s3 as s3


class OpensearchStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        **kwargs,
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "generatorVpc", max_azs=2)
        bucket = s3.Bucket(self, "My Bucket")
        domain = opensearch.Domain(self,"OpensearchDomain",
            version=opensearch.EngineVersion.OPENSEARCH_1_3,
            vpc=vpc,
            fine_grained_access_control=opensearch.AdvancedSecurityOptions(
                master_user_name="osadmin",
            ),
        )
        instance = ec2.Instance(self, "Instance",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                instance_class=ec2.InstanceClass.M5,
                instance_size=ec2.InstanceSize.LARGE,
            ),
            machine_image=ec2.MachineImage.latest_amazon_linux(
                generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
            ),
            init=ec2.CloudFormationInit.from_elements(
                ec2.InitFile.from_string(
                            file_name="/home/ec2-user/logstash-8.4.0/config/my_conf.conf",
                            owner="ec2-user",
                            mode="00755",
                            content=f"""input {{
    s3 {{
        bucket => "{bucket.bucket_name}"
        region => "{self.region}"
    }}
}}
output {{
    opensearch {{
        hosts => ["{domain.domain_endpoint}:443"]
        user => "{domain.master_user_password.secrets_manager("What secret id do I put here?", json_field="username")}"
        password => "{domain.master_user_password.secrets_manager("What secret id do I put here?", json_field="password")}"
        ecs_compatibility => disabled
    }}
}}
""",
                )
            )
        )

由於SecretValue沒有secretId屬性，我不確定如何確定masterUserPassword的 Secret ID/Arn。

有沒有更好的方法在我的 logstash 配置中獲取生成的憑據？

Answer 1

username值很簡單，因為您明確將其設置為osadmin 。 要獲取password引用，請在域的master_user_password屬性上調用to_string方法，這是一個SecretValue ：

domain.master_user_password.to_string()

在合成模板中，這會變成對密碼密碼的 CloudFormation 動態引用。 模板不知道實際密碼。 它將在部署時在雲端解決。

SecretsValue.secrets_manager static 方法也合成相同的動態引用。 但是，您不能使用它。 該方法需要秘密 ID，如果Domain構造為您生成秘密，則不會公開該 ID。

Answer 2

我最終向CloudFormationInit添加了命令以從 Secrets Manager 中提取操作系統憑證並進行了查找和替換工作

from aws_cdk import aws_ec2 as ec2
from aws_cdk import aws_opensearchservice as opensearch
from aws_cdk import aws_s3 as s3
from aws_cdk import aws_secretsmanager as secretsmanager
from aws_cdk import Stack
from constructs import Construct


class OpensearchStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        **kwargs,
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "generatorVpc", max_azs=2)
        bucket = s3.Bucket(self, "My Bucket")
        domain = opensearch.Domain(self,"OpensearchDomain",
            version=opensearch.EngineVersion.OPENSEARCH_1_3,
            vpc=vpc,
            fine_grained_access_control=opensearch.AdvancedSecurityOptions(
                master_user_name="osadmin",
            ),
        )
        # Get the domain secret
        domain_secret: secretsmanager.Secret = domain.node.find_child("MasterUser")
        instance = ec2.Instance(self, "Instance",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                instance_class=ec2.InstanceClass.M5,
                instance_size=ec2.InstanceSize.LARGE,
            ),
            machine_image=ec2.MachineImage.latest_amazon_linux(
                generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
            ),
            init=ec2.CloudFormationInit.from_elements(
                ec2.InitFile.from_string(
                            file_name="/home/ec2-user/logstash-8.4.0/config/my_conf.conf",
                            owner="ec2-user",
                            mode="00755",
                            content=f"""input {{
    s3 {{
        bucket => "{bucket.bucket_name}"
        region => "{self.region}"
    }}
}}
output {{
    opensearch {{
        hosts => ["{domain.domain_endpoint}:443"]
        user => "REPLACE_WITH_USERNAME"
        password => "REPLACE_WITH_PASSWORD"
        ecs_compatibility => disabled
    }}
}}
""",
                ),
                ec2.InitPackage.yum("jq"),  # install jq
                ec2.InitCommand.shell_command(
                    shell_command=(
                        f"aws configure set region {self.region} && "
                        # save secret value to variable
                        f"OS_SECRET=$(aws secretsmanager get-secret-value --secret-id {domain_secret.secret_arn} "
                        "--query SecretString) && "
                        # Pull values from json string
                        "OS_USER=$(echo $OS_SECRET | jq -r '. | fromjson | .username') && "
                        "OS_PASS=$(echo $OS_SECRET | jq -r '. | fromjson | .password') && "
                        # Find and replace
                        "sed -i \"s/REPLACE_WITH_USERNAME/$OS_USER/g\" /home/ec2-user/logstash-8.4.0/config/my_conf.conf && "
                        "sed -i \"s/REPLACE_WITH_PASSWORD/$OS_PASS/g\" /home/ec2-user/logstash-8.4.0/config/my_conf.conf"
                    ),
                ),
            )
        )
        # Don't forget to grant the instance read access to the secret
        domain_secret.grant_read(instance.role)