[WIP] r/aws_elasticsearchdomain: add support for cognito_options

aws/resource_aws_elasticsearch_domain.go

@@ -229,6 +229,33 @@ func resourceAwsElasticSearchDomain() *schema.Resource {
 				Default:  "1.5",
 				ForceNew: true,
 			},
+			"cognito_options": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: false,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  true,
+						},
+						"user_pool_id": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"identity_pool_id": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"role_arn": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
 
 			"tags": tagsSchema(),
 		},
@@ -384,6 +411,21 @@ func resourceAwsElasticSearchDomainCreate(d *schema.ResourceData, meta interface
 		}
 	}
 
+	if v, ok := d.GetOk("cognito_options"); ok {
+
+		options := v.([]interface{})
+		if len(options) > 1 {
+			return fmt.Errorf("Only a single cognito_options block is expected")
+		} else if len(options) == 1 {
+			if options[0] == nil {
+				return fmt.Errorf("At least one field is expected inside cognito_options")
+			}
+
+			s := options[0].(map[string]interface{})
+			input.CognitoOptions = expandESCognitoOptions(s)
+		}
+	}
+
 	log.Printf("[DEBUG] Creating ElasticSearch domain: %s", input)
 
 	// IAM Roles can take some time to propagate if set in AccessPolicies and created in the same terraform
@@ -402,6 +444,9 @@ func resourceAwsElasticSearchDomainCreate(d *schema.ResourceData, meta interface
 			if isAWSErr(err, "ValidationException", "Domain is still being deleted") {
 				return resource.RetryableError(err)
 			}
+			if isAWSErr(err, "ValidationException", "Amazon Elasticsearch must be allowed to use the passed role") {
+				return resource.RetryableError(err)
+			}
 
 			return resource.NonRetryableError(err)
 		}
@@ -504,6 +549,10 @@ func resourceAwsElasticSearchDomainRead(d *schema.ResourceData, meta interface{}
 	if err != nil {
 		return err
 	}
+	err = d.Set("cognito_options", flattenESCognitoOptions(ds.CognitoOptions))
+	if err != nil {
+		return err
+	}
 	if ds.SnapshotOptions != nil {
 		d.Set("snapshot_options", map[string]interface{}{
 			"automated_snapshot_start_hour": *ds.SnapshotOptions.AutomatedSnapshotStartHour,
@@ -634,6 +683,12 @@ func resourceAwsElasticSearchDomainUpdate(d *schema.ResourceData, meta interface
 		input.VPCOptions = expandESVPCOptions(s)
 	}
 
+	if d.HasChange("cognito_options") {
+		options := d.Get("cognito_options").([]interface{})
+		s := options[0].(map[string]interface{})
+		input.CognitoOptions = expandESCognitoOptions(s)
+	}
+
 	if d.HasChange("log_publishing_options") {
 		input.LogPublishingOptions = make(map[string]*elasticsearch.LogPublishingOption)
 		options := d.Get("log_publishing_options").(*schema.Set).List()

aws/resource_aws_elasticsearch_domain_test.go

@@ -293,6 +293,26 @@ func TestAccAWSElasticSearchDomain_LogPublishingOptions(t *testing.T) {
 	})
 }
 
+func TestAccAWSElasticSearchDomain_CognitoOptions(t *testing.T) {
+	var domain elasticsearch.ElasticsearchDomainStatus
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckESDomainDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccESDomainConfig_CognitoOptions(acctest.RandInt()),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckESDomainExists("aws_elasticsearch_domain.example", &domain),
+					resource.TestCheckResourceAttr(
+						"aws_elasticsearch_domain.example", "elasticsearch_version", "6.0"),
+					testAccCheckESCognitoOptions(true, &domain),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckESNumberOfSecurityGroups(numberOfSecurityGroups int, status *elasticsearch.ElasticsearchDomainStatus) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		count := len(status.VPCOptions.SecurityGroupIds)
@@ -501,6 +521,16 @@ func testAccCheckESEncrypted(encrypted bool, status *elasticsearch.Elasticsearch
 	}
 }
 
+func testAccCheckESCognitoOptions(enabled bool, status *elasticsearch.ElasticsearchDomainStatus) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conf := status.CognitoOptions
+		if *conf.Enabled != enabled {
+			return fmt.Errorf("CognitoOptions not set properly. Given: %t, Expected: %t", *conf.Enabled, enabled)
+		}
+		return nil
+	}
+}
+
 func testAccLoadESTags(conf *elasticsearch.ElasticsearchDomainStatus, td *elasticsearch.ListTagsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := testAccProvider.Meta().(*AWSClient).esconn
@@ -1064,3 +1094,68 @@ resource "aws_elasticsearch_domain" "example" {
 }
 `, randInt, randInt, randInt)
 }
+
+func testAccESDomainConfig_CognitoOptions(randInt int) string {
+	return fmt.Sprintf(`
+resource "aws_cognito_user_pool" "example" {
+  name = "tf-test-%d"
+}
+
+resource "aws_cognito_user_pool_domain" "example" {
+  domain = "tf-test-%d"
+	user_pool_id = "${aws_cognito_user_pool.example.id}"
+}
+
+resource "aws_cognito_identity_pool" "example" {
+  identity_pool_name = "tf_test_%d"
+	allow_unauthenticated_identities = false
+}
+
+resource "aws_iam_role" "example" {
+	name = "tf-test-%d" 
+	path = "/service-role/"
+	assume_role_policy = "${data.aws_iam_policy_document.assume-role-policy.json}"
+}
+
+data "aws_iam_policy_document" "assume-role-policy" {
+  statement {
+    sid     = ""
+		actions = ["sts:AssumeRole"]
+		effect  = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["es.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "example" {
+	role       = "${aws_iam_role.example.name}"
+	policy_arn = "arn:aws:iam::aws:policy/AmazonESCognitoAccess"
+}
+
+resource "aws_elasticsearch_domain" "example" {
+	domain_name = "tf-test-%d"
+
+	elasticsearch_version = "6.0"
+
+  cognito_options {
+		enabled = true
+		user_pool_id = "${aws_cognito_user_pool.example.id}"
+		identity_pool_id = "${aws_cognito_identity_pool.example.id}"
+		role_arn = "${aws_iam_role.example.arn}"
+	}
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  depends_on = [
+		"aws_iam_role.example",
+		"aws_iam_role_policy_attachment.example"
+	]
+}
+`, randInt, randInt, randInt, randInt, randInt)
+}

aws/structure.go

@@ -1088,6 +1088,51 @@ func flattenESClusterConfig(c *elasticsearch.ElasticsearchClusterConfig) []map[s
 	return []map[string]interface{}{m}
 }
 
+func expandESCognitoOptions(m map[string]interface{}) *elasticsearch.CognitoOptions {
+	options := elasticsearch.CognitoOptions{}
+
+	if cognitoEnabled, ok := m["enabled"]; ok {
+		options.Enabled = aws.Bool(cognitoEnabled.(bool))
+
+		if cognitoEnabled.(bool) {
+
+			if v, ok := m["user_pool_id"]; ok && v.(string) != "" {
+				options.UserPoolId = aws.String(v.(string))
+			}
+			if v, ok := m["identity_pool_id"]; ok && v.(string) != "" {
+				options.IdentityPoolId = aws.String(v.(string))
+			}
+			if v, ok := m["role_arn"]; ok && v.(string) != "" {
+				options.RoleArn = aws.String(v.(string))
+			}
+		}
+	}
+
+	return &options
+}
+
+func flattenESCognitoOptions(c *elasticsearch.CognitoOptions) []map[string]interface{} {
+	m := map[string]interface{}{}
+
+	if c.Enabled != nil {
+		m["enabled"] = *c.Enabled
+	}
+
+	if aws.BoolValue(c.Enabled) {
+		if c.UserPoolId != nil {
+			m["user_pool_id"] = *c.UserPoolId
+		}
+		if c.IdentityPoolId != nil {
+			m["identity_pool_id"] = *c.IdentityPoolId
+		}
+		if c.RoleArn != nil {
+			m["role_arn"] = *c.RoleArn
+		}
+	}
+
+	return []map[string]interface{}{m}
+}
+
 func flattenESEBSOptions(o *elasticsearch.EBSOptions) []map[string]interface{} {
 	m := map[string]interface{}{}
 

website/docs/r/elasticsearch_domain.html.markdown

@@ -120,6 +120,14 @@ Security Groups and Subnets referenced in these attributes must all be within th
 * `cloudwatch_log_group_arn` - (Required) ARN of the Cloudwatch log group to which log needs to be published.
 * `enabled` - (Optional, Default: true) Specifies whether given log publishing option is enabled or not.
 
+**cognito_options** supports the following attribute:
+
+AWS documentation: [Amazon Cognito Authentication for Kibana](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html)
+
+* `user_pool_id` - (Required) ID of the Cognito User Pool to use
+* `identity_pool_id` - (Required) ID of the Cognito Identity Pool to use
+* `role_arn` - (Required) ARN of the IAM role that has the AmazonESCognitoAccess policy attached
+
 ## Attributes Reference
 
 In addition to all arguments above, the following attributes are exported: