lambda-elasticsearch-kibana v1.125.0

Lambda >> ElasticSearch >> Kibana

This AWS Solutions Construct implements the AWS Lambda function and Amazon ElasticSearch Service with the least privileged permissions.

Architecture

Here is a minimal deployable pattern definition in Typescript:

import { LambdaToElasticSearchAndKibana } from 'lambda-elasticsearch-kibana';
import { Aws } from "@aws-cdk/core";

const lambdaProps: lambda.FunctionProps = {
    code: lambda.Code.fromAsset(`${__dirname}/lambda`),
    runtime: lambda.Runtime.NODEJS_14_X,
    handler: 'index.handler'
};

new LambdaToElasticSearchAndKibana(this, 'test-lambda-elasticsearch-kibana', {
    lambdaFunctionProps: lambdaProps,
    domainName: 'test-domain',
    // TODO: Ensure the Cognito domain name is globally unique
    cognitoDomainName: 'globallyuniquedomain' + Aws.ACCOUNT_ID;
});

Initializer

new LambdaToElasticSearchAndKibana(scope: Construct, id: string, props: LambdaToElasticSearchAndKibanaProps);

Parameters

• scope Construct
• id string
• props LambdaToElasticSearchAndKibanaProps

Pattern Construct Props

Pattern Properties

Lambda Function

This pattern requires a lambda function that can post data into the ElasticSearch. A sample function is provided here.

Default settings

Out of the box implementation of the Construct without any override will set the following defaults:

AWS Lambda Function

• Configure limited privilege access IAM role for Lambda function
• Enable reusing connections with Keep-Alive for NodeJs Lambda function
• Enable X-Ray Tracing
• Set Environment Variables
  • (default) DOMAIN_ENDPOINT
  • AWS_NODEJS_CONNECTION_REUSE_ENABLED (for Node 12.x and higher functions)

Amazon Cognito

• Set password policy for User Pools
• Enforce the advanced security mode for User Pools

Amazon ElasticSearch Service

• Deploy best practices CloudWatch Alarms for the ElasticSearch Domain
• Secure the Kibana dashboard access with Cognito User Pools
• Enable server-side encryption for ElasticSearch Domain using AWS managed KMS Key
• Enable node-to-node encryption for ElasticSearch Domain
• Configure the cluster for the Amazon ES domain