This is a sample implementation for Amazon OpenSearch Service deployed in VPC with CDK (TypeScript). In this sample, all resources are deployed in private subnet, and end users have access to the OpenSearch Dashboards via port forwading in AWS Session Manager, avoiding need for exposing SSH port to the internet. This sample also contains indexing data into OpenSearch from AWS Lambda deployed in VPC.

• Configuration of AWS profile
• Node.js (Active LTS version preferred)
• Docker
  • Docker is used to create packages for Lambda function.
• Session Manager Plugin
  • Session Manager Plugin is required for access to OpenSearch Dashboards using Session Manager.

Run the following commands to deploy the sample in this directory.

npm ci
npx cdk bootstrap
npx cdk deploy

Initial deployment usually takes about 20 to 30 minutes. You can also use npx cdk deploy command to modify deployed resources. If the deployment completes successfully, you will get outputs like below. Outputs values will be used in the following steps.

 ✅  OpensearchVpcCdkStack

✨  Deployment time: 1521.61s

Outputs:
OpensearchVpcCdkStack.BastionHostBastionHostIdC743CBD6 = i-xxxxxxxx
OpensearchVpcCdkStack.IndexingFunctionName = OpensearchVpcCdkStack-DataIndexxxxxxx
OpensearchVpcCdkStack.OpenSearchDomainHost = vpc-domainxxxxxxxxxx.ap-northeast-1.es.amazonaws.com
Stack ARN:
arn:aws:cloudformation:ap-northeast-1:123456789012:stack/OpensearchVpcCdkStack/078d0be0-e3c5-11ed-8d9c-0a455fdf670f

✨  Total time: 1543.55s

You can run this lambda to index sample data to OpenSearch. If you just want to access OpenSearch Dashboards, you do not need to do this step. Execute the following command after replacing the <IndexingFunctionName> to the above output value.

aws lambda invoke --function-name <IndexingFunctionName> --cli-binary-format raw-in-base64-out --payload '{ "productId": "product_123", "price": 200 }' /dev/stdout

Run the following command to access OpenSearch Dashboards, after replacing <BastionHostId> and <OpenSearchDomainHost> to the values output by cdk.

aws ssm start-session --target <BastionHostId> --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"portNumber":["443"],"localPortNumber":["8157"], "host":["<OpenSearchDomainHost>"]}'

After starting session, access https://localhost:8157/_dashboards in your browser. Warning may appear because the domain (*.<region>.es.amazonaws.com) in the certificate is different from the domain (localhost) you access. Since this does not cause serious problems, continue accessing the site, and you will see OpenSearch Dashboards like below.