Is it exist an Easy way to use this module with cloudposse/elasticsearch/aws?

[vvchik]

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

In cloudposse/elasticsearch/aws we have following variables

log_publishing_application_cloudwatch_log_group_arn
log_publishing_audit_cloudwatch_log_group_arn
log_publishing_index_cloudwatch_log_group_arn
log_publishing_search_cloudwatch_log_group_arn

That module also have the variable create_iam_service_linked_role; if it is set to true, it will create AWSServiceRoleForAmazonElasticsearchService with the attached AWS managed policy for ES

If it is set to false it will use existing AWSServiceRoleForAmazonElasticsearchService role and attach it to the created Domain

This module creates its own role that lacks ES-required capabilities.
And also creates a policy attached to the cloud watch log stream without principal,
so permissions should be set in the assumed role.
So terraform fails with an error.

ValidationException: The Resource Access Policy specified for the CloudWatch Logs log group dev-testnet-opensearch-cloudwatch does not grant sufficient permissions for Amazon OpenSearch Service to create a log stream. Please check the Resource Access Policy.

Expected Behavior

I want to be able to create a policy attached to the log stream like follow, (with the principal):

data "aws_iam_policy_document" "example" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }

    actions = [
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
      "logs:CreateLogStream",
    ]

    resources = ["arn:aws:logs:*"]
  }
}

So that gives a possibility to use the original ES role from another module.
A working example in plain teraform https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticsearch_domain#log-publishing-to-cloudwatch-logs

Use Case

Should be possible to use these two modules together, without hacks.

Describe the Ideal Solution

Possibility to define own aws_iam_policy_document to attach to log stream

or add parametric values to an existing policy with the possibility to set principal