{
    "AWSTemplateFormatVersion":"2010-09-09",
    "Description":"AES - Flowlogs - ES Domain.  **Attention** This template creates AWS resources that will incur charges on your account.",
    "Parameters":{
        "NetworkStackName": {
            "Description": "Name of an active CloudFormation stack that contains the networking resources.",
            "Type": "String"
        },
        "ElasticsearchDomainName":{
            "Description": "Name of the Elasticsearch Domain you wish to create.",
            "Type": "String",
            "MinLength" : 3,
            "MaxLength" : 28,
            "AllowedPattern" : "^[a-z][-a-z0-9]*$"
        },
	"AuthRoleARN":{
            "Description": "Auth role for Cognito Identity Pool Request Signing.",
            "Type": "String"
	}
    },
    "Resources":{
        "ElasticsearchSecurityGroup":{
            "Type":"AWS::EC2::SecurityGroup",
            "Properties":{
                "GroupDescription":"Rules for allowing access to the ES cluster",
                "VpcId":{ "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCID"}},     	
                "SecurityGroupIngress":
                [
                    {
                        "IpProtocol":"tcp",
                        "FromPort":"443",
                        "ToPort":"443",
			"CidrIp":{ "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCCIDRBlock"}}
                    }
                ],
		"Tags":[
                    {"Key": "Name","Value": {"Fn::Join": ["",[{"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-EnvTag"}},"-elasticsearch-sg"]]}}
                ]
            }
        },
        "ElasticsearchDomain":{
            "Type":"AWS::Elasticsearch::Domain",
            "Properties":{
                "DomainName":{"Ref":"ElasticsearchDomainName"},
		"ElasticsearchVersion":"7.1",
                "ElasticsearchClusterConfig":{
                    "DedicatedMasterEnabled":"false",
                    "InstanceCount":"1",
                    "InstanceType":"i3.large.elasticsearch"
                },
                "NodeToNodeEncryptionOptions":{"Enabled":"true"},
		"EncryptionAtRestOptions":{"Enabled":"true"},
                "AccessPolicies":{
                    "Version":"2012-10-17",
                    "Statement":[
                        {
                            "Effect":"Allow",
                            "Principal":{
                                "AWS":{"Ref":"AuthRoleARN"}
                            },
                            "Action":["es:*"],
                            "Resource":{"Fn::Join":["",["arn:aws:es:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":domain/",{"Ref":"ElasticsearchDomainName"},"/*"]]}
                        }
                    ]
                },
                "AdvancedOptions":{
                    "rest.action.multi.allow_explicit_index":"true"
                },
		
                "VPCOptions" : {
                    "SubnetIds" : [
                        { "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PrivateSubnetApp0"}}
                    ],
                    "SecurityGroupIds" : [
                        { "Ref" : "ElasticsearchSecurityGroup" }
                    ]
                },
		"Tags":[
                    {"Key": "Name","Value": {"Fn::Join": ["",[{"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-EnvTag"}},"-elasticsearch-domain"]]}}
                ]
            }
        }
    },                                                                                              
    "Outputs":{
        "StackName":{
            "Description":"This is the stack name.",
            "Value": {"Ref":"AWS::StackName"},
            "Export" : { "Name" : {"Fn::Sub": "${AWS::StackName}-StackName" }}
	},
        "ElasticsearchEndpoint":{
            "Description":"The endpoint of the Elasticsearch Domain",
            "Value":{"Fn::GetAtt":["ElasticsearchDomain","DomainEndpoint"]},
	    "Export" : { "Name" : {"Fn::Sub": "${AWS::StackName}-ElasticsearchEndpoint" }}
        }
    }
} 	
    
