AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  SubnetIds:
    Type: "List<AWS::EC2::Subnet::Id>"
    Description: "Comma-delimited list of subnet IDs within which the ElasticSearch instance will be provisioned."
  BlockStoreSizeGB:
    Type: Number
    Default: 100
    Description: "The size of the Elastic Block Store to have back ElasticSearch, in GigaBytes."
Resources:
   # Not currently supported by cloudformation.
#  ESServiceLinkedRole:
#    Type: "AWS::IAM::ServiceLinkedRole"
#    Properties:
#      AWSServiceName: "es.amazonaws.com"
#      Description: "Role to enable Amazon ES to manage your cluster."
  MozDefElasticSearch:
    Type: "AWS::Elasticsearch::Domain"
    Properties:
      VPCOptions:
        SubnetIds: !Ref SubnetIds 
      EBSOptions:
        EBSEnabled: true
        VolumeType: "gp2"
        VolumeSize: !Ref BlockStoreSizeGB
      ElasticsearchVersion: "5.6"
      Tags:
        -
          Key: "application"
          Value: "mozdef"
Outputs:
  ElasticsearchDomainArn:
    Description: "ARN of the provisioned ElasticSearch Cluster"
    Value: !GetAtt MozDefElasticSearch.DomainArn
    Export:
      Name: "ElasticsearchDomainArn"
  ElasticsearchDomainEndpoint:
    Description: "Endpoint of the provisioned ElasticSearch Cluster"
    Value: !GetAtt MozDefElasticSearch.DomainEndpoint
    Export:
      Name: "ElasticsearchDomainEndpoint"


---
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  SubnetIds:
    Type: "List<AWS::EC2::Subnet::Id>"
    Description: "Comma-delimited list of subnet IDs within which the ElasticSearch instance will be provisioned."
  BlockStoreSizeGB:
    Type: Number
    Default: 100
    Description: "The size of the Elastic Block Store to have back ElasticSearch, in GigaBytes."
Resources:
## Not currently supported by cloudformation.
#  ESServiceLinkedRole:
#    Type: "AWS::IAM::ServiceLinkedRole"
#    Properties:
#      AWSServiceName: "es.amazonaws.com"
#      Description: "Role to enable Amazon ES to manage your cluster."
  MozDefElasticSearch:
    Type: "AWS::Elasticsearch::Domain"
    Properties:
      VPCOptions:
        SubnetIds: !Ref SubnetIds
      EBSOptions:
        EBSEnabled: true
        VolumeType: "gp2"
        VolumeSize: !Ref BlockStoreSizeGB
      ElasticsearchVersion: "5.6"
      AccessPolicies:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              AWS: "*"
            Action: "es:*"
      Tags:
        -
          Key: "application"
          Value: "mozdef"
Outputs:
  ElasticsearchDomainArn:
    Description: "ARN of the provisioned ElasticSearch Cluster"
    Value: !GetAtt MozDefElasticSearch.DomainArn
    Export:
      Name: "ElasticsearchDomainArn"
  ElasticsearchDomainEndpoint:
    Description: "Endpoint of the provisioned ElasticSearch Cluster"
    Value: !GetAtt MozDefElasticSearch.DomainEndpoint
    Export:
      Name: "ElasticsearchDomainEndpoint"

Add access policy for ES This allow access from all, thus, make sure you use a private subnet. Security will be enforced by the access proxy.
Add access policy for ES
This allow access from all, thus, make sure you use a private subnet.
Security will be enforced by the access proxy.

For test purposes you can spawn an EC2 instance in the same VPC and add
an interface on the ES subnet, then just ssh -D1080 and use your browser
to go to the kibana interface (you can find this on the AWS console for
ES)
