### Run Developer Sandbox Setup

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Execute this command to start OpenSearch and Dashboards, build the provider, and apply the sandbox configuration.

```shell
make dev
```

--------------------------------

### Manual Acceptance Test Setup

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Manually set up and run acceptance tests without using the Makefile. This involves starting OpenSearch via Docker Compose, setting environment variables for the cluster URL and logging, and then executing the tests.

```sh
export OSS_IMAGE="opensearchproject/opensearch:2"
docker compose up -d
docker compose ps -a  # Checks that the process is running
# Before OS 2.12.0
# export OPENSEARCH_URL=http://admin:admin@localhost:9200
export OPENSEARCH_URL=http://admin:myStrongPassword123%40456@localhost:9200
export TF_LOG=INFO
TF_ACC=1 go test ./... -v -parallel 20 -cover -short
```

--------------------------------

### Clone and Apply Terraform Example

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/examples/README.md

Instructions for cloning the repository and applying a Terraform configuration for an example. Ensure you navigate to the specific example directory before running 'terraform apply'.

```sh
$ git clone https://github.com/opensearch-project/terraform-provider-opensearch
$ cd terraform-provider-opensearch/examples/ingest_pipeline
$ terraform apply
...
```

--------------------------------

### Generate Documentation

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Run this command to generate example usage documentation from resource configurations.

```shell
make docs
```

--------------------------------

### Start Debuggable Provider

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Build the provider executable and start it in debug mode. This is useful for debugging provider logic.

```console
$ go build
$ ./terraform-provider-opensearch -debuggable # or start in debug mode in your IDE
```

--------------------------------

### Create a Full User, Role, and Role Mapping Example

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/user.md

This example demonstrates the creation of an OpenSearch role, a user, and then maps the user to that role. This is useful for defining granular access control within OpenSearch. The user's password can be provided via a variable.

```terraform
resource "opensearch_role" "reader" {
  role_name   = "app_reader"
  description = "App Reader Role"

  index_permissions {
    index_patterns  = ["app-*"]
    allowed_actions = ["get", "read", "search"]
  }
}

resource "opensearch_user" "reader" {
  username = "app-reader"
  password = var.password
}

resource "opensearch_roles_mapping" "reader" {
  role_name   = opensearch_role.reader.id
  description = "App Reader Role"
  users       = [opensearch_user.reader.id]
}
```

--------------------------------

### Basic opensearch_cluster_settings Resource

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/cluster_settings.md

Example of how to configure cluster-wide settings like maximum shards per node and index auto-creation patterns.

```terraform
resource "opensearch_cluster_settings" "global" {
  cluster_max_shards_per_node = 10
  action_auto_create_index    = "my-index-000001,index10,-index1*,+ind*"
}
```

--------------------------------

### Create an OpenSearch index with aliases

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/index.md

This example demonstrates creating an OpenSearch index with a specific alias and defining its mappings and shard/replica configuration using JSON encoding.

```terraform
resource "opensearch_index" "index" {
  name = "sample"
  aliases = jsonencode(
   {
    "log": {
      "is_write_index": true
    }
  }
  )
  number_of_replicas = "1"
  number_of_shards = "1"
  mappings = jsonencode({
    "properties": {
      "age": {
        "type": "integer"
      }
    }
  })
}
```

--------------------------------

### Minimal ML Connector with 'http' protocol

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

This example shows a minimal ML Connector configuration using the 'http' protocol to connect to OpenAI with an API Key.

```APIDOC
## opensearch_ml_connector.minimal_http

### Description
Minimal ML Connector with only the mandatory attributes connecting to OpenAI with an API Key.

### Attributes
*   `name` (Required) - Name of the ML connector.
*   `description` (Optional) - Description of the ML connector.
*   `version` (Required) - Version of the ML connector.
*   `protocol` (Required) - The protocol to use for the connection (e.g., "aws_sigv4", "http").
*   `credential` (Required) - Authentication credentials for the connector.
    *   `openAIKey` (Required for http protocol with OpenAI)
*   `parameters` (Required) - Parameters specific to the protocol and service.
    *   `endpoint` (Required for http protocol) - The API endpoint.
    *   `max_tokens` (Optional) - Maximum tokens for the completion.
    *   `temperature` (Optional) - Temperature for the completion.
    *   `model` (Optional) - The model to use for completion.
*   `actions` (Required) - Defines the actions the connector can perform.
    *   `action_type` (Required) - Type of action (e.g., "predict").
    *   `method` (Required) - HTTP method for the action (e.g., "POST").
    *   `url` (Required) - URL for the action endpoint.
    *   `headers` (Optional) - HTTP headers for the request.
    *   `request_body` (Optional) - Request body template.
    *   `pre_process_function` (Optional) - Function to pre-process the request.
    *   `post_process_function` (Optional) - Function to post-process the response.

### Example
```terraform
resource "opensearch_ml_connector" "minimal_http" {
  name        = "minimal_http"
  description = "Minimal ML Connector with only the mandatory attributes connecting to OpenAI with an API Key"
  version     = "1"
  protocol    = "http"
  credential = {
    openAIKey = "<OpenAI API Key>"
  }
  parameters = {
    endpoint    = "api.openai.com"
    max_tokens  = 7
    temperature = 0
    model       = "gpt-4.1"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://$${parameters.endpoint}/v1/completions"
    headers     = {
      Authorization = "Bearer $${credential.openAIKey}"
    }
    request_body = "{ \"model\": \"$${parameters.model}\", \"prompt\": \"$${parameters.prompt}\", \"max_tokens\": \"$${parameters.max_tokens}\", \"temperature\": \"$${parameters.temperature}\" }"
  }
}
```
```

--------------------------------

### ML Connector with Pre and Post processing functions

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

This example shows an ML Connector configuration that includes pre-processing and post-processing functions for request and response handling.

```APIDOC
## opensearch_ml_connector.with_pre_post_processing

### Description
ML Connector pre and post processing functions.

### Attributes
*   `name` (Required) - Name of the ML connector.
*   `description` (Optional) - Description of the ML connector.
*   `version` (Required) - Version of the ML connector.
*   `protocol` (Required) - The protocol to use for the connection (e.g., "aws_sigv4", "http").
*   `credential` (Required) - Authentication credentials for the connector.
    *   `roleArn` (Required for IAM Role assumption) - ARN of the IAM Role.
    *   `access_key` (Required for direct credentials) - AWS access key.
    *   `secret_key` (Required for direct credentials) - AWS secret key.
    *   `session_token` (Required for direct credentials) - AWS session token.
*   `parameters` (Required) - Parameters specific to the protocol and service.
    *   `region` (Required for aws_sigv4) - AWS region.
    *   `service_name` (Required for aws_sigv4) - AWS service name.
*   `actions` (Required) - Defines the actions the connector can perform.
    *   `action_type` (Required) - Type of action (e.g., "predict").
    *   `method` (Required) - HTTP method for the action (e.g., "POST").
    *   `url` (Required) - URL for the action endpoint.
    *   `headers` (Optional) - HTTP headers for the request.
    *   `request_body` (Optional) - Request body template.
    *   `pre_process_function` (Optional) - Function to pre-process the request.
    *   `post_process_function` (Optional) - Function to post-process the response.

### Example
```terraform
resource "opensearch_ml_connector" "with_pre_post_processing" {
  name        = "with_pre_post_processing"
  description = "ML Connector pre and post processing functions"
  version     = "1"
  protocol    = "aws_sigv4"
  credential = {
    roleArn = "<ARN of IAM Role with permissions to access the AWS Bedrock model>"
  }
  parameters = {
    region       = "eu-west-3"
    service_name = "bedrock"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://bedrock-runtime.$${parameters.region}.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke"
    headers = {
      Content-Type         = "application/json"
      x-amz-content-sha256 = "required"
    }
    request_body = "{ \"inputText\": \"$${parameters.inputText}\" }"
    pre_process_function  = "connector.pre_process.bedrock.embedding"
    post_process_function = "connector.post_process.bedrock.embedding"
  }
}
```
```

--------------------------------

### Create a Data Stream

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/data_stream.md

This example shows how to create a data stream named 'foo-data-stream'. It depends on a composable index template 'foo-template' which defines the index pattern and enables data stream support.

```terraform
resource "opensearch_composable_index_template" "foo" {
  name = "foo-template"
  body = <<EOF
{
  "index_patterns": ["foo-data-stream*"],
  "data_stream": {}
}
EOF
}

resource "opensearch_data_stream" "foo" {
  name       = "foo-data-stream"
  depends_on = [opensearch_composable_index_template.foo]
}
```

--------------------------------

### Customize Sandbox Images and Password

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Override OpenSearch and OpenSearch Dashboards images, and set the initial admin password before running the sandbox setup.

```shell
OSS_IMAGE=opensearchproject/opensearch:2.17.0 \
OSS_DASHBOARDS_IMAGE=opensearchproject/opensearch-dashboards:2.17.0 \
OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123@456 \
make dev-up
```

--------------------------------

### Minimal ML Connector with 'aws_sigv4' protocol using direct credentials

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

This example shows a minimal ML Connector configuration for self-managed OpenSearch using the 'aws_sigv4' protocol with direct AWS credentials.

```APIDOC
## opensearch_ml_connector.minimal_self_managed_aws_sigv4

### Description
AWS Bedrock connector using pre-assumed temporary credentials for self-managed clusters.

### Attributes
*   `name` (Required) - Name of the ML connector.
*   `description` (Optional) - Description of the ML connector.
*   `version` (Required) - Version of the ML connector.
*   `protocol` (Required) - The protocol to use for the connection (e.g., "aws_sigv4", "http").
*   `credential` (Required) - Authentication credentials for the connector.
    *   `roleArn` (Required for IAM Role assumption) - ARN of the IAM Role.
    *   `access_key` (Required for direct credentials) - AWS access key.
    *   `secret_key` (Required for direct credentials) - AWS secret key.
    *   `session_token` (Required for direct credentials) - AWS session token.
*   `parameters` (Required) - Parameters specific to the protocol and service.
    *   `region` (Required for aws_sigv4) - AWS region.
    *   `service_name` (Required for aws_sigv4) - AWS service name.
*   `actions` (Required) - Defines the actions the connector can perform.
    *   `action_type` (Required) - Type of action (e.g., "predict").
    *   `method` (Required) - HTTP method for the action (e.g., "POST").
    *   `url` (Required) - URL for the action endpoint.
    *   `headers` (Optional) - HTTP headers for the request.
    *   `request_body` (Optional) - Request body template.
    *   `pre_process_function` (Optional) - Function to pre-process the request.
    *   `post_process_function` (Optional) - Function to post-process the response.

### Example
```terraform
resource "opensearch_ml_connector" "minimal_self_managed_aws_sigv4" {
  name        = "self_managed_aws_sigv4"
  description = "AWS Bedrock connector using pre-assumed temporary credentials"
  version     = "1"
  protocol    = "aws_sigv4"
  credential = {
    access_key    = "<AWS access key>"
    secret_key    = "<AWS secret key>"
    session_token = "<AWS session token>"
  }
  parameters = {
    region       = "eu-west-3"
    service_name = "bedrock"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://bedrock-runtime.$${parameters.region}.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke"
    headers     = {
      Content-Type         = "application/json"
      x-amz-content-sha256 = "required"
    }
    request_body = "{ \"inputText\": \"$${parameters.inputText}\" }"
  }
}
```
```

--------------------------------

### Create a snapshot repository

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/snapshot_repository.md

Use this snippet to create a new snapshot repository. Specify the repository name, type (e.g., 's3'), and backend-specific settings. Ensure the necessary plugins are installed for the chosen repository type.

```terraform
resource "opensearch_snapshot_repository" "repo" {
  name = "es-index-backups"
  type = "s3"
  settings = {
    bucket   = "es-index-backups"
    region   = "us-east-1"
    role_arn = "arn:aws:iam::123456789012:role/MyRole"
  }
}
```

--------------------------------

### opensearch_audit_config Resource

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/audit_config.md

Example of how to configure audit and compliance logging for an OpenSearch domain.

```APIDOC
## opensearch_audit_config Resource

### Description

Manages the audit configuration for an OpenSearch domain. This resource allows you to configure audit logging and compliance logging for your OpenSearch domain. You can enable or disable various logging categories, specify ignored users and requests, and configure compliance-specific settings like watched fields and indices.

### Schema

#### Required

- `enabled` (Boolean) - Whether to enable audit logging.

#### Optional

- `audit` (Block Set, Max: 1) - Configuration for audit logging.
  - `enable_rest` (Boolean) - Whether to enable REST logging.
  - `disabled_rest_categories` (Set of String) - A list of REST categories to disable.
  - `enable_transport` (Boolean) - Whether to enable transport logging.
  - `disabled_transport_categories` (Set of String) - A list of transport categories to disable.
  - `resolve_bulk_requests` (Boolean) - Whether to resolve bulk requests.
  - `log_request_body` (Boolean) - Whether to log the request body.
  - `resolve_indices` (Boolean) - Whether to resolve indices.
  - `exclude_sensitive_headers` (Boolean) - Whether to exclude sensitive headers. Note: if set false, AWS OpenSearch will return HTTP 409 (Conflict).
  - `ignore_users` (Set of String) - A list of users to ignore.
  - `ignore_requests` (Set of String) - A list of requests to ignore.

- `compliance` (Block Set, Max: 1) - Configuration for compliance logging.
  - `enabled` (Boolean) - Whether to enable compliance logging.
  - `internal_config` (Boolean) - Whether to enable internal compliance configuration. Note: if both internal/external are set true, AWS OpenSearch will return HTTP 409 (Conflict).
  - `external_config` (Boolean) - Whether to enable external compliance configuration. Note: if both internal/external are set true, AWS OpenSearch will return HTTP 409 (Conflict).
  - `read_metadata_only` (Boolean) - Whether to only read metadata for compliance logging.
  - `read_ignore_users` (Set of String) - A list of users to ignore for read compliance logging.
  - `read_watched_field` (Block Set) - Configuration for watched fields in read compliance logging.
    - `index` (String) - The index to watch.
    - `fields` (Set of String) - A list of fields to watch.
  - `write_metadata_only` (Boolean) - Whether to only write metadata for compliance logging.
  - `write_log_diffs` (Boolean) - Whether to log diffs for write compliance logging.
  - `write_watched_indices` (Set of String) - A list of indices to watch for write compliance logging.
  - `write_ignore_users` (Set of String) - A list of users to ignore for write compliance logging.

#### Read-Only

- `id` (String) - The ID of this resource.

### Import

Import is supported using the following syntax:

```shell
# Import by name
terraform import opensearch_audit_config.test_config my-config
```
```

--------------------------------

### Run Acceptance Tests

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Execute the full acceptance test suite for the Terraform provider. This command starts a local OpenSearch cluster using Docker Compose and runs the tests.

```sh
make test
```

--------------------------------

### Configure OpenSearch Provider with AWS Static Credentials

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/index.md

This example demonstrates configuring the OpenSearch provider for AWS OpenSearch Service domains using static AWS credentials. Ensure `aws_region` is set if using a custom domain.

```terraform
provider "opensearch" {
  url            = "https://search-foo-bar-pqrhr4w3u4dzervg41frow4mmy.us-east-1.es.amazonaws.com"
  aws_access_key = "anaccesskey"
  aws_secret_key = "asecretkey"
  aws_token      = "" # if necessary
}
```

--------------------------------

### Minimal ML Connector with 'aws_sigv4' protocol (IAM Role — AWS-managed OpenSearch)

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

This example demonstrates a minimal ML Connector configuration for AWS-managed OpenSearch using the 'aws_sigv4' protocol with IAM Role assumption for authentication.

```APIDOC
## opensearch_ml_connector.minimal_aws_sigv4

### Description
Minimal ML Connector with only the mandatory attributes connecting to AWS Bedrock with an IAM Role.

### Attributes
*   `name` (Required) - Name of the ML connector.
*   `description` (Optional) - Description of the ML connector.
*   `version` (Required) - Version of the ML connector.
*   `protocol` (Required) - The protocol to use for the connection (e.g., "aws_sigv4", "http").
*   `credential` (Required) - Authentication credentials for the connector.
    *   `roleArn` (Required for IAM Role assumption) - ARN of the IAM Role.
    *   `access_key` (Required for direct credentials) - AWS access key.
    *   `secret_key` (Required for direct credentials) - AWS secret key.
    *   `session_token` (Required for direct credentials) - AWS session token.
*   `parameters` (Required) - Parameters specific to the protocol and service.
    *   `region` (Required for aws_sigv4) - AWS region.
    *   `service_name` (Required for aws_sigv4) - AWS service name.
*   `actions` (Required) - Defines the actions the connector can perform.
    *   `action_type` (Required) - Type of action (e.g., "predict").
    *   `method` (Required) - HTTP method for the action (e.g., "POST").
    *   `url` (Required) - URL for the action endpoint.
    *   `headers` (Optional) - HTTP headers for the request.
    *   `request_body` (Optional) - Request body template.
    *   `pre_process_function` (Optional) - Function to pre-process the request.
    *   `post_process_function` (Optional) - Function to post-process the response.

### Example
```terraform
resource "opensearch_ml_connector" "minimal_aws_sigv4" {
  name        = "minimal_aws_sigv4"
  description = "Minimal ML Connector with only the mandatory attributes connecting to AWS Bedrock with an IAM Role"
  version     = "1"
  protocol    = "aws_sigv4"
  credential = {
    roleArn = "<ARN of IAM Role with permissions to access the AWS Bedrock model>"
  }
  parameters = {
    region       = "eu-west-3"
    service_name = "bedrock"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://bedrock-runtime.$${parameters.region}.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke"
    headers     = {
      Content-Type         = "application/json"
      x-amz-content-sha256 = "required"
    }
    request_body = "{ \"inputText\": \"$${parameters.inputText}\" }"
  }
}
```
```

--------------------------------

### Manage OpenSearch Cluster Independently

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Commands to start or stop only the OpenSearch cluster without managing Dashboards.

```shell
make up    # start OpenSearch only
```

```shell
make down  # stop OpenSearch
```

--------------------------------

### Create a role with document-level security

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/role.md

This example demonstrates how to create a role with document-level security enabled. It grants read access to indices matching 'pub*' but restricts access based on a JSON security policy that checks the 'readable_by' field against the current user's name.

```terraform
resource "opensearch_role" "writer" {
  role_name = "foo_writer"

  cluster_permissions = ["*"]

  index_permissions {
    index_patterns          = ["pub*"]
    allowed_actions         = ["read"]
    document_level_security = "{\"term\": { \"readable_by\": \"$${user.name}\"}}"
  }
}
```

--------------------------------

### Basic opensearch_audit_config Resource

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/audit_config.md

Configure audit logging for REST and transport layers, including ignored users and requests. This example also sets up compliance logging with specific read and write configurations.

```terraform
resource "opensearch_audit_config" "test" {
  enabled = true

  audit {
    enable_rest              = true
    disabled_rest_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]

    enable_transport              = true
    disabled_transport_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]

    resolve_bulk_requests = true
    log_request_body      = true
    resolve_indices       = true

    # Note: if set false, AWS OpenSearch will return HTTP 409 (Conflict)
    exclude_sensitive_headers = true

    ignore_users    = ["dashboardserver"]
    ignore_requests = ["SearchRequest", "indices:data/read/*", "/_cluster/health"]
  }

  compliance {
    enabled = true

    # Note: if both internal/external are set true, AWS OpenSearch will return HTTP 409 (Conflict)
    internal_config = true
    external_config = false

    read_metadata_only = true
    read_ignore_users  = ["read-ignore-1"]

    read_watched_field {
      index  = "read-index-1"
      fields = ["field-1", "field-2"]
    }

    read_watched_field {
      index  = "read-index-2"
      fields = ["field-3"]
    }

    write_metadata_only   = true
    write_log_diffs       = false
    write_watched_indices = ["write-index-1", "write-index-2", "log-*", "*"]
    write_ignore_users    = ["write-ignore-1"]
  }
}
```

--------------------------------

### Retrieve host URL

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/data-sources/host.md

Use this data source to get the URL of the active OpenSearch cluster. Ensure the 'active' argument is set to true.

```terraform
data "opensearch_host" "test" {
  active = true
}
```

--------------------------------

### Create a simple OpenSearch index

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/index.md

Use this resource to create a basic OpenSearch index with specified shard and replica counts, and define its mappings.

```terraform
resource "opensearch_index" "test-simple-index" {
  name               = "terraform-test"
  number_of_shards   = "1"
  number_of_replicas = "1"
  mappings           = <<EOF
{
  "properties": {
    "name": {
      "type": "text"
    }
  }
}
EOF
}
```

--------------------------------

### Import opensearch_component_template

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/component_template.md

Imports an existing component template by its name.

```shell
terraform import opensearch_component_template.test terraform-test
```

--------------------------------

### ML Connector with Client Configuration

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

Set up an ML connector with detailed client configuration, including connection timeouts, retry policies, and maximum retries. The `roleArn` in `credential` must have permissions to access the AWS Bedrock model.

```hcl
resource "opensearch_ml_connector" "with_client_config" {
  name        = "with_client_config"
  description = "ML Connector with all 'client_config' attributes"
  version     = "1"
  protocol    = "aws_sigv4"
  credential = {
    roleArn = "<ARN of IAM Role with permissions to access the AWS Bedrock model>"
  }
  parameters = {
    region       = "eu-west-3"
    service_name = "bedrock"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://bedrock-runtime.$${parameters.region}.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke"
    headers     = {
      Content-Type         = "application/json"
      x-amz-content-sha256 = "required"
    }
    request_body = "{ \"inputText\": \"$${parameters.inputText}\" }"
  }
  client_config {
    max_connection        = 10
    connection_timeout    = 10
    read_timeout          = 10
    retry_backoff_policy  = "constant"
    max_retry_times       = 2
    retry_backoff_millis  = 500
    retry_timeout_seconds = 30
  }
}
```

--------------------------------

### Run Specific Acceptance Test

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/README.md

Execute a single, specific acceptance test. Navigate to the provider directory and use the `go test` command with the `-run` flag to specify the test function.

```sh
cd provider/
TF_ACC=2 go test -run TestAccOpensearchOpenDistroDashboardTenant -v -cover -short
```

--------------------------------

### Import an OpenSearch Channel Configuration

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/channel_configuration.md

Import an existing OpenSearch channel configuration into Terraform management. Use the `terraform import` command followed by the resource name and the configuration ID.

```shell
terraform import opensearch_channel_configuration.configuration_1 configuration_1
```

--------------------------------

### Create an OpenSearch Monitor

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/monitor.md

Use this resource to define and configure an OpenSearch monitor. The `body` argument accepts a JSON string that specifies the monitor's name, type, schedule, inputs, and triggers.

```terraform
resource "opensearch_monitor" "movies_last_hour" {
  body = <<EOF
{
  "name": "test-monitor",
  "type": "monitor",
  "enabled": true,
  "schedule": {
    "period": {
      "interval": 1,
      "unit": "MINUTES"
    }
  },
  "inputs": [{
    "search": {
      "indices": ["movies"],
      "query": {
        "size": 0,
        "aggregations": {},
        "query": {
          "bool": {
            "adjust_pure_negative":true,
            "boost":1,
            "filter": [{
              "range": {
                "@timestamp": {
                  "boost":1,
                  "from":"||-1h",
                  "to":"",
                  "include_lower":true,
                  "include_upper":true,
                  "format": "epoch_millis"
                }
              }
            }]
          }
        }
      }
    }
  }],
  "triggers": [
    {
      "name" : "Errors",
      "severity" : "1",
      "condition" : {
        "script" : {
          "source" : "ctx.results[0].hits.total.value > 0",
          "lang" : "painless"
        }
      },
      "actions" : [
        {
          "name" : "Slack",
          "destination_id" : "${opensearch_channel_configuration.slack_on_call_channel.id}",
          "message_template" : {
            "source" : "bogus",
            "lang" : "mustache"
          },
          "throttle_enabled" : false,
          "subject_template" : {
            "source" : "Production Errors",
            "lang" : "mustache"
          }
        }
      ]
    }
  ]
}
EOF
}

```

--------------------------------

### Create an OpenSearch Channel Configuration

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/channel_configuration.md

Use this resource to create a new channel configuration in OpenSearch. Ensure the `body` contains a valid JSON object with the desired configuration details, including `config_id`, `name`, `description`, `config_type`, and specific channel settings like `slack.url`.

```terraform
resource "opensearch_channel_configuration" "configuration_1" {
  body = <<EOF
{
  "config_id": "configuration_1",
  "config": {
    "name": "name",
    "description" : "description",
    "config_type" : "slack",
    "is_enabled" : true,
    "slack": {
      "url": "https://sample-slack-webhook"
    }
  }
}
EOF
}
```

--------------------------------

### Create a simple ingest pipeline

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ingest_pipeline.md

Use this resource to create a basic ingest pipeline. Ensure the `body` contains valid JSON defining the pipeline's description, version, and processors.

```terraform
resource "opensearch_ingest_pipeline" "test" {
  name = "terraform-test"
  body = <<EOF
{
  "description" : "describe pipeline",
  "version": 123,
  "processors" : [
    {
      "set" : {
        "field": "foo",
        "value": "bar"
      }
    }
  ]
}
EOF
}
```

--------------------------------

### Configure Credentials via Environment Variables

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/index.md

Provide AWS Access Key ID, Secret Access Key, and optionally Session Token via environment variables.

```shell
$ export AWS_ACCESS_KEY_ID="anaccesskey"
$ export AWS_SECRET_ACCESS_KEY="asecretkey"
$ terraform plan
```

--------------------------------

### Create an OpenSearch Dashboard Tenant

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/dashboard_tenant.md

Use this resource to create a new tenant in OpenSearch Dashboards. The tenant name and description are required.

```terraform
resource "opensearch_dashboard_tenant" "test" {
  tenant_name = "test"
  description = "test tenant"
}
```

--------------------------------

### Configure OpenSearch Provider and Create Index Template

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/index.md

This snippet shows how to configure the OpenSearch provider with a URL and create an index template. The index template defines settings and mappings for new indices.

```terraform
# Configure the OpenSearch provider
provider "opensearch" {
  url = "http://127.0.0.1:9200"
}

# Create an index template
resource "opensearch_index_template" "template_1" {
  name = "template_1"
  body = <<EOF
{
  "index_patterns": [
    "your-pattern-here-*"
  ],
  "template": {
    "settings": {
      "index": {
        "number_of_shards": "1"
      }
    },
    "mappings": {
      "_source": {
        "enabled": false
      },
      "properties": {
        "host_name": {
          "type": "keyword"
        },
        "created_at": {
          "type": "date",
          "format": "EEE MMM dd HH:mm:ss Z YYYY"
        }
      }
    }
  }
}
EOF
}
```

--------------------------------

### Create an OpenSearch User

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/user.md

Use this snippet to create a basic OpenSearch user with a username, password, and description. Ensure the password meets any policy requirements enforced by your OpenSearch domain.

```terraform
resource "opensearch_user" "mapper" {
  username    = "app-reasdder"
  password    = "SuperSekret123!"
  description = "a reader role for our app"
}
```

--------------------------------

### Import an index template

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/index_template.md

Import an existing OpenSearch index template into Terraform management. Use the resource name and the template name to perform the import.

```shell
terraform import opensearch_index_template.template_1 template_1
```

--------------------------------

### Import an existing snapshot repository

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/snapshot_repository.md

This command imports an existing snapshot repository into your Terraform state. Replace 'es-index-backups' with the actual name of the repository you want to import.

```shell
terraform import opensearch_snapshot_repository.repo es-index-backups
```

--------------------------------

### Import ML Model Group

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_model_group.md

Demonstrates how to import an existing ML Model Group into Terraform management using its ID.

```shell
# Import an ML Model Group by its ID
terraform import opensearch_ml_model_group.test <model_group_id>
```

--------------------------------

### Create an index template

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/index_template.md

Use this resource to create a new index template in OpenSearch. Specify the template name and the JSON body defining index patterns, mappings, settings, and aliases.

```terraform
resource "opensearch_index_template" "template_1" {
  name = "template_1"
  body = <<EOF
{
  "index_patterns": [
    "logs-2020-01-*"
  ],
  "template": {
    "aliases": {
      "my_logs": {}
    },
    "settings": {
      "index": {
        "number_of_shards": "2",
        "number_of_replicas": "1"
      }
    },
    "mappings": {
      "properties": {
        "timestamp": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
        },
        "value": {
          "type": "double"
        }
      }
    }
  }
}
EOF
}
```

--------------------------------

### Create opensearch_component_template

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/component_template.md

Defines a component template with settings, mappings, and aliases. Ensure the body is valid JSON.

```terraform
resource "opensearch_component_template" "test" {
  name = "terraform-test"
  body = <<EOF
{
  "template": {
    "settings": {
      "index": {
        "number_of_shards": "1"
      }
    },
    "mappings": {
      "properties": {
        "host_name": {
          "type": "keyword"
        },
        "created_at": {
          "type": "date",
          "format": "EEE MMM dd HH:mm:ss Z yyyy"
        }
      }
    },
    "aliases": {
      "mydata": { }
    }
  }
}
EOF
}

```

--------------------------------

### Import an OpenSearch Monitor

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/monitor.md

Monitors can be imported into Terraform state using their ID. This allows you to manage existing OpenSearch monitors with Terraform.

```shell
terraform import opensearch_monitor.alert lgOZb3UB96pyyRQv0ppQ
```

--------------------------------

### Create an OpenSearch SM policy

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/sm_policy.md

Use this resource to define and manage snapshot management policies in OpenSearch. Ensure a snapshot repository is configured before creating the policy.

```terraform
resource "opensearch_snapshot_repository" "repo" {
  name = "os-index-backups"
  type = "s3"

  settings = {
    bucket                 = module.s3_snapshot.s3_bucket_id
    region                 = module.s3_snapshot.s3_bucket_region
    role_arn               = aws_iam_role.snapshot_create.arn
    server_side_encryption = true
  }
}

# Create the SM policy
resource "opensearch_sm_policy" "snapshot_to_s3" {
  policy_name = "snapshot_to_s3"

  body = jsonencode({
    "enabled"     = true
    "description" = "My snapshot policy"

    "creation" = {
      "schedule" = {
        "cron" = {
          "expression" = "0 0 * * *"
          "timezone"   = "UTC"
        }
      }

      "time_limit" = "1h"
    }

    "deletion" = {
      "schedule" = {
        "cron" = {
          "expression" = "0 0 * * *"
          "timezone"   = "UTC"
        }
      }

      "condition" = {
        "max_age"   = "14d"
        "max_count" = 400
        "min_count" = 1
      }

      "time_limit" = "1h"
    }

    "snapshot_config" = {
      "timezone"   = "UTC"
      "indices"    = "*"
      "repository" = opensearch_snapshot_repository.repo.name
    }
  })
}
```

--------------------------------

### Minimal HTTP ML Connector (OpenAI)

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

Connects to OpenAI using the 'http' protocol with an API key. Requires specifying endpoint, model, and other parameters.

```terraform
resource "opensearch_ml_connector" "minimal_http" {
  name        = "minimal_http"
  description = "Minimal ML Connector with only the mandatory attributes connecting to OpenAI with an API Key"
  version     = "1"
  protocol    = "http"
  credential = {
    openAIKey = "<OpenAI API Key>"
  }
  parameters = {
    endpoint    = "api.openai.com"
    max_tokens  = 7
    temperature = 0
    model       = "gpt-4.1"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://$${parameters.endpoint}/v1/completions"
    headers     = {
      Authorization = "Bearer $${credential.openAIKey}"
    }
    request_body = "{ \"model\": \"$${parameters.model}\", \"prompt\": \"$${parameters.prompt}\", \"max_tokens\": \"$${parameters.max_tokens}\", \"temperature\": \"$${parameters.temperature}\" }"
  }
}
```

--------------------------------

### Import opensearch_ism_policy_mapping Resource

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ism_policy_mapping.md

This command demonstrates how to import an existing `opensearch_ism_policy_mapping` resource into your Terraform state, using the policy ID.

```bash
terraform import opensearch_ism_policy_mapping.test policy_1
```

--------------------------------

### Create a basic role with cluster and index permissions

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/role.md

Use this snippet to create a new OpenSearch role with broad cluster access and specific write permissions for indices matching the 'logstash-*' pattern. It also configures write access for tenants matching the same pattern.

```terraform
resource "opensearch_role" "writer" {
  role_name   = "logs_writer"
  description = "Logs writer role"

  cluster_permissions = ["*"]

  index_permissions {
    index_patterns  = ["logstash-*"]
    allowed_actions = ["write"]
  }

  tenant_permissions {
    tenant_patterns = ["logstash-*"]
    allowed_actions = ["write"]
  }
}
```

--------------------------------

### Create an opensearch_script resource

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/script.md

Use this resource to create a new stored script in OpenSearch. Ensure the script_id is unique within the cluster. The 'lang' defaults to 'painless' if not specified.

```terraform
resource "opensearch_script" "test_script" {
  script_id = "my_script"
  lang      = "painless"
  source    = "Math.log(_score * 2) + params.my_modifier"
}
```

--------------------------------

### OpenSearch-Provided Pretrained Text Embedding Model with Optional Attributes

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_model.md

Configures an OpenSearch-provided pretrained text embedding model with optional attributes like description.

```terraform
# ML Model - OpenSearch-provided pretrained text embedding model with optional attributes
resource "opensearch_ml_model" "os_provided_pretrained_text_embedding_with_optional" {
  name           = "huggingface/sentence-transformers/msmarco-distilbert-base-tas-b"
  description    = "ML Model for OpenSearch-provided pretrained text embedding model"
  version        = "1.0.3"
  model_format   = "TORCH_SCRIPT"
  model_group_id = opensearch_ml_model_group.minimal.id
}

```

--------------------------------

### ML Connector with Access Mode and Backend Roles

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_connector.md

Configure an ML connector with restricted access mode and specify allowed backend roles. Ensure the `roleArn` in `credential` has necessary permissions.

```hcl
resource "opensearch_ml_connector" "with_access_mode_and_backend_roles" {
  name        = "with_access_mode_and_backend_roles"
  description = "ML Connector with 'access_mode' set to 'restricted' and specific 'backend_roles'"
  version     = "1"
  protocol    = "aws_sigv4"
  credential = {
    roleArn = "<ARN of IAM Role with permissions to access the AWS Bedrock model>"
  }
  parameters = {
    region       = "eu-west-3"
    service_name = "bedrock"
  }
  actions {
    action_type = "predict"
    method      = "POST"
    url         = "https://bedrock-runtime.$${parameters.region}.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke"
    headers     = {
      Content-Type         = "application/json"
      x-amz-content-sha256 = "required"
    }
    request_body = "{ \"inputText\": \"$${parameters.inputText}\" }"
  }
  access_mode   = "restricted"
  backend_roles = ["ml_full_access"]
}
```

--------------------------------

### ML Model - Third-Party with Model-Based Guardrails

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_model.md

Set up a third-party ML model with model-based guardrails, specifying a model ID and a response validation regex.

```terraform
resource "opensearch_ml_model" "third_party_with_model_guardrails" {
  name           = "third_party_with_model_guardrails"
  description    = "ML Model for third-party model with model-based guardrails"
  function_name  = "REMOTE"
  model_group_id = opensearch_ml_model_group.minimal.id
  connector_id   = opensearch_ml_connector.minimal.id
  is_enabled     = true

  guardrails {
    type                      = "model"
    model_id                  = "guardrail_model_id"
    response_validation_regex = "^\\d{4}-\\d{2}-\\d{2}$"
  }
}
```

--------------------------------

### ML Model Configuration

Source: https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docs/resources/ml_model.md

Defines the configuration for an ML Model resource, including required and optional parameters for registration and deployment.

```APIDOC
## ML Model Resource Configuration

### Description
This resource allows you to manage ML Models within OpenSearch. You can configure various aspects such as model group, connector, deployment settings, guardrails, and model configuration.

### Schema

#### Required
- `model_group_id` (String) - ML Model Group ID to which this ML Model belongs.
- `name` (String) - Name of the ML Model.

#### Optional
- `connector_id` (String) - ML Connector ID this ML Model uses. Required for third-party models.
- `deploy_after_registering` (Boolean) - Whether to deploy the model after registration. Defaults to `true`.
- `description` (String) - Description of the ML Model (not returned by OpenSearch API for OS-provided models, but returned for custom and third-party models).
- `function_name` (String) - Specifies the model's function (e.g., `TEXT_EMBEDDING`, `SPARSE_ENCODING`, `TEXT_SIMILARITY`, `QUESTION_ANSWERING`). Required for custom and third-party models.
- `guardrails` (Block List, Max: 1) - Configuration for model input and output guardrails.
  - `type` (String) - Required. Valid values: `"local_regex"`, `"model"`.
  - `input_guardrail` (Block List, Max: 1) - Guardrail for model input.
    - `regex` (List of String) - Regular expression for input validation.
    - `stop_words` (Block List, Max: 1) - Stopwords for input validation.
      - `index_name` (String) - Required. Name of index storing stopwords.
      - `source_fields` (List of String) - Required. Name of field(s) in the index storing stopwords.
  - `model_id` (String) - Guardrail model ID. Required when `type` is `"model"`.
  - `output_guardrail` (Block List, Max: 1) - Guardrail for model output.
    - `regex` (List of String) - Regular expression for output validation.
    - `stop_words` (Block List, Max: 1) - Stopwords for output validation.
      - `index_name` (String) - Required. Name of index storing stopwords.
      - `source_fields` (List of String) - Required. Name of field(s) in the index storing stopwords.
  - `response_validation_regex` (String) - Regular expression for guardrail model response validation. Required when `type` is `"model"`.
- `interface` (Block List, Max: 1) - Interface configuration for the model.
  - `input` (String) - JSON schema for model input.
  - `output` (String) - JSON schema for model output.
- `is_enabled` (Boolean) - Whether the model is enabled. Defaults to `true`.
- `model_config` (Block List, Max: 1) - Model configuration, including type, dimension, and framework.
  - `model_type` (String) - Type of the model.
  - `embedding_dimension` (Number) - Dimension of the embedding.
  - `framework_type` (String) - Type of the framework.
  - `all_config` (String) - JSON string containing all model configurations.
  - `additional_config` (Object) - Additional configuration details.
    - `space_type` (String) - Space type for pretrained or custom models.
- `model_content_hash_value` (String) - SHA-256 hash of the downloaded model. Required for custom models.
- `model_format` (String) - Portable format of the model file. Valid values: `"TORCH_SCRIPT"`, `"ONNX"`. Required for OS-provided pretrained and custom models.
- `rate_limiter` (Block List, Max: 1) - Rate limiting configuration for the Predict API.
- `url` (String) - URL to download the model. Required for custom models.
- `version` (String) - Version of the ML Model.

### Read-Only
- `id` (String) - The unique identifier of the ML Model resource.
```