data "aws_iam_policy_document" "main" {

  statement {
    actions = ["es:*"]

    condition {
      test = "IpAddress"
      values = ["127.0.0.1/32"]
      variable = "aws:SourceIp"
    }
    effect = "Allow"

    principals {
      identifiers = [*]
      type = *
    }
    resources = ["${aws_opensearch_domain.example.arn}/*"]
  }
}

resource "aws_opensearch_domain" "example" {
  domain_name = "tf-test"
  engine_version = "OpenSearch_1.1"
}

resource "aws_opensearch_domain_policy" "main" {
  access_policies = data.aws_iam_policy_document.main.json
  domain_name = aws_opensearch_domain.example.domain_name
}