Adjust account-specific terraform to manually-applied changes.

[adunkman]

These tweaks have been made to update our logging infrastructure; apply them to terraform to bring things back in line. This change goes hand-in-hand with an update to our Court-specific environment documentation to document these values.

[mmarcotte]

Thanks for this Andrew!

[adunkman]

Added one more commit to fix #496:

• When deploying a domain, AWS Elasticsearch creates a Cognito user pool client and its mapped identity provider, configured to point at the domain endpoint.
• This creates an issue when Terraform runs against the Cognito identity pool, since it sees no such mapped identity provider and removes it. (Reported at BUG: log_viewers cognito pool recreated on account-specific terraform run #496). This breaks authentication for Kibana when the run happens.
• Any time the domain is deployed — on changes to its volumes, instances, configuration, etc — it re-creates the user pool client and mapped identity provider if it doesn’t exist. This fixes authentication.

…

FIGHT!

• I initially attempted to bring these resources under Terraform control, which would allow us to manage them ourselves as we do all other AWS resources. This creates a cycle:
  • To configure the user pool client, you need the endpoint for Elasticsearch.
  • To determine the endpoint for Elasticsearch, you need the user pool client.
• My attempted fix was to use a known domain for the Elasticsearch endpoint (logs.ef-cms.ustaxcourt.gov) to break the cycle. This worked great! Except…
  • Even when Elasticsearch is configured to use a custom domain (AWS ElasticSearch Custom endpoint support  hashicorp/terraform-provider-aws#16059), it still forces the Cognito user pool client and its mapped identity provider to point to the AWS-managed domain. The one that we can’t know until after the Elasticsearch domain is created.

There is no permanent fix without a change in AWS behavior (hashicorp/terraform-provider-aws#5557) — c853d8b implements a workaround (to have Terraform ignore changes to cognito_identity_providers, sidestepping the fight).

[adunkman]

Since this PR is still open, tacked on one more commit to fix a bash scripting bug which we discovered right before our load test yesterday — the IF-statement conditional is reversed for determining if LOG_GROUP_ENVIRONMENTS is set, which ensured the default value was always used. Fixed in de5aa71.