Elasticsearch Domains Should Not Allow Cross Account Access

Using Console

To remediate the issue of Elasticsearch domains allowing cross-account access in AWS using the AWS console, follow these steps:

Log in to the AWS Management Console.
Navigate to the Elasticsearch service.
Select the Elasticsearch domain that is allowing cross-account access.
Click on the “Access” tab.
In the “Access policies” section, click on the “Edit” button.
Remove any entries that allow cross-account access.
Add a new entry to the access policy that allows access only from trusted accounts.
Click on the “Save changes” button to apply the new access policy.
Verify that the Elasticsearch domain no longer allows cross-account access by attempting to access it from a different AWS account.
Repeat the above steps for any other Elasticsearch domains that are allowing cross-account access.

By following these steps, you can remediate the issue of Elasticsearch domains allowing cross-account access in AWS.

Using CLI

To remediate the Elasticsearch Domains Should Not Allow Cross Account Access misconfiguration in AWS, you can follow the below steps using AWS CLI:

Open the AWS CLI and run the following command to get the Elasticsearch domain ARN:
aws es list-domain-names

Once you have the Elasticsearch domain ARN, run the following command to update the Elasticsearch domain access policy to restrict cross-account access:

aws es update-elasticsearch-domain-config --domain-name <domain-name> --cognito-options Enabled=false --access-policies '{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "*"},"Action": "es:*","Resource": "<domain-arn>","Condition": {"IpAddress": {"aws:SourceIp": ["<your-ip-address>/32"]}}}]}' 

Replace <domain-name> with the name of your Elasticsearch domain and <domain-arn> with the ARN of your Elasticsearch domain.

Verify that the access policy has been updated by running the following command:
aws es describe-elasticsearch-domain-config --domain-name <domain-name>
This command will return the current configuration of the Elasticsearch domain.

By following these steps, you can successfully remediate the Elasticsearch Domains Should Not Allow Cross Account Access misconfiguration in AWS.

Using Python

To remediate the Elasticsearch Domains Should Not Allow Cross Account Access misconfiguration in AWS using Python, you can follow these steps:

Create a new Elasticsearch Domain Policy that restricts cross-account access.

import boto3
import json

client = boto3.client('es')

# Define the new Elasticsearch Domain Policy
policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "es:*",
            "Resource": "arn:aws:es:us-west-2:123456789012:domain/my-domain/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::123456789012:root",
                        "arn:aws:sts::123456789012:assumed-role/MyRole/*"
                    ]
                }
            }
        }
    ]
}

# Convert the policy to a JSON string
policy_json = json.dumps(policy)

# Update the Elasticsearch Domain Policy
response = client.update_elasticsearch_domain_config(
    DomainName='my-domain',
    ElasticsearchClusterConfig={
        'InstanceType': 'm3.medium.elasticsearch',
        'InstanceCount': 2,
        'DedicatedMasterEnabled': False,
        'ZoneAwarenessEnabled': False
    },
    EBSOptions={
        'EBSEnabled': True,
        'VolumeType': 'gp2',
        'VolumeSize': 10
    },
    ElasticsearchVersion='7.1',
    AccessPolicies=policy_json
)

Replace the existing Elasticsearch Domain Policy with the new policy.

import boto3
import json

client = boto3.client('es')

# Get the existing Elasticsearch Domain Policy
response = client.describe_elasticsearch_domain_config(DomainName='my-domain')
existing_policy_json = response['DomainConfig']['AccessPolicies']

# Parse the existing policy JSON string
existing_policy = json.loads(existing_policy_json)

# Modify the policy to restrict cross-account access
modified_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "es:*",
            "Resource": "arn:aws:es:us-west-2:123456789012:domain/my-domain/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::123456789012:root",
                        "arn:aws:sts::123456789012:assumed-role/MyRole/*"
                    ]
                }
            }
        }
    ]
}

# Convert the modified policy to a JSON string
modified_policy_json = json.dumps(modified_policy)

# Update the Elasticsearch Domain Policy
response = client.update_elasticsearch_domain_config(
    DomainName='my-domain',
    ElasticsearchClusterConfig={
        'InstanceType': 'm3.medium.elasticsearch',
        'InstanceCount': 2,
        'DedicatedMasterEnabled': False,
        'ZoneAwarenessEnabled': False
    },
    EBSOptions={
        'EBSEnabled': True,
        'VolumeType': 'gp2',
        'VolumeSize': 10
    },
    ElasticsearchVersion='7.1',
    AccessPolicies=modified_policy_json
)

Note: Replace the DomainName and Resource ARNs in the policy with your own Elasticsearch Domain and ARNs. Also, replace the PrincipalArn values in the policy with the ARNs of the IAM users or roles that should have access to the domain.

Using Terraform

# Replace PLACEHOLDERS with your actual values:
# - OPENSEARCH_DOMAIN_NAME: the name of your existing domain
# - TRUSTED_PRINCIPAL_ARN_N: ARNs of IAM roles/users/accounts that are allowed
#   (do NOT include untrusted external account ARNs or "*")

data "aws_iam_policy_document" "opensearch_domain_access" {
  statement {
    sid    = "AllowTrustedAccess"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [
        "TRUSTED_PRINCIPAL_ARN_1",
        "TRUSTED_PRINCIPAL_ARN_2",
      ]
    }

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpDelete",
      "es:ESHttpPut",
      # add/remove actions as needed for your applications
    ]

    resources = [
      "arn:aws:es:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:domain/OPENSEARCH_DOMAIN_NAME/*",
    ]
  }
}

data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

resource "aws_opensearch_domain" "this" {
  domain_name = "OPENSEARCH_DOMAIN_NAME"

  # ... your existing domain configuration (cluster, ebs_options, vpc_options, etc.)

  # This replaces the full access policy with one that only allows trusted principals.
  access_policies = data.aws_iam_policy_document.opensearch_domain_access.json
}

Changing access_policies does not force replacement of the domain, but misconfiguration can cause an outage by blocking legitimate access; review the principals and actions carefully before applying.For verification, terraform plan should show an in-place update on aws_opensearch_domain.this with a change only to the access_policies JSON (removal of any untrusted or cross-account principals and retention of only trusted ARNs).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elasticsearch Domains Should Not Allow Cross Account Access

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: