More Info:
All your Elasticsearch Service (ES) clusters should be configured to allow access only to trusted AWS users and accounts in order to protect against unauthorized cross account accessRisk Level
HighAddress
SecurityCompliance Standards
AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of Elasticsearch domains allowing cross-account access in AWS using the AWS console, follow these steps:
- Log in to the AWS Management Console.
- Navigate to the Elasticsearch service.
- Select the Elasticsearch domain that is allowing cross-account access.
- Click on the “Access” tab.
- In the “Access policies” section, click on the “Edit” button.
- Remove any entries that allow cross-account access.
- Add a new entry to the access policy that allows access only from trusted accounts.
- Click on the “Save changes” button to apply the new access policy.
- Verify that the Elasticsearch domain no longer allows cross-account access by attempting to access it from a different AWS account.
- Repeat the above steps for any other Elasticsearch domains that are allowing cross-account access.
Using CLI
Using CLI
To remediate the Elasticsearch Domains Should Not Allow Cross Account Access misconfiguration in AWS, you can follow the below steps using AWS CLI:
-
Open the AWS CLI and run the following command to get the Elasticsearch domain ARN:
-
Once you have the Elasticsearch domain ARN, run the following command to update the Elasticsearch domain access policy to restrict cross-account access:
Replace
<domain-name>with the name of your Elasticsearch domain and<domain-arn>with the ARN of your Elasticsearch domain. -
Verify that the access policy has been updated by running the following command:
This command will return the current configuration of the Elasticsearch domain.
Using Python
Using Python
To remediate the Elasticsearch Domains Should Not Allow Cross Account Access misconfiguration in AWS using Python, you can follow these steps:Note: Replace the
- Create a new Elasticsearch Domain Policy that restricts cross-account access.
- Replace the existing Elasticsearch Domain Policy with the new policy.
DomainName and Resource ARNs in the policy with your own Elasticsearch Domain and ARNs. Also, replace the PrincipalArn values in the policy with the ARNs of the IAM users or roles that should have access to the domain.