More Info:
AWS Elasticsearch domains should not be publicly accessible their access policy should be updated in order to stop any unsigned requests made to these resourcesRisk Level
HighAddress
SecurityCompliance Standards
HITRUST, AWSWAF, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step by step instructions to remediate the Elasticsearch Domains Should Not Be Publicly Exposed issue for AWS using the AWS console:
- Log in to your AWS console.
- Navigate to the Elasticsearch Service console.
- Select the Elasticsearch domain that is publicly exposed.
- Click on the “Edit” button.
- Scroll down to the “Network configuration” section.
- Click on the “Edit” button.
- In the “Public access” section, select “Disabled”.
- Click on the “Save changes” button.
- Wait for the changes to take effect.
- Once the changes have taken effect, verify that the Elasticsearch domain is no longer publicly exposed.
Using CLI
Using CLI
To remediate the Elasticsearch domain publicly exposed issue in AWS using AWS CLI, you can follow the below steps:Step 1: Login to AWS CLI using your AWS account credentials.Step 2: Run the following command to get the Elasticsearch domain endpoint:Step 3: Once you have the Elasticsearch domain endpoint, run the following command to update the Elasticsearch domain access policy and restrict access to only authorized IP addresses:Note: Replace Step 5: Test the Elasticsearch domain access by trying to access it from an IP address that is not authorized. You should receive an error message indicating that access is denied.By following the above steps, you can remediate the Elasticsearch domain publicly exposed issue in AWS using AWS CLI and restrict access to only authorized IP addresses.
<your-domain-name> with the name of your Elasticsearch domain and <your-ip-address> with the IP address you want to allow access to.Step 4: Verify that the Elasticsearch domain access policy has been updated successfully by running the following command:Using Python
Using Python
To remediate the Elasticsearch Domains should not be publicly exposed misconfiguration in AWS, you can use the following steps using Python:
-
First, you need to identify the Elasticsearch domains that are publicly exposed. You can do this by using the AWS SDK for Python (Boto3) to list all the Elasticsearch domains in your account and check if they have public access policies attached to them.
-
Once you have identified the publicly exposed Elasticsearch domains, you need to update their access policies to restrict public access. You can do this by using the
update_elasticsearch_domain_configAPI to update the access policies of the domain. -
Finally, you need to verify that the access policies have been updated successfully and the Elasticsearch domains are no longer publicly accessible. You can use the same code as in step 1 to check if the domains have public access policies attached to them.