ElasticSearch Domains Should Be Encrypted

Using Console

To remediate the ElasticSearch Domains Should Be Encrypted misconfiguration in AWS using the AWS console, follow these steps:

Log in to the AWS Management Console.
Navigate to the Amazon ElasticSearch Service.
Select the Elasticsearch domain you want to remediate.
Click on the “Edit” button in the “Encryption” section.
Select the “Encrypt” option.
Choose the KMS key that you want to use for encryption.
Click on the “Save” button to apply the changes.

Once you have completed these steps, the ElasticSearch domain will be encrypted using the KMS key that you selected, and the misconfiguration will be remediated.

Using CLI

To remediate ElasticSearch domains that are not encrypted in AWS using AWS CLI, follow these steps:

Open the AWS CLI and navigate to the AWS Elasticsearch service.
Check the status of your Elasticsearch domains by running the following command:

aws es list-domain-names

Identify the domain that needs to be encrypted and run the following command to update the domain configuration:

aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true

This will enable encryption at rest for the Elasticsearch domain.

Verify that the domain is now encrypted by running the following command:

aws es describe-elasticsearch-domain --domain-name <domain-name> | grep EncryptionAtRestOptions

This should return a response that includes the following:

"EncryptionAtRestOptions": {
    "Enabled": true
}

This confirms that the domain is now encrypted at rest.

Repeat these steps for any other Elasticsearch domains that need to be encrypted.

Note: It is important to ensure that all Elasticsearch domains are encrypted to protect sensitive data.

Using Python

To remediate the ElasticSearch Domains Should Be Encrypted misconfiguration for AWS using Python, you can follow the below steps:

Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

Import the necessary libraries:

import boto3
from botocore.exceptions import ClientError

Set up the AWS credentials:

aws_access_key_id = 'YOUR_AWS_ACCESS_KEY_ID'
aws_secret_access_key = 'YOUR_AWS_SECRET_ACCESS_KEY'
region_name = 'YOUR_AWS_REGION_NAME'

Create an AWS ElasticSearch client:

es_client = boto3.client('es', aws_access_key_id=aws_access_key_id, aws_secret_access_key=aws_secret_access_key, region_name=region_name)

Get a list of all ElasticSearch domains:

response = es_client.list_domain_names()
domain_names = [domain['DomainName'] for domain in response['DomainNames']]

For each domain, check if it is encrypted:

for domain_name in domain_names:
    try:
        response = es_client.describe_elasticsearch_domain(DomainName=domain_name)
        encryption_at_rest_options = response['DomainStatus']['EncryptionAtRestOptions']
        if not encryption_at_rest_options['Enabled']:
            # Enable encryption
            es_client.update_elasticsearch_domain_config(DomainName=domain_name, EncryptionAtRestOptions={'Enabled': True})
            print(f"ElasticSearch domain {domain_name} has been encrypted.")
    except ClientError as e:
        print(f"Error checking encryption for ElasticSearch domain {domain_name}: {e}")

Run the Python script to remediate the misconfiguration.

Note: Make sure to replace the placeholders YOUR_AWS_ACCESS_KEY_ID, YOUR_AWS_SECRET_ACCESS_KEY, and YOUR_AWS_REGION_NAME with your AWS credentials and region name.

Using Terraform

resource "aws_elasticsearch_domain" "THIS_DOMAIN" {
  domain_name = "ELASTICSEARCH_DOMAIN_NAME"

  # Other required configuration (cluster_config, ebs_options, etc.) goes here

  encrypt_at_rest {
    enabled = true
    # Optional: use a customer-managed KMS key instead of the AWS-managed key
    # kms_key_id = "KMS_KEY_ID_OR_ARN"
  }
}

Enabling encrypt_at_rest is irreversible in AWS and will trigger a blue/green deployment; the domain remains the same Terraform resource and is not replaced, but configuration updates are blocked while the deployment runs.For verification, terraform plan should show encrypt_at_rest.enabled changing from false (or being added) to true, and if you set it, kms_key_id changing from null (or absent) to "KMS_KEY_ID_OR_ARN".

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ElasticSearch Domains Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: