ElasticSearch Domains Should Be Encrypted

More Info:

ElasticSearch domains should be encrypted with KMS. ElasticSearch domains should be encrypted to ensure data at rest is secured.

Risk Level

High

Address

Security

Compliance Standards

HIPAA, GDPR, HITRUST, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate ElasticSearch domains that are not encrypted in AWS using AWS CLI, follow these steps:

Open the AWS CLI and navigate to the AWS Elasticsearch service.
Check the status of your Elasticsearch domains by running the following command:

aws es list-domain-names

Identify the domain that needs to be encrypted and run the following command to update the domain configuration:

aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true

This will enable encryption at rest for the Elasticsearch domain.

Verify that the domain is now encrypted by running the following command:

aws es describe-elasticsearch-domain --domain-name <domain-name> | grep EncryptionAtRestOptions

This should return a response that includes the following:

"EncryptionAtRestOptions": {
    "Enabled": true
}

This confirms that the domain is now encrypted at rest.

Repeat these steps for any other Elasticsearch domains that need to be encrypted.

Note: It is important to ensure that all Elasticsearch domains are encrypted to protect sensitive data.

Using Python

To remediate the ElasticSearch Domains Should Be Encrypted misconfiguration for AWS using Python, you can follow the below steps:

Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

Import the necessary libraries:

import boto3
from botocore.exceptions import ClientError

Set up the AWS credentials:

aws_access_key_id = 'YOUR_AWS_ACCESS_KEY_ID'
aws_secret_access_key = 'YOUR_AWS_SECRET_ACCESS_KEY'
region_name = 'YOUR_AWS_REGION_NAME'

Create an AWS ElasticSearch client:

es_client = boto3.client('es', aws_access_key_id=aws_access_key_id, aws_secret_access_key=aws_secret_access_key, region_name=region_name)

Get a list of all ElasticSearch domains:

response = es_client.list_domain_names()
domain_names = [domain['DomainName'] for domain in response['DomainNames']]

For each domain, check if it is encrypted:

for domain_name in domain_names:
    try:
        response = es_client.describe_elasticsearch_domain(DomainName=domain_name)
        encryption_at_rest_options = response['DomainStatus']['EncryptionAtRestOptions']
        if not encryption_at_rest_options['Enabled']:
            # Enable encryption
            es_client.update_elasticsearch_domain_config(DomainName=domain_name, EncryptionAtRestOptions={'Enabled': True})
            print(f"ElasticSearch domain {domain_name} has been encrypted.")
    except ClientError as e:
        print(f"Error checking encryption for ElasticSearch domain {domain_name}: {e}")

Run the Python script to remediate the misconfiguration.

Note: Make sure to replace the placeholders YOUR_AWS_ACCESS_KEY_ID, YOUR_AWS_SECRET_ACCESS_KEY, and YOUR_AWS_REGION_NAME with your AWS credentials and region name.

Additional Reading:

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ElasticSearch Domains Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: