More Info:
Your Amazon ElasticSearch (ES) domains should be encrypted with KMS Customer Master Keys (CMKs) instead of AWS managed-keysRisk Level
HighAddress
SecurityCompliance Standards
HIPAATriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step by step instructions to remediate the Elasticsearch Domain Should Be Encrypted with KMS CMKs on AWS:
- Login to your AWS console and navigate to the Elasticsearch service.
- Select the Elasticsearch domain that needs to be remediated.
- Click on the “Configure” button in the “Security” section.
- In the “Encryption” section, select the “KMS” option.
- Select the appropriate KMS CMK from the list of available keys. If you don’t have a KMS CMK, you can create one by clicking the “Create a new key” button.
- Once you have selected the KMS CMK, click the “Save changes” button to apply the encryption.
- Wait for the changes to take effect. This may take a few minutes.
- Verify that the Elasticsearch domain is now encrypted with the selected KMS CMK. You can do this by checking the “Encryption” section in the Elasticsearch domain’s configuration.
Using CLI
Using CLI
To remediate the Elasticsearch Domain misconfiguration in AWS using AWS CLI, you can follow these steps:Replace If the output is
- Identify the Elasticsearch domain that needs to be encrypted with KMS CMKs.
- Create a KMS Customer Master Key (CMK) if you don’t already have one.
- Enable AWS Key Management Service (KMS) encryption for the Elasticsearch domain using the following command:
<your-domain-name> with the name of your Elasticsearch domain and <your-KMS-CMK-ARN> with the ARN of the KMS CMK you want to use for encryption.- Verify that the Elasticsearch domain is encrypted with KMS CMKs by running the following command:
ENABLED, it means that the Elasticsearch domain is encrypted with KMS CMKs.- Repeat the above steps for all Elasticsearch domains that need to be encrypted with KMS CMKs.
Using Python
Using Python
To remediate the Elasticsearch Domain should be encrypted with KMS CMKs misconfiguration for AWS using python, you can follow the below steps:Replace This command will return the Elasticsearch Domain configuration, which should include the
- First, you need to identify the Elasticsearch Domain that is not encrypted with KMS CMKs. You can use the following AWS CLI command to get the list of Elasticsearch domains:
- Once you have identified the Elasticsearch Domain, you need to enable encryption using KMS CMKs. You can use the following AWS CLI command to enable encryption:
<domain-name> with the name of your Elasticsearch Domain and <kms-key-id> with the ID of the KMS CMK that you want to use for encryption.- Verify that the Elasticsearch Domain is encrypted with KMS CMKs. You can use the following AWS CLI command to get the Elasticsearch Domain configuration:
EncryptionAtRestOptions parameter with the value Enabled=true and KmsKeyId=<kms-key-id>.- Finally, you can confirm that the Elasticsearch Domain is encrypted with KMS CMKs by checking the AWS KMS console. The KMS CMK that you specified in step 2 should have been used to encrypt the Elasticsearch Domain.