ElasticSearch Should Have Logging Enabled

Using Console

Sure, here are the step-by-step instructions to remediate the Elasticsearch logging misconfiguration in AWS:

Log in to your AWS Management Console.
Navigate to the Elasticsearch service.
Select the Elasticsearch domain that you want to remediate.
Click on the “Actions” drop-down menu and select “Modify Domain.”
Scroll down to the “Logging” section and ensure that the “Enabled” option is selected.
In the “Log Publishing Options” section, select the desired log types that you want to publish to CloudWatch Logs.
In the “Log Publishing Options” section, select the desired log retention period.
Click on the “Submit” button to save the changes.

Once you have completed these steps, Elasticsearch logging will be enabled for the selected Elasticsearch domain, and logs will be published to CloudWatch Logs for the selected log types and retention period.

Using CLI

To remediate the ElasticSearch logging misconfiguration in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to enable logging for your ElasticSearch domain:

aws es update-elasticsearch-domain-config --domain-name <domain-name> --elasticsearch-cluster-config '{"CloudWatchLogsLogGroupArn":"<log-group-arn>","LogPublishingOptions":{"INDEX_SLOW_LOGS":{"CloudWatchLogsLogGroupArn":"<log-group-arn>","Enabled":true},"SEARCH_SLOW_LOGS":{"CloudWatchLogsLogGroupArn":"<log-group-arn>","Enabled":true},"ES_APPLICATION_LOGS":{"CloudWatchLogsLogGroupArn":"<log-group-arn>","Enabled":true},"AUDIT_LOGS":{"CloudWatchLogsLogGroupArn":"<log-group-arn>","Enabled":true}}}'

Replace <domain-name> with the name of your ElasticSearch domain and <log-group-arn> with the ARN of the CloudWatch Logs log group where you want to store your ElasticSearch logs.

Verify that logging is enabled by running the following command:

aws es describe-elasticsearch-domain-config --domain-name <domain-name>

This will return the current configuration of your ElasticSearch domain. Check that the LogPublishingOptions property has the correct values for each log type.

Wait for a few minutes for the changes to take effect and start seeing the logs in your CloudWatch Logs log group.

By following these steps, you have successfully remediated the ElasticSearch logging misconfiguration in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of ElasticSearch not having logging enabled in AWS using Python, you can follow these steps:

Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

Create an AWS ElasticSearch client using Boto3:

import boto3

es_client = boto3.client('es')

Check if logging is enabled for the ElasticSearch domain:

domain_name = 'your-domain-name'

logging_config = es_client.describe_elasticsearch_domain_config(
    DomainName=domain_name,
    DeploymentName='log-publishing'
)['DomainConfig']['LogPublishingOptions']

if logging_config:
    print('Logging is already enabled for the ElasticSearch domain.')
else:
    print('Logging is not enabled for the ElasticSearch domain.')

If logging is not enabled, enable it by updating the ElasticSearch domain configuration:

logging_config = {
    'ES_APPLICATION_LOGS': {
        'CloudWatchLogsLogGroupArn': 'your-log-group-arn',
        'Enabled': True
    }
}

response = es_client.update_elasticsearch_domain_config(
    DomainName=domain_name,
    LogPublishingOptions=logging_config
)

print('Logging has been enabled for the ElasticSearch domain.')

Note: You will need to replace your-domain-name and your-log-group-arn with your own domain name and CloudWatch Logs log group ARN, respectively.

Using Terraform

resource "aws_cloudwatch_log_group" "opensearch_app_logs" {
  name              = "/aws/opensearch/domains/${aws_opensearch_domain.MY_DOMAIN.domain_name}/application-logs"
  retention_in_days = 30 # adjust as needed
}

resource "aws_cloudwatch_log_resource_policy" "opensearch_logs" {
  policy_name     = "opensearch-log-publishing-policy"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowOpenSearchToPublishLogs"
        Effect = "Allow"
        Principal = {
          Service = "es.amazonaws.com"
        }
        Action   = "logs:PutLogEvents"
        Resource = "${aws_cloudwatch_log_group.opensearch_app_logs.arn}:*"
      }
    ]
  })
}

resource "aws_opensearch_domain" "MY_DOMAIN" {
  domain_name = "YOUR_DOMAIN_NAME" # replace with your domain name

  # ... existing configuration ...

  # WARNING: Terraform manages the entire log_publishing_options block.
  # Ensure ALL desired log types (ES_APPLICATION_LOGS, SEARCH_SLOW_LOGS, INDEX_SLOW_LOGS, etc.)
  # are declared here so they are not removed on apply.
  log_publishing_options {
    log_type = "ES_APPLICATION_LOGS"

    cloudwatch_log_group_arn = aws_cloudwatch_log_group.opensearch_app_logs.arn
    enabled                   = true
  }

  # example: add other logs if you already use them
  # log_publishing_options {
  #   log_type                = "SEARCH_SLOW_LOGS"
  #   cloudwatch_log_group_arn = aws_cloudwatch_log_group.opensearch_search_slow.arn
  #   enabled                   = true
  # }
}

This updates the domain’s log publishing configuration, enabling ES_APPLICATION_LOGS to a specified CloudWatch log group; Terraform will replace the entire log_publishing_options configuration on each apply, so all required log types must be included in this resource. The domain enters a processing state during update but is not replaced.Verification: terraform plan should show:

aws_cloudwatch_log_group.opensearch_app_logs and aws_cloudwatch_log_resource_policy.opensearch_logs to be created.
aws_opensearch_domain.MY_DOMAIN to be updated in-place with log_publishing_options adding ES_APPLICATION_LOGS set to enabled = true and pointing to the new log group ARN.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ElasticSearch Should Have Logging Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: