More Info:
ElasticSearch domain traffic should be encrypted in transit between nodes. ElasticSearch domains should use node-to-node encryption to ensure data in transit remains encrypted using TLS 1.2.Risk Level
HighAddress
SecurityCompliance Standards
HIPAA, GDPR, NIST, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the ElasticSearch Domain misconfiguration for AWS using the AWS console:
- Login to your AWS console and navigate to the ElasticSearch service.
- Select the ElasticSearch domain that you want to remediate.
- Click on the “Edit” button to edit the domain configuration.
- Under the “Encryption” section, select the “Require node-to-node encryption” option.
- Click on the “Save changes” button to save the updated configuration.
- Wait for a few minutes for the changes to take effect.
- Verify that the ElasticSearch domain now has node-to-node encryption enabled by checking the “Encryption” section in the domain configuration.
Using CLI
Using CLI
To remediate the ElasticSearch Domains should have Node to Node Encryption misconfiguration in AWS using AWS CLI, follow the below steps:
- Open your terminal and install the AWS CLI if you haven’t already installed it.
- Authenticate the AWS CLI using your AWS credentials.
- Run the following command to enable Node to Node Encryption for your ElasticSearch domain:
-
Replace
<your-domain-name>with the name of your ElasticSearch domain. - After running the above command, AWS will update the configuration of your ElasticSearch domain to enable Node to Node Encryption.
- Verify the configuration by running the following command:
- If the output of the above command shows that Node to Node Encryption is enabled, then the remediation is successful.
Using Python
Using Python
To remediate the misconfiguration that ElasticSearch domains should have node to node encryption in AWS using Python, you can follow these steps:Note: You will need to have the appropriate IAM permissions to update the ElasticSearch domain configuration using Boto3.
- Open the AWS Management Console and navigate to the ElasticSearch service.
- Select the ElasticSearch domain that requires node to node encryption.
- In the domain dashboard, click on the “Configure” button.
- In the “Node-to-Node Encryption” section, click on the “Edit” button.
- Enable node-to-node encryption by setting the “Enabled” option to “Yes”.
- Click on the “Save Changes” button to apply the changes.
- To automate this process using Python, you can use the AWS SDK for Python (Boto3) to update the domain configuration. Here’s an example code snippet: