Elasticsearch domain must enforce HTTPS

High AWS General aws-elasticsearch-domain-elasticsearch-domain-enfo

Applies to

AWS::Elasticsearch::Domain

What CGPulse checks

A resource passes this rule when enforceHTTPS must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enforce HTTPS to require all traffic to use TLS encryption. In AWS Console: OpenSearch > Domains > select domain > Edit > set Enforce HTTPS. See: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html

Terraform

resource "aws_opensearch_domain" "{name}" {
  domain_endpoint_options {
    enforce_https = true
  }
}

Compliance frameworks

Cloud Security: AWS Foundations
Cloud Security: Multi-Cloud Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(e)(1)
ISO 27001: Information SecurityA.10.1.1
NIST 800-53: Cloud Security ControlsSC-8
PCI DSS v4.04.2.1

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan

Related AWS rules

ACM certificate must be eligible for renewal
ACM certificate must be in issued status
Amplify app should have basic auth disabled for production
API Gateway REST API must have an endpoint configuration
API Gateway V2 API must be properly configured
App Runner service must have encryption enabled
AppSync API must have logging configured
AppSync API must have X-Ray tracing enabled