Skip to main content

Elasticsearch Should Use The Desired Instance Type

More Info:​

Determine if the Elasticsearch (ES) instances provisioned in your AWS account have the desired instance type established by your organization based on the workload deployed.

Risk Level​

Low

Address​

Cost Optimisation, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step by step instructions to remediate the Elasticsearch misconfiguration "Elasticsearch Should Use The Desired Instance Type" for AWS using the AWS console:

  1. Open the AWS Management Console and navigate to the Elasticsearch Service.
  2. Click on the Elasticsearch domain that you want to remediate.
  3. In the navigation pane, click on the "Elasticsearch Version" link.
  4. In the "Elasticsearch Version" page, click on the "Update" button.
  5. In the "Update Elasticsearch Version" page, select the desired Elasticsearch version and instance type.
  6. Click on the "Next" button.
  7. In the "Instance Configuration" page, select the number of instances and the instance type.
  8. Click on the "Next" button.
  9. In the "Review" page, review the changes and click on the "Submit" button to apply the changes.

Once you have completed these steps, the Elasticsearch instance will be updated to use the desired instance type.

Using CLI

To remediate the Elasticsearch instance type misconfiguration in AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI and check the current Elasticsearch instance type by running the following command:

    aws es describe-elasticsearch-domain --domain-name <your-domain-name> --output json

  2. The output will show the current Elasticsearch instance type. Note down the instance type and determine the desired instance type.

  3. Modify the Elasticsearch instance type by running the following command:

    aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --elasticsearch-cluster-config InstanceType=<desired-instance-type>

    Replace <your-domain-name> with the name of your Elasticsearch domain and <desired-instance-type> with the desired instance type.

  4. Wait for the Elasticsearch domain to update, which may take several minutes. You can check the status of the update by running the following command:

    aws es describe-elasticsearch-domain --domain-name <your-domain-name> --output json

  5. Verify that the Elasticsearch instance type has been updated to the desired instance type.

That's it! You have successfully remediated the Elasticsearch instance type misconfiguration in AWS using AWS CLI.

Using Python

To remediate the Elasticsearch misconfiguration "Elasticsearch Should Use The Desired Instance Type" in AWS using Python, you can follow these steps:

  1. Define the desired instance type for Elasticsearch in your AWS account.

  2. Use the AWS SDK for Python (Boto3) to update the Elasticsearch domain's instance type to the desired instance type.

Here is an example code snippet that you can use to update the Elasticsearch domain's instance type to the desired instance type:

import boto3

# Define the desired Elasticsearch instance type
desired_instance_type = 'm5.large.elasticsearch'

# Connect to the Elasticsearch service using Boto3
es_client = boto3.client('es')

# Get the list of Elasticsearch domains in your AWS account
es_domains = es_client.list_domain_names()['DomainNames']

# Loop through each Elasticsearch domain and update its instance type to the desired instance type
for es_domain in es_domains:
    es_domain_name = es_domain['DomainName']
    es_domain_status = es_client.describe_elasticsearch_domain(DomainName=es_domain_name)['DomainStatus']
    current_instance_type = es_domain_status['ElasticsearchClusterConfig']['InstanceType']
    if current_instance_type != desired_instance_type:
        es_client.update_elasticsearch_domain_config(
            DomainName=es_domain_name,
            ElasticsearchClusterConfig={
                'InstanceType': desired_instance_type
            }
        )
        print(f"Updated Elasticsearch domain '{es_domain_name}' instance type from '{current_instance_type}' to '{desired_instance_type}'.")
    else:
        print(f"Elasticsearch domain '{es_domain_name}' instance type is already set to '{desired_instance_type}'.")

This code will loop through each Elasticsearch domain in your AWS account, check its current instance type, and update it to the desired instance type if it is not already set to that value. Note that you will need to have the appropriate AWS credentials configured to run this code.

Using Terraform
resource "aws_elasticsearch_domain" "es_domain" {
  domain_name = "ES_DOMAIN_NAME" # replace with your ES domain name

  elasticsearch_version = "ES_VERSION" # e.g., "7.10"

  elasticsearch_cluster_config {
    instance_type  = "DESIRED_INSTANCE_TYPE"  # e.g., "m5.large.elasticsearch"
    instance_count = 2                        # keep your current value
    zone_awareness_enabled = true            # keep your current value
    # ...include any other existing cluster settings here so they are not reset...
  }

  # ...other existing configuration (EBS options, snapshot options, etc.)...
}

resource "aws_opensearch_domain" "os_domain" {
  domain_name = "OPENSEARCH_DOMAIN_NAME" # replace with your OpenSearch domain name

  engine_version = "OPENSEARCH_VERSION" # e.g., "OpenSearch_2.13"

  cluster_config {
    instance_type  = "DESIRED_INSTANCE_TYPE"  # e.g., "m5.large.search"
    instance_count = 2                        # keep your current value
    zone_awareness_enabled = true            # keep your current value
    # ...include any other existing cluster settings here so they are not reset...
  }

  # ...other existing configuration...
}

Changing instance_type on either domain will not force resource replacement but will trigger a blue/green deployment and may take time; ensure you carry over all existing *_cluster_config / cluster_config attributes to avoid them resetting to defaults.

Verification: terraform plan should show an in-place update changing only elasticsearch_cluster_config.instance_type (for aws_elasticsearch_domain) or cluster_config.instance_type (for aws_opensearch_domain) from the current value to "DESIRED_INSTANCE_TYPE".

Additional Reading:​