ElasticSearch Should Use HTTPS Only

More Info:

ElasticSearch domains are configured to enforce HTTPS connections. ElasticSearch domains should be configured to enforce HTTPS connections for all clients to ensure encryption of data in transit.

Risk Level

Low

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the ElasticSearch misconfiguration of using HTTPS only in AWS using the AWS console, you can follow the below steps:

1. Log in to the AWS Management Console and navigate to the ElasticSearch service.

2. Select the misconfigured ElasticSearch domain.

3. In the domain dashboard, click on the "Edit" button in the "Encryption" section.

4. In the "Encryption" section, select the "Require HTTPS" option.

5. Click on the "Save Changes" button to apply the new configuration.

6. Once the changes are saved, ElasticSearch will only be accessible through HTTPS.

7. Verify the changes by attempting to access the ElasticSearch domain using HTTP. It should not be accessible and should return an error message.

By following these steps, you can remediate the misconfiguration of ElasticSearch not using HTTPS only in AWS.

Using CLI

To remediate the ElasticSearch misconfiguration of using HTTPS only in AWS using AWS CLI, you can follow the below steps:

1. Open the AWS CLI and run the following command to get the current status of the ElasticSearch domain:

   aws es describe-elasticsearch-domain --domain-name <domain-name>

   Replace <domain-name> with the name of your ElasticSearch domain.

2. Check the output of the above command for the value of the EncryptionAtRestOptions parameter. If it is not set to Enabled, then run the following command to enable encryption at rest:

   aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true

   Replace <domain-name> with the name of your ElasticSearch domain.

3. Next, run the following command to update the ElasticSearch domain to use HTTPS only:

   aws es update-elasticsearch-domain-config --domain-name <domain-name> --advanced-security-options Enabled=true,InternalUserDatabaseEnabled=false,MasterUserOptions.Enabled=false,NodeToNodeEncryptionOptions.Enabled=false,EncryptionAtRestOptions.Enabled=true,HTTPSEnabled=true

   Replace <domain-name> with the name of your ElasticSearch domain.

4. After running the above command, wait for a few minutes for the changes to take effect. You can check the status of the ElasticSearch domain again by running the describe-elasticsearch-domain command.

   aws es describe-elasticsearch-domain --domain-name <domain-name>

   If the output of this command shows that the HTTPSEnabled parameter is set to true, then the ElasticSearch domain is now using HTTPS only.

By following these steps, you can remediate the ElasticSearch misconfiguration of using HTTPS only in AWS using AWS CLI.

Using Python

To remediate this misconfiguration on AWS using Python, you can follow the steps below:

1. Install the AWS SDK for Python (Boto3) by running the following command in your terminal:

pip install boto3

2. Create an AWS ElasticSearch client using the Boto3 library:

import boto3

es_client = boto3.client('es')

3. Get the ElasticSearch domain configuration using the describe_elasticsearch_domain method:

domain_name = 'your-domain-name'
domain_config = es_client.describe_elasticsearch_domain(DomainName=domain_name)

4. Check if the ElasticSearch domain is using HTTPS only by looking at the DomainStatus dictionary:

domain_status = domain_config['DomainStatus']
if domain_status['EncryptionAtRestOptions']['Enabled'] and domain_status['NodeToNodeEncryptionOptions']['Enabled'] and domain_status['AdvancedSecurityOptions']['Enabled']:
    print('ElasticSearch domain is already using HTTPS only')
else:
    # Remediate the misconfiguration

5. If the ElasticSearch domain is not using HTTPS only, update the domain configuration using the update_elasticsearch_domain_config method:

from botocore.exceptions import ClientError

try:
    response = es_client.update_elasticsearch_domain_config(
        DomainName=domain_name,
        AdvancedSecurityOptions={
            'Enabled': True,
            'InternalUserDatabaseEnabled': False,
            'MasterUserOptions': {
                'MasterUserARN': 'arn:aws:iam::123456789012:user/elasticsearch-master-user',
                'MasterUserName': 'elasticsearch-master-user',
                'MasterUserPassword': 'your-password'
            }
        }
    )
    print('ElasticSearch domain configuration updated successfully')
except ClientError as e:
    print('Error updating ElasticSearch domain configuration: {}'.format(e))

6. Verify that the ElasticSearch domain is now using HTTPS only by checking the DomainStatus dictionary again:

domain_config = es_client.describe_elasticsearch_domain(DomainName=domain_name)
domain_status = domain_config['DomainStatus']
if domain_status['EncryptionAtRestOptions']['Enabled'] and domain_status['NodeToNodeEncryptionOptions']['Enabled'] and domain_status['AdvancedSecurityOptions']['Enabled']:
    print('ElasticSearch domain is now using HTTPS only')
else:
    print('Failed to remediate ElasticSearch misconfiguration')

Note: In the code above, we assume that the ElasticSearch domain is not using VPC and that you have an IAM user with the necessary permissions to update the ElasticSearch domain configuration. Also, make sure to replace your-domain-name and your-password with the actual values for your ElasticSearch domain.

Using Terraform

resource "aws_elasticsearch_domain" "THIS_DOMAIN" {
  domain_name = "YOUR_DOMAIN_NAME"

  # ...other required Elasticsearch domain arguments...

  domain_endpoint_options {
    enforce_https = true
  }
}

• Replace YOUR_DOMAIN_NAME with the actual domain name of your Elasticsearch domain.
• This change updates the endpoint options so all traffic must use HTTPS; it does not force resource replacement but will trigger an in-place domain update that can take some time and may impact clients still using HTTP.

After updating the Terraform and running terraform apply, terraform plan should show a single in-place change on aws_elasticsearch_domain.THIS_DOMAIN with domain_endpoint_options.enforce_https changing from false (or unset) to true.

Additional Reading:

• https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html