Es public service domain remediation

Using Console

To remediate the ElasticSearch domain misconfiguration in AWS, follow these steps:

Open the AWS Management Console and navigate to the Amazon ElasticSearch Service.
Select the ElasticSearch domain that you want to remediate.
Click on the “Modify” button in the “Actions” dropdown menu.
Scroll down to the “Network Configuration” section.
Under the “VPC Options” tab, enable the “VPC Access” option.
Select the VPC that you want to use for private access to your ElasticSearch domain.
Choose the subnets that you want to use for private access to your ElasticSearch domain.
Select the security groups that you want to use for private access to your ElasticSearch domain.
Click on the “Save Changes” button to apply the changes.
Verify that the ElasticSearch domain is now using private VPC endpoints by checking the “Endpoint” section in the domain details page. The endpoint should now show as a private IP address.

By following these steps, you have successfully remediated the ElasticSearch domain misconfiguration by launching it with private VPC endpoints in AWS.

Using CLI

To remediate the ElasticSearch Domains should be launched with private VPC endpoints in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your computer.
Run the following command to create a new VPC endpoint for ElasticSearch:

aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --service-name com.amazonaws.<region>.es --route-table-ids <route-table-id> --subnet-ids <subnet-id> --security-group-ids <security-group-id>

Replace <vpc-id> with the ID of the VPC that contains your ElasticSearch domain. Replace <region> with the region where your ElasticSearch domain is located. Replace <route-table-id> with the ID of the route table that is associated with your subnet. Replace <subnet-id> with the ID of the subnet that contains your ElasticSearch domain. Replace <security-group-id> with the ID of the security group that is associated with your ElasticSearch domain.

Run the following command to modify your ElasticSearch domain to use the VPC endpoint:

aws es modify-elasticsearch-domain-config --domain-name <domain-name> --vpc-options SubnetIds=<subnet-id>,SecurityGroupIds=<security-group-id>

Replace <domain-name> with the name of your ElasticSearch domain. Replace <subnet-id> with the ID of the subnet that contains your ElasticSearch domain. Replace <security-group-id> with the ID of the security group that is associated with your ElasticSearch domain.

Verify that your ElasticSearch domain is now using the VPC endpoint by running the following command:

aws es describe-elasticsearch-domain --domain-name <domain-name> --query 'DomainStatus.EndpointOptions.VPCOptions'

This command should return a JSON object that includes the VPC endpoint information.

Repeat these steps for each ElasticSearch domain that you want to remediate.

Using Python

To remediate this misconfiguration in AWS using Python, you can follow the below steps:

Install the AWS SDK for Python (Boto3) using the following command:
pip install boto3
Create an EC2 client using the following code:
import boto3 ec2 = boto3.client('ec2')
Get the VPC ID of the VPC where the ElasticSearch domain is launched using the following code:
response = ec2.describe_vpcs(Filters=[{'Name': 'tag:Name', 'Values': ['<VPC_NAME>']}]) vpc_id = response['Vpcs'][0]['VpcId']
Replace <VPC_NAME> with the name of the VPC where the ElasticSearch domain is launched.
Create a VPC endpoint for ElasticSearch using the following code:
response = ec2.create_vpc_endpoint( VpcEndpointType='Interface', VpcId=vpc_id, ServiceName='com.amazonaws.<REGION>.es', PrivateDnsEnabled=True, SecurityGroupIds=['<SECURITY_GROUP_ID>'], SubnetIds=['<SUBNET_ID>'] )
Replace <REGION> with the AWS region where the ElasticSearch domain is launched, <SECURITY_GROUP_ID> with the ID of the security group that allows traffic to the ElasticSearch domain, and <SUBNET_ID> with the ID of the subnet where the ElasticSearch domain is launched.

Update the ElasticSearch domain to use the VPC endpoint by setting the VPCOptions parameter using the following code:

import boto3

es = boto3.client('es')

response = es.update_elasticsearch_domain_config(
    DomainName='<DOMAIN_NAME>',
    ElasticsearchClusterConfig={
        'DedicatedMasterEnabled': False,
        'InstanceCount': 1,
        'InstanceType': '<INSTANCE_TYPE>',
        'ZoneAwarenessEnabled': False
    },
    EBSOptions={
        'EBSEnabled': True,
        'VolumeSize': 10,
        'VolumeType': 'gp2'
    },
    VPCOptions={
        'SubnetIds': ['<SUBNET_ID>'],
        'SecurityGroupIds': ['<SECURITY_GROUP_ID>'],
        'VpcId': vpc_id
    },
    CognitoOptions={
        'Enabled': False
    },
    AdvancedOptions={
        'rest.action.multi.allow_explicit_index': 'true'
    }
)

Replace <DOMAIN_NAME> with the name of the ElasticSearch domain, <INSTANCE_TYPE> with the desired instance type for the ElasticSearch cluster, <SUBNET_ID> with the ID of the subnet where the ElasticSearch domain is launched, and <SECURITY_GROUP_ID> with the ID of the security group that allows traffic to the ElasticSearch domain.

Verify that the ElasticSearch domain is now using the VPC endpoint by checking the VPCOptions parameter using the following code:
response = es.describe_elasticsearch_domain_config( DomainName='<DOMAIN_NAME>' ) vpc_options = response['DomainConfig']['VPCOptions'] print(vpc_options)
Replace <DOMAIN_NAME> with the name of the ElasticSearch domain.

By following these steps, you can remediate the misconfiguration of ElasticSearch domains not being launched with private VPC endpoints in AWS using Python.

Using Terraform

resource "aws_elasticsearch_domain" "THIS_DOMAIN" {
  domain_name           = "YOUR_DOMAIN_NAME"                # replace with your ES domain name
  elasticsearch_version = "7.10"                            # or whatever version you use

  # ...your existing cluster_config, ebs_options, etc...

  # Configure the domain to use a VPC endpoint only (no public endpoint)
  vpc_options {
    subnet_ids = [
      "SUBNET_ID_1",                                        # replace with first private subnet ID
      "SUBNET_ID_2",                                        # replace with second private subnet ID (optional but recommended for AZ redundancy)
    ]

    security_group_ids = [
      aws_security_group.es_vpc_sg.id,                      # or a list of existing SG IDs
    ]
  }
}

resource "aws_security_group" "es_vpc_sg" {
  name        = "es-vpc-endpoint-sg"
  description = "Security group for VPC-based Elasticsearch domain"
  vpc_id      = "VPC_ID"                                    # replace with your VPC ID

  # Ensure inbound 443 from resources that must reach the ES domain
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["ALLOWED_CIDR_BLOCK"]                    # e.g. your application subnets or VPC CIDR
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

This change updates the Elasticsearch domain to use vpc_options (private VPC endpoints) and removes the public endpoint; this move into a VPC is irreversible and triggers a blue/green deployment, though the domain name remains the same and Terraform treats it as an in‑place update (no resource replacement).To verify, terraform plan should show the aws_elasticsearch_domain.THIS_DOMAIN gaining a vpc_options block (with the specified subnet_ids and security_group_ids) and no replacement (-/+ or destroy/create) of the domain resource.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Es public service domain remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation