> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ElasticSearch Domains Should Use The Latest Service Software ### More Info: ElasticSearch domains should be running the latest service software. ElasticSearch domains should be configured to run the latest service software which often contains security updates. ### Risk Level Low ### Address Operational Maturity, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step by step instructions to remediate the misconfiguration "ElasticSearch Domains Should Use The Latest Service Software" for AWS using the AWS console: 1. Open the AWS Management Console and navigate to the Amazon Elasticsearch Service dashboard. 2. Select the Elasticsearch domain that you want to update. 3. Click on the "Actions" button and select "Upgrade Elasticsearch Version". 4. In the "Upgrade Elasticsearch Version" dialog box, select the latest version of Elasticsearch that you want to upgrade to. 5. Choose the "Schedule Upgrade" option to schedule the upgrade for a later time or choose the "Upgrade Immediately" option to upgrade Elasticsearch immediately. 6. Review the upgrade details and click on the "Confirm" button to start the upgrade process. 7. Wait for the upgrade process to complete. The Elasticsearch domain will be unavailable during the upgrade process. 8. Once the upgrade process is complete, verify that the Elasticsearch domain is using the latest version of Elasticsearch. That's it! By following these steps, you can remediate the misconfiguration "ElasticSearch Domains Should Use The Latest Service Software" for AWS using the AWS console. # To remediate the misconfiguration "ElasticSearch Domains Should Use The Latest Service Software" for AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to get the list of Elasticsearch domains in your AWS account: ``` aws es list-domain-names ``` 3. Identify the Elasticsearch domain that needs to be updated to the latest service software. 4. Run the following command to get the details of the Elasticsearch domain: ``` aws es describe-elasticsearch-domain --domain-name ``` Replace `` with the name of the Elasticsearch domain that needs to be updated. 5. Check the value of the `ElasticsearchVersion` parameter in the output. If it is not the latest version, proceed to the next step. 6. Run the following command to update the Elasticsearch domain to the latest service software: ``` aws es update-elasticsearch-domain-config --domain-name --elasticsearch-version "7.10" ``` Replace `` with the name of the Elasticsearch domain that needs to be updated. The `--elasticsearch-version` parameter should be set to the latest version available at the time of remediation. In this example, we have used version 7.10. 7. Wait for the update to complete. You can check the status of the update by running the following command: ``` aws es describe-elasticsearch-domain --domain-name ``` Replace `` with the name of the Elasticsearch domain that was updated. 8. Verify that the Elasticsearch domain is now using the latest service software by checking the value of the `ElasticsearchVersion` parameter in the output of the `describe-elasticsearch-domain` command. With these steps, you have successfully remediated the misconfiguration "ElasticSearch Domains Should Use The Latest Service Software" for AWS using AWS CLI. To remediate the misconfiguration of ElasticSearch Domains Should Use The Latest Service Software in AWS using python, you can follow the below steps: 1. Import the necessary Python libraries: boto3 and json. ``` import boto3 import json ``` 2. Create an AWS ElasticSearch client using boto3. ``` client = boto3.client('es') ``` 3. Get the list of all Elasticsearch domains in the account using the `list_domain_names()` method. ``` domains = client.list_domain_names()['DomainNames'] ``` 4. Loop through each domain and check if the domain is using the latest service software version. You can get the latest Elasticsearch version using the `describe_elasticsearch_version()` method. ``` for domain in domains: domain_name = domain['DomainName'] response = client.describe_elasticsearch_version( DomainName=domain_name, ) latest_version = response['ElasticsearchVersions'][0] domain_info = client.describe_elasticsearch_domain( DomainName=domain_name ) current_version = domain_info['DomainStatus']['ElasticsearchVersion'] if current_version != latest_version: print(f"Updating {domain_name} from {current_version} to {latest_version}") response = client.update_elasticsearch_domain_config( DomainName=domain_name, ElasticsearchClusterConfig={ 'ElasticsearchVersion': latest_version, } ) ``` 5. Finally, run the Python script to remediate the misconfiguration in AWS ElasticSearch domains. Note: You need to have appropriate AWS credentials configured in your environment to run this script. ```hcl theme={null} resource "aws_elasticsearch_domain" "this" { domain_name = "ES_DOMAIN_NAME" # replace with your domain name engine_version = "LATEST_COMPATIBLE_VERSION" # replace with the target version from `get-compatible-elasticsearch-versions` # include the rest of your existing settings here so the domain is recreated identically: # cluster_config { ... } # ebs_options { ... } # vpc_options { ... } # snapshot_options { ... } # encrypt_at_rest { ... } # node_to_node_encryption { ... } # etc. } ``` * Set `LATEST_COMPATIBLE_VERSION` to the exact version you selected from `aws es get-compatible-elasticsearch-versions` (the same value you would pass to `--target-version` in `aws es upgrade-elasticsearch-domain`). * **Important:** In the current AWS provider, changing `engine_version` on `aws_elasticsearch_domain` forces resource replacement (destroy and recreate the domain). This is not reversible and can cause downtime and/or data loss if you are not also managing snapshots and data restore separately. The warnings from the CLI remediation still apply: review breaking changes, ensure recent snapshots, and expect a potentially long upgrade window. Verification with Terraform: * `terraform plan` should show a `-/+` change for `aws_elasticsearch_domain.this` with `engine_version` changing from the current version to `LATEST_COMPATIBLE_VERSION`, indicating the domain will be replaced with the new service software version. ### Additional Reading: * [https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html)