Elasticsearch Domains Should Be Accessible Only From

More Info:

The access to your Elasticsearch Service (ES) domains should be made based on whitelisted IP addresses only in order to protect them against unauthorized access

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the Elasticsearch Domains Should Be Accessible Only From Whitelisted IP Addresses misconfiguration in AWS, follow these steps:

1. Login to your AWS console and navigate to the Elasticsearch service.

2. Select the Elasticsearch domain that you want to remediate.

3. Click on the "Modify access policy" button.

4. In the "Access policy" section, select the "Custom access policy" option.

5. Replace the existing policy with the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "es:*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "x.x.x.x/32",
            "y.y.y.y/32"
          ]
        }
      },
      "Resource": "arn:aws:es:us-west-2:123456789012:domain/my-domain/*"
    }
  ]
}

6. Replace the x.x.x.x/32 and y.y.y.y/32 with the IP addresses that you want to whitelist.

7. Click on the "Save changes" button to save the new access policy.

This will ensure that only the whitelisted IP addresses will be able to access the Elasticsearch domain.

Using CLI

To remediate the misconfiguration of Elasticsearch domains being accessible only from whitelisted IP addresses in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine.

2. Run the following command to get the Elasticsearch domain endpoint:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> --output text --query 'DomainStatus.Endpoint'

3. Run the following command to get the current access policy of the Elasticsearch domain:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> --output text --query 'DomainStatus.AccessPolicies'

4. Copy the output of the above command to a text editor and edit the access policy to allow access only from the whitelisted IP addresses.

5. Run the following command to update the access policy of the Elasticsearch domain:

aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --access-policies <path-to-edited-access-policy-file>

Replace <path-to-edited-access-policy-file> with the path to the file containing the edited access policy.

6. Verify that the access policy has been updated by running the following command:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> --output text --query 'DomainStatus.AccessPolicies'

The output should show the updated access policy.

7. Test the Elasticsearch domain to ensure that it is accessible only from the whitelisted IP addresses.

Using Python

To remediate this misconfiguration for AWS Elasticsearch domains, you can use the AWS Python SDK, Boto3. Here are the steps to remediate:

1. Install Boto3: You can install Boto3 using pip. Run the following command in your terminal or command prompt:

   pip install boto3

2. Create a Boto3 client for Elasticsearch: In your Python script, create a Boto3 client for Elasticsearch using the following code:

   import boto3
   
   es_client = boto3.client('es')

3. Get the Elasticsearch domain configuration: Use the describe_elasticsearch_domain_config method of the Elasticsearch client to get the current domain configuration. Here is an example code:

   domain_name = 'your-domain-name'
   
   response = es_client.describe_elasticsearch_domain_config(
       DomainName=domain_name
   )
   
   domain_config = response['DomainConfig']

4. Update the Elasticsearch domain access policy: Update the access policy of the Elasticsearch domain to allow access only from whitelisted IP addresses. You can use the update_elasticsearch_domain_config method of the Elasticsearch client to update the access policy. Here is an example code:

   # Whitelist IP addresses
   ip_addresses = ['1.2.3.4', '5.6.7.8']
   
   # Create the access policy
   access_policy = {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "*"
               },
               "Action": "es:*",
               "Condition": {
                   "IpAddress": {
                       "aws:SourceIp": ip_addresses
                   }
               },
               "Resource": "arn:aws:es:us-east-1:123456789012:domain/your-domain-name/*"
           }
       ]
   }
   
   # Update the Elasticsearch domain configuration
   es_client.update_elasticsearch_domain_config(
       DomainName=domain_name,
       ElasticsearchClusterConfig=domain_config['ElasticsearchClusterConfig'],
       EBSOptions=domain_config['EBSOptions'],
       SnapshotOptions=domain_config['SnapshotOptions'],
       AdvancedOptions=domain_config['AdvancedOptions'],
       AccessPolicies=json.dumps(access_policy)
   )

   In the above code, replace ip_addresses with a list of the IP addresses that should be whitelisted.

5. Verify the Elasticsearch domain configuration: Use the describe_elasticsearch_domain_config method of the Elasticsearch client to verify that the access policy has been updated. Here is an example code:

   response = es_client.describe_elasticsearch_domain_config(
       DomainName=domain_name
   )
   
   access_policies = json.loads(response['DomainConfig']['AccessPolicies'])
   
   print(access_policies)

   The above code will print the updated access policy. Verify that the IP addresses in the access policy match the whitelisted IP addresses.

That's it! The Elasticsearch domain is now accessible only from the whitelisted IP addresses.

Using Terraform

# Replace DOMAIN_NAME, DOMAIN_ARN, and WHITELISTED_CIDR_n with your values.

data "aws_iam_policy_document" "es_whitelisted_ip_access" {
  statement {
    sid    = "AllowAccessFromWhitelistedIPs"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = ["es:*"]

    resources = [
      "arn:aws:es:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:domain/DOMAIN_NAME/*"
    ]

    condition {
      test     = "IpAddress"
      variable = "aws:SourceIp"
      values = [
        "WHITELISTED_CIDR_1", # e.g. "203.0.113.10/32"
        "WHITELISTED_CIDR_2", # optional
      ]
    }
  }
}

data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

resource "aws_elasticsearch_domain" "this" {
  domain_name = "DOMAIN_NAME"

  # ... other required config: cluster_config, ebs_options, etc.

  # WARNING: This policy completely replaces any prior access_policies on the domain.
  # Merge any existing required statements into data.aws_iam_policy_document.es_whitelisted_ip_access.
  access_policies = data.aws_iam_policy_document.es_whitelisted_ip_access.json
}

Changing access_policies is an in-place update and does not replace the Elasticsearch domain, but it does fully overwrite any existing policy, so ensure all required statements are merged into aws_iam_policy_document.es_whitelisted_ip_access. After the change, terraform plan should show an in-place update in-place for aws_elasticsearch_domain.this with the old access_policies JSON replaced by the new, IP-restricted policy.

Additional Reading:

• https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/