Skip to main content

Elasticsearch Should Have Zone Awareness Enabled

More Info:​

AWS Elasticsearch (ES) cross-zone replication (Zone Awareness) should be enabled to increase the availability of your ES clusters

Risk Level​

Informational

Address​

Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the Elasticsearch should have zone awareness enabled misconfiguration for AWS using the AWS console, please follow the below steps:

  1. Open the AWS Elasticsearch console.
  2. Select the Elasticsearch domain for which you want to enable zone awareness.
  3. Click on the "Configure cluster" button.
  4. Under the "Instance settings" section, click on the "Edit" button.
  5. Scroll down to the "Zone awareness" section and enable it by selecting the "Enable zone awareness" checkbox.
  6. Select the number of availability zones you want to use.
  7. Choose the preferred instance type for each availability zone.
  8. Click on the "Save changes" button to save the changes.

Once the changes are saved, Elasticsearch will be configured with zone awareness, which ensures that data is distributed across multiple availability zones for high availability and fault tolerance.

Using CLI

To remediate the Elasticsearch misconfiguration for AWS using AWS CLI, you can follow the below steps:

Step 1: Log in to the AWS Management Console and open the AWS CLI.

Step 2: Run the following command to enable zone awareness for your Elasticsearch domain:

aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --zone-awareness-config Enabled=true

Note: Replace <your-domain-name> with the actual name of your Elasticsearch domain.

Step 3: Verify that zone awareness is enabled for your Elasticsearch domain by running the following command:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> | grep ZoneAwarenessEnabled

The output should show "ZoneAwarenessEnabled": true.

Step 4: If you have multiple availability zones in your region, you can also specify the list of availability zones to use for your Elasticsearch domain by running the following command:

aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --zone-awareness-config AvailabilityZoneCount=<number-of-availability-zones>, AvailabilityZones=<list-of-availability-zones>

Note: Replace <number-of-availability-zones> with the actual number of availability zones you want to use, and <list-of-availability-zones> with the actual list of availability zones you want to use.

Step 5: Verify that the availability zones are set correctly by running the following command:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> | grep AvailabilityZones

The output should show the list of availability zones you specified.

By following these steps, you can remediate the Elasticsearch misconfiguration by enabling zone awareness for your Elasticsearch domain in AWS.

Using Python

To remediate the misconfiguration in AWS, you can use the following steps in Python:

  1. Install the AWS SDK for Python (Boto3) using the following command:
pip install boto3
  1. Create a Boto3 Elasticsearch client using the following code:
import boto3

client = boto3.client('es')
  1. Get the Elasticsearch domain configuration using the describe_elasticsearch_domain method:
domain_name = 'your-domain-name'
response = client.describe_elasticsearch_domain(DomainName=domain_name)
  1. Check if zone awareness is enabled in the Elasticsearch domain configuration:
zone_awareness_enabled = response['DomainStatus']['ElasticsearchClusterConfig']['ZoneAwarenessEnabled']
if zone_awareness_enabled:
    print('Zone awareness is already enabled')
else:
    print('Zone awareness is not enabled')
  1. If zone awareness is not enabled, update the Elasticsearch domain configuration using the update_elasticsearch_domain_config method:
if not zone_awareness_enabled:
    zone_awareness_config = {
        'AvailabilityZoneCount': 2
    }
    response = client.update_elasticsearch_domain_config(
        DomainName=domain_name,
        ElasticsearchClusterConfig={
            'ZoneAwarenessEnabled': True,
            'ZoneAwarenessConfig': zone_awareness_config
        }
    )
    print('Zone awareness is now enabled')
  1. Verify that zone awareness is enabled by checking the Elasticsearch domain configuration again:
response = client.describe_elasticsearch_domain(DomainName=domain_name)
zone_awareness_enabled = response['DomainStatus']['ElasticsearchClusterConfig']['ZoneAwarenessEnabled']
if zone_awareness_enabled:
    print('Zone awareness is enabled')
else:
    print('Zone awareness is not enabled')

By following these steps, you can remediate the misconfiguration of Elasticsearch not having zone awareness enabled in AWS using Python.

Using Terraform
resource "aws_elasticsearch_domain" "ES_DOMAIN" {
  domain_name = "ES_DOMAIN_NAME"

  cluster_config {
    instance_type          = "INSTANCE_TYPE"
    instance_count         = INSTANCE_COUNT               # must be a multiple of AZ count
    zone_awareness_enabled = true

    # Optionally, to explicitly use 3 AZs instead of the default 2:
    # zone_awareness_config {
    #   availability_zone_count = 3
    # }
  }

  # ...other required arguments (e.g., ebs_options, vpc_options, etc.)...
}

Enabling zone_awareness_enabled = true changes the domain’s cluster configuration in place and can trigger a long-running blue/green deployment; ensure instance_count is a multiple of the AZ count (2 by default, or 3 if you set availability_zone_count = 3) to avoid update failures.

For verification, terraform plan should show an in-place update on aws_elasticsearch_domain.ES_DOMAIN with cluster_config.zone_awareness_enabled changing from false (or unset) to true (and, if used, the availability_zone_count value being added or updated).

Additional Reading:​