Encryption At Rest Should Be Enabled OpenSearch Service Domains

More Info:

This rule checks whether Amazon OpenSearch Service domains have encryption at rest configuration enabled. Encryption at rest helps protect sensitive data stored in OpenSearch domains from unauthorized access. The rule is marked as non-compliant if the EncryptionAtRestOptions field is not enabled.

Risk Level

Medium

Address

Security

Compliance Standards

CBP,SEBI,RBI_UCB

Triage and Remediation

Remediation

Using Console

Using CLI

To enable encryption at rest for an Amazon OpenSearch Service domain in AWS using the AWS CLI, follow these steps:

Identify the OpenSearch Service domain: First, you need to identify the OpenSearch Service domain for which you want to enable encryption at rest. You can list all the domains using the following AWS CLI command:
```
aws opensearchservice list-domain-names
```
Enable encryption at rest: Once you have identified the domain, you can enable encryption at rest by updating the domain configuration. Use the following AWS CLI command to update the domain configuration and enable encryption at rest:
```
aws opensearchservice update-domain-config --domain-name <your-domain-name> --advanced-security-options Enabled=true,InternalUserDatabaseEnabled=true --node-to-node-encryption-options Enabled=true
```
Replace <your-domain-name> with the actual name of your OpenSearch Service domain.
Monitor the domain: After enabling encryption at rest, monitor the domain to ensure that the configuration change is successfully applied. You can check the status of the domain using the following AWS CLI command:
```
aws opensearchservice describe-elasticsearch-domain --domain-name <your-domain-name> --query "DomainStatus"
```
Replace <your-domain-name> with the actual name of your OpenSearch Service domain.
Verify encryption at rest: Finally, verify that encryption at rest is enabled for the OpenSearch Service domain by checking the domain configuration. You can use the following AWS CLI command to describe the domain configuration:
```
aws opensearchservice describe-elasticsearch-domain-config --domain-name <your-domain-name> --query "DomainConfig.ElasticsearchClusterConfig.NodeToNodeEncryptionOptions"
```
Replace <your-domain-name> with the actual name of your OpenSearch Service domain.

By following these steps, you can remediate the misconfiguration and enable encryption at rest for an Amazon OpenSearch Service domain in AWS using the AWS CLI.

Using Python

To remediate the misconfiguration of enabling Encryption At Rest for AWS OpenSearch Service domains using Python, you can use the AWS SDK for Python (Boto3) to update the domain configuration. Here are the step-by-step instructions to enable Encryption At Rest for an AWS OpenSearch Service domain:

Install Boto3: If you haven’t already installed the Boto3 library, you can do so using pip:

pip install boto3

Configure AWS Credentials: Make sure you have your AWS credentials configured either by setting environment variables or using AWS CLI aws configure.
Write Python script: Create a Python script with the following code to enable Encryption At Rest for the OpenSearch Service domain. Replace your-domain-name with the actual domain name of your OpenSearch Service domain:

import boto3

def enable_encryption_at_rest(domain_name):
    client = boto3.client('es')

    response = client.update_elasticsearch_domain_config(
        DomainName=domain_name,
        ElasticsearchClusterConfig={
            'DedicatedMasterEnabled': False,
            'InstanceCount': 1,
            'InstanceType': 't2.small.elasticsearch',
            'ZoneAwarenessEnabled': False
        },
        EBSOptions={
            'EBSEnabled': True,
            'VolumeType': 'gp2',
            'VolumeSize': 10
        },
        EncryptionAtRestOptions={
            'Enabled': True
        }
    )

    print("Encryption at rest has been enabled for the OpenSearch Service domain: {}".format(domain_name))

if __name__ == "__main__":
    domain_name = 'your-domain-name'
    enable_encryption_at_rest(domain_name)

Run the script: Execute the Python script to enable Encryption At Rest for the specified OpenSearch Service domain:

python enable_encryption_at_rest.py

After running the script, Encryption At Rest should be enabled for the specified AWS OpenSearch Service domain.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Encryption At Rest Should Be Enabled OpenSearch Service Domains

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation