Skip to main content

AWS Opensearch Should Be in VPC

More Info:​

Ensure Opensearch cluster is in VPC

Risk Level​

Medium

Address​

Configuration

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of OpenSearch not being in a VPC for AWS, you can follow these steps using the AWS Management Console:

  1. Create a VPC (Virtual Private Cloud):

    • Go to the AWS Management Console and navigate to the VPC service.
    • Click on "Your VPCs" in the left-hand menu and then click on "Create VPC".
    • Enter the details for your VPC such as name, IPv4 CIDR block, and any additional settings as needed.
    • Click "Create" to create the VPC.

  2. Create Subnets within the VPC:

    • Inside the VPC dashboard, click on "Subnets" in the left-hand menu.
    • Click on "Create subnet" and select the VPC you created in the previous step.
    • Enter the details for the subnet such as name, VPC, availability zone, and IPv4 CIDR block.
    • Click "Create" to create the subnet.

  3. Modify OpenSearch Domain:

    • Go to the Amazon OpenSearch Service console.
    • Find the OpenSearch domain that you want to modify and click on its name to go to the domain details page.
    • Click on the "Edit domain" button.
    • In the "Network configuration" section, select the VPC that you created in step 1 from the dropdown.
    • Select the subnets within the VPC that you created in step 2.
    • Click "Save changes" to apply the VPC configuration to the OpenSearch domain.

  4. Verify the Configuration:

    • Once the changes are saved, verify that the OpenSearch domain is now within the VPC.
    • You can check the network configuration details in the OpenSearch domain settings to ensure that it is using the VPC and subnets you specified.

By following these steps, you will successfully remediate the misconfiguration of OpenSearch not being in a VPC for AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of Amazon OpenSearch not being in a VPC using AWS CLI, follow these steps:

  1. Create a VPC (if not already created): If there is no VPC available, you need to create one. You can use the following AWS CLI command to create a VPC:

    aws ec2 create-vpc --cidr-block 10.0.0.0/16

  2. Create Subnets within the VPC: Next, you need to create subnets within the VPC. Use the following AWS CLI command to create a subnet in the VPC:

    aws ec2 create-subnet --vpc-id <VPC-ID> --cidr-block 10.0.1.0/24

  3. Modify OpenSearch Domain to use VPC: Update the OpenSearch domain to use the VPC and the subnets you created. Use the following AWS CLI command to modify the OpenSearch domain:

    aws opensearchservice update-domain-config --domain-name <your-domain-name> --vpc-options SubnetIds=<subnet-id-1>,<subnet-id-2>,VPCId=<vpc-id>

  4. Verify the Configuration: Once you have updated the OpenSearch domain to use the VPC, verify the configuration to ensure that the domain is now within the VPC. You can use the following AWS CLI command to describe the domain:

    aws opensearchservice describe-domain --domain-name <your-domain-name>

  5. Ensure Security Group Configuration: Make sure that the security group associated with the OpenSearch domain allows the necessary inbound and outbound traffic for your use case.

By following these steps, you can remediate the misconfiguration of Amazon OpenSearch not being in a VPC using AWS CLI.

Using Python

To remediate the misconfiguration of OpenSearch not being in a VPC in AWS using Python, you can follow these steps:

  1. Create a VPC:

    • Use the boto3 library in Python to create a new Virtual Private Cloud (VPC) in AWS.
    • Specify the CIDR block for the VPC and any other relevant configurations.

  2. Create Subnets:

    • Within the VPC, create one or more subnets using the create_subnet method in boto3.
    • Ensure that the subnets are associated with the VPC and are in different Availability Zones for high availability.

  3. Update OpenSearch Domain:

    • Use the update_domain_config method in boto3 to update the configuration of your OpenSearch domain.
    • Set the VPC options for the OpenSearch domain to specify the VPC and subnets you created earlier.

  4. Ensure Security Group Configuration:

    • Update the security group associated with the OpenSearch domain to allow necessary inbound and outbound traffic.
    • Ensure that the security group allows traffic from the subnets within the VPC.

  5. Verify the Configuration:

    • Check the OpenSearch domain configuration to ensure that it is now located within the specified VPC and subnets.
    • Test the connectivity to the OpenSearch domain to confirm that it is functioning correctly within the VPC.

Here is a sample Python code snippet to update the VPC configuration for an OpenSearch domain using boto3:

import boto3

client = boto3.client('es')

response = client.update_elasticsearch_domain_config(
    DomainName='your-opensearch-domain-name',
    ElasticsearchClusterConfig={
        'InstanceType': 'm5.large.elasticsearch',
        'InstanceCount': 2,
        'DedicatedMasterEnabled': False,
        'ZoneAwarenessEnabled': False
    },
    VPCOptions={
        'SubnetIds': [
            'subnet-12345678',
            'subnet-87654321'
        ],
        'SecurityGroupIds': [
            'sg-123abcde'
        ]
    }
)

print(response)

Replace 'your-opensearch-domain-name', 'subnet-12345678', 'subnet-87654321', and 'sg-123abcde' with your actual values.

By following these steps and executing the Python script, you can successfully remediate the misconfiguration of OpenSearch not being in a VPC in AWS.

Using Terraform
resource "aws_opensearch_domain" "this" {
  domain_name = "YOUR_DOMAIN_NAME" # replace with your OpenSearch domain name

  # ... other existing configuration (cluster_config, ebs_options, etc.)

  # Place the OpenSearch domain into a VPC, equivalent to:
  # aws opensearch update-domain-config --vpc-options '{"SubnetIds":[...],"SecurityGroupIds":[...]}'
  vpc_options {
    subnet_ids         = ["SUBNET_ID_1", "SUBNET_ID_2"]     # replace with at least two subnet IDs in different AZs
    security_group_ids = ["SECURITY_GROUP_ID"]              # replace with a security group ID that allows required access
  }
}

# Example security group for the domain (optional, adapt as needed)
resource "aws_security_group" "opensearch" {
  name        = "opensearch-domain-sg"
  description = "Security group for OpenSearch VPC domain"
  vpc_id      = "YOUR_VPC_ID" # replace with your VPC ID

  # Allow HTTPS from your client networks
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["CLIENT_CIDR_BLOCK"] # replace with your client CIDR(s), e.g., "10.0.0.0/16"
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

This change moves the OpenSearch domain into the specified VPC subnets and security group, matching the CLI update-domain-config --vpc-options behavior. Moving a domain from public access into a VPC is effectively irreversible and requires recreating the domain in Terraform (the aws_opensearch_domain resource will be destroyed and re-created), and AWS will perform a blue/green deployment during the update window.

For verification, terraform plan should show the aws_opensearch_domain.this resource being replaced with the new vpc_options block added, and (if you added it) creation of aws_security_group.opensearch.