Opensearch Should Export Logs To Cloudwatch

More Info:

Ensure Opensearch logs are sent to cloudwatch

Risk Level

Medium

Address

Operational Maturity, Reliability, Security

Compliance Standards

HIPAA,SOC2,HITRUST,NISTCSF,PCIDSS,SEBI,RBI_MD_ITF,RBI_UCB

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration where OpenSearch should export logs to CloudWatch in AWS, you can follow these steps using the AWS CLI:

Enable the Log Publishing Option: Run the following AWS CLI command to enable the log publishing option for your OpenSearch domain. Replace <domain-name> with the name of your OpenSearch domain.
```
aws opensearchservice update-domain-config --domain-name <domain-name> --advanced-security-options "AuditLogs: { CloudWatchLogs: { Enabled: true }}"
```
Verify the Configuration: You can verify that the log publishing option is enabled for your OpenSearch domain by describing the domain configuration using the following command:
```
aws opensearchservice describe-elasticsearch-domain-config --domain-name <domain-name>
```
Check CloudWatch Logs: Once the configuration is updated, you should start seeing the OpenSearch logs in CloudWatch Logs. You can access these logs from the AWS Management Console or by using the CloudWatch Logs API.

By following these steps, you can remediate the misconfiguration and ensure that OpenSearch logs are exported to CloudWatch in AWS.

Using Python

To remediate the misconfiguration of OpenSearch not exporting logs to CloudWatch in AWS using Python, you can follow these steps:

Install Boto3: Boto3 is the AWS SDK for Python and will allow you to interact with AWS services from your Python script. You can install it using pip:
```
pip install boto3
```

Update OpenSearch Domain Policy: Update the OpenSearch domain policy to allow the OpenSearch domain to publish logs to CloudWatch Logs. You can use the following Python script to update the domain policy:

import boto3

# Define the OpenSearch domain name
domain_name = 'your-opensearch-domain-name'

# Create a CloudWatch Logs resource policy
cloudwatch_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "es.amazonaws.com"
            },
            "Action": "logs:PutLogEvents",
            "Resource": "arn:aws:logs:*:*:log-group:/aws/opensearch-service/*"
        }
    ]
}

# Update the OpenSearch domain access policy
client = boto3.client('es')
response = client.update_elasticsearch_domain_config(
    DomainName=domain_name,
    ElasticsearchClusterConfig={
        'CloudWatchLogsLogGroupArn': 'arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch-service/*',
        'CloudWatchLogsRoleArn': 'arn:aws:iam::123456789012:role/your-cloudwatch-role'
    },
    AccessPolicies=json.dumps(cloudwatch_policy)
)

print(response)

Replace placeholders: Replace the placeholder values in the script with your actual OpenSearch domain name, CloudWatch Logs Log Group ARN, and CloudWatch Logs Role ARN.
Run the script: Save the script in a Python file (e.g., remediate_opensearch_logs.py) and run it using the Python interpreter:
```
python remediate_opensearch_logs.py
```
Verify the configuration: After running the script, verify that the OpenSearch domain is now exporting logs to CloudWatch Logs by checking the CloudWatch Logs console for log streams related to your OpenSearch domain.

By following these steps and running the Python script, you can remediate the misconfiguration of OpenSearch not exporting logs to CloudWatch in AWS.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Opensearch Should Export Logs To Cloudwatch

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation