AWS Elastic Search Audit

Audit your Elastic Search to safe gaurd your data

What we do?

Encrypted Domain

Ensures ElasticSearch domains are encrypted with KMS. ElasticSearch domains should be encrypted to ensure data at rest is secured.

Addresses: Security

Additional Reading:

ElasticSearch HTTPS Only

Ensures ElasticSearch domains are configured to enforce HTTPS connections. ElasticSearch domains should be configured to enforce HTTPS connections for all clients to ensure encryption of data in transit.

Addresses: Security

Additional Reading:

ElasticSearch Logging Enabled

Ensures ElasticSearch domains are configured to log data to CloudWatch. ElasticSearch domains should be configured with logging enabled with logs sent to CloudWatch for analysis and long-term storage.

Addresses: Security, Operational Maturity

Additional Reading:

ElasticSearch Node To Node Encryption

ElasticSearch domain traffic is encrypted in transit between nodes. ElasticSearch domains should use node-to-node encryption to ensure data in transit remains encrypted using TLS 1.2.

Addresses: Security

Additional Reading:

ElasticSearch Private Service Domain

Ensures ElasticSearch domains are created with private VPC endpoint options. ElasticSearch domains can either be created with a public endpoint or with a VPC configuration that enables internal VPC communication. Domains should be created without a public endpoint to prevent potential public access to the domain.

Addresses: Security

Additional Reading:

ElasticSearch Upgrade Available

Ensures ElasticSearch domains are running the latest service software. ElasticSearch domains should be configured to run the latest service software which often contains security updates.

Addresses: Security, Operational Maturity

Additional Reading:

ElasticSearch Cluster Status

Ensure that your AWS ElasticSearch (ES) clusters are healthy, i.e. they all have shard allocation status set to "Green"

Addresses: Performance Efficiency

Elasticsearch Domain Encrypted with KMS CMKs

Ensure that your Amazon ElasticSearch (ES) domains are encrypted with KMS Customer Master Keys (CMKs) instead of AWS managed-keys

Addresses: Security

Elasticsearch Free Storage Space

Identify any Amazon ElasticSearch (ES) clusters that appear to run low on disk space and scale them up to help mitigate any issues

Addresses: Performance Efficiency

Elasticsearch Accessible only from Whitelisted IP Addresses

Ensure that the access to your Elasticsearch Service (ES) domains is made based on whitelisted IP addresses only in order to protect them against unauthorized access

Addresses: Security

Elasticsearch Cross Account Access

Ensure that all your Elasticsearch Service (ES) clusters are configured to allow access only to trusted AWS users and accounts in order to protect against unauthorized cross account access

Addresses: Security

Elasticsearch Dedicated Master Enabled

Ensure that your AWS Elasticsearch Service (ES) clusters are using dedicated master nodes to improve their environmental stability by offloading all the management tasks from the cluster data nodes.

Addresses: Reliability

Elasticsearch Desired Instance Type

Determine if the Elasticsearch (ES) instances provisioned in your AWS account have the desired instance type established by your organization based on the workload deployed.

Addresses: Security

Elasticsearch Domain Exposed

Identify any publicly accessible AWS Elasticsearch domains and update their access policy in order to stop any unsigned requests made to these resources

Addresses: Security

Elasticsearch General Purpose SSD

Ensure that your Amazon Elasticsearch (ES) clusters are using General Purpose SSD (gp2) data nodes instead of Provisioned IOPS SSD (io1) nodes for cost-effective storage that fits a broad range of workloads

Addresses: Cost Optimisation

Elasticsearch Instance Counts

Ensure that the number of Amazon Elasticsearch cluster instances provisioned in your AWS account has not reached the limit quota established by your organization

Addresses: Security

Elasticsearch Reserved Instance Lease Expiration In The Next 30 Days

Ensure that your AWS Elasticsearch Reserved Instances (RIs) are renewed before expiration in order to get a significant discount on the hourly charges.

Addresses: Cost Optimisation

Elasticsearch Reserved Instance Lease Expiration In The Next 7 Days

Ensure that your AWS Elasticsearch Reserved Instances (RIs) are renewed before expiration in order to get a significant discount on the hourly charges.

Addresses: Cost Optimisation

Elasticsearch Reserved Instance Payment Failed

Identify any failed Amazon Elasticsearch (ES) Reserved Instances available within your AWS account

Addresses: Cost Optimisation

Elasticsearch Reserved Instance Payment Pending

Identify any pending Amazon Elasticsearch (ES) Reserved Instances available in your AWS account and solve these incomplete ES reservations by requesting AWS Support to retry the necessary payments

Addresses: Cost Optimisation

Elasticsearch Reserved Instance Recent Purchases

Ensure that all active Amazon Elasticsearch (ES) Reserved Instance purchases are reviewed every 7 days to make sure that no unwanted RI purchase has been placed recently.

Addresses: Cost Optimisation

Elasticsearch Zone Awareness Enabled

Ensure that AWS Elasticsearch (ES) cross-zone replication (Zone Awareness) is enabled to increase the availability of your ES clusters

Addresses: Reliability

Idle Elasticsearch Clusters

Identify any Amazon Elasticsearch (ES) clusters that appear to be idle and remove them from your account to help lower the cost of your monthly AWS bill.

Addresses: Cost Optimisation