Elasticsearch domain uses plaintext traffic for node to node communication.
Traffic flowing between Elasticsearch nodes should be encrypted to ensure sensitive data is kept private.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable encrypted node to node communication
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
Resources:
GoodExample:
Type: AWS::Elasticsearch::Domain
Properties:
DomainName: test
EBSOptions:
EBSEnabled: true
Iops: "0"
VolumeSize: "20"
VolumeType: gp2
ElasticsearchClusterConfig:
DedicatedMasterCount: "3"
DedicatedMasterEnabled: true
DedicatedMasterType: m3.medium.elasticsearch
InstanceCount: "2"
InstanceType: m3.medium.elasticsearch
ZoneAwarenessEnabled: true
ElasticsearchVersion: "7.10"
EncryptionAtRestOptions:
Enabled: true
KmsKeyId: alias/kmskey
NodeToNodeEncryptionOptions:
Enabled: true
|
Enable encrypted node to node communication
1
2
3
4
5
6
7
|
resource "aws_elasticsearch_domain" "good_example" {
domain_name = "domain-foo"
node_to_node_encryption {
enabled = true
}
}
|
Links