Elasticsearch domain endpoint is using outdated TLS policy.
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Use the most modern TLS/SSL policies available
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
Resources:
GoodExample:
Type: AWS::Elasticsearch::Domain
Properties:
DomainEndpointOptions:
TLSSecurityPolicy: Policy-Min-TLS-1-2-2019-07
DomainName: test
EBSOptions:
EBSEnabled: true
Iops: "0"
VolumeSize: "20"
VolumeType: gp2
ElasticsearchClusterConfig:
DedicatedMasterCount: "3"
DedicatedMasterEnabled: true
DedicatedMasterType: m3.medium.elasticsearch
InstanceCount: "2"
InstanceType: m3.medium.elasticsearch
ZoneAwarenessEnabled: true
ElasticsearchVersion: "7.10"
EncryptionAtRestOptions:
Enabled: true
KmsKeyId: alias/kmskey
|
Use the most modern TLS/SSL policies available
1
2
3
4
5
6
7
8
|
resource "aws_elasticsearch_domain" "good_example" {
domain_name = "domain-foo"
domain_endpoint_options {
enforce_https = true
tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
}
}
|
Links