HIGH
Source
Trivy
ID
AVD-AWS-0043

Elasticsearch domain uses plaintext traffic for node to node communication.

Traffic flowing between Elasticsearch nodes should be encrypted to ensure sensitive data is kept private.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable encrypted node to node communication

1
2
3
4
5
6
Resources:
  GoodExample:
    Type: AWS::OpenSearchService::Domain
    Properties:
      NodeToNodeEncryptionOptions:
        Enabled: true
1
2
3
4
5
6
Resources:
  GoodExample:
    Type: AWS::Elasticsearch::Domain
    Properties:
      NodeToNodeEncryptionOptions:
        Enabled: true

Enable encrypted node to node communication

1
2
3
4
5
6
7
resource "aws_elasticsearch_domain" "good_example" {
  domain_name = "domain-foo"

  node_to_node_encryption {
    enabled = true
  }
}