Project: KICS (Provisioning / Security & Compliance)
File: d926aa95-0a04-4abc-b20c-acf54afe38a1.md

title: ElasticSearch Encryption With KMS Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d926aa95-0a04-4abc-b20c-acf54afe38a1 Query name: ElasticSearch Encryption With KMS Disabled Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Check if any ElasticSearch domain isn't encrypted with KMS.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="15" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: "test" ElasticsearchClusterConfig: DedicatedMasterEnabled: "true" InstanceCount: "2" ZoneAwarenessEnabled: "true" InstanceType: "m3.medium.elasticsearch" DedicatedMasterType: "m3.medium.elasticsearch" DedicatedMasterCount: "3" EncryptionAtRestOptions: Enabled: true EBSOptions: EBSEnabled: true Iops: 0 VolumeSize: 20 VolumeType: "gp2" SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/es-user" Action: "es:*" Resource: "arn:aws:es:us-east-1:846973539254:domain/test/*" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` ```json title="Positive test num. 2 - json file" hl_lines="7" { "Description": "Creates RDS Cluster", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "EncryptionAtRestOptions": { "Enabled": true }, "EBSOptions": { "EBSEnabled": true, "Iops": 0, "VolumeSize": 20, "VolumeType": "gp2" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/es-user" }, "Action": "es:*", "Resource": "arn:aws:es:us-east-1:846973539254:domain/test/*" } ] }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" }, "DomainName": "test", "ElasticsearchClusterConfig": { "DedicatedMasterType": "m3.medium.elasticsearch", "DedicatedMasterCount": "3", "DedicatedMasterEnabled": "true", "InstanceCount": "2", "ZoneAwarenessEnabled": "true", "InstanceType": "m3.medium.elasticsearch" } } } }, "AWSTemplateFormatVersion": "2010-09-09" } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster2 Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: "test" ElasticsearchClusterConfig: DedicatedMasterEnabled: "true" InstanceCount: "2" ZoneAwarenessEnabled: "true" InstanceType: "m3.medium.elasticsearch" DedicatedMasterType: "m3.medium.elasticsearch" DedicatedMasterCount: "3" EBSOptions: EBSEnabled: true Iops: 0 VolumeSize: 20 VolumeType: "gp2" SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/es-user" Action: "es:*" Resource: "arn:aws:es:us-east-1:846973539254:domain/test/*" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="6" { "Description": "Creates RDS Cluster2", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "EBSOptions": { "EBSEnabled": true, "Iops": 0, "VolumeSize": 20, "VolumeType": "gp2" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/es-user" }, "Action": "es:*", "Resource": "arn:aws:es:us-east-1:846973539254:domain/test/*" } ] }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" }, "DomainName": "test", "ElasticsearchClusterConfig": { "DedicatedMasterType": "m3.medium.elasticsearch", "DedicatedMasterCount": "3", "DedicatedMasterEnabled": "true", "InstanceCount": "2", "ZoneAwarenessEnabled": "true", "InstanceType": "m3.medium.elasticsearch" } } } }, "AWSTemplateFormatVersion": "2010-09-09" } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: "test" ElasticsearchClusterConfig: DedicatedMasterEnabled: "true" InstanceCount: "2" ZoneAwarenessEnabled: "true" InstanceType: "m3.medium.elasticsearch" DedicatedMasterType: "m3.medium.elasticsearch" DedicatedMasterCount: "3" EncryptionAtRestOptions: Enabled: true KmsKeyId: "some-kms-key-id" EBSOptions: EBSEnabled: true Iops: 0 VolumeSize: 20 VolumeType: "gp2" SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/es-user" Action: "es:*" Resource: "arn:aws:es:us-east-1:846973539254:domain/test/*" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/es-user" }, "Action": "es:*", "Resource": "arn:aws:es:us-east-1:846973539254:domain/test/*" } ] }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" }, "DomainName": "test", "ElasticsearchClusterConfig": { "DedicatedMasterCount": "3", "DedicatedMasterEnabled": "true", "InstanceCount": "2", "ZoneAwarenessEnabled": "true", "InstanceType": "m3.medium.elasticsearch", "DedicatedMasterType": "m3.medium.elasticsearch" }, "EncryptionAtRestOptions": { "Enabled": true, "KmsKeyId": "some-kms-key-id" }, "EBSOptions": { "EBSEnabled": true, "Iops": 0, "VolumeSize": 20, "VolumeType": "gp2" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" } } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster" } ```