Project: KICS (Provisioning / Security & Compliance)
File: 5c666ed9-b586-49ab-9873-c495a833b705.md

title: Elasticsearch Without IAM Authentication hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5c666ed9-b586-49ab-9873-c495a833b705 Query name: Elasticsearch Without IAM Authentication Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: AWS Elasticsearch should ensure IAM Authentication<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="24" AWSTemplateFormatVersion: "2010-09-09" Description: Creates ES Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: "test" ElasticsearchVersion: "7.10" ElasticsearchClusterConfig: DedicatedMasterEnabled: true InstanceCount: "2" ZoneAwarenessEnabled: true InstanceType: "m3.medium.elasticsearch" DedicatedMasterType: "m3.medium.elasticsearch" DedicatedMasterCount: "3" EBSOptions: EBSEnabled: true Iops: "0" VolumeSize: "20" VolumeType: "gp2" AccessPolicies: Version: "2012-10-17" Statement: Effect: "Allow" Principal: AWS: "*" Action: "es:*" Resource: "arn:aws:es:us-east-1:846973539254:domain/test/*" LogPublishingOptions: ESAPPLICATIONLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs" Enabled: true SEARCHSLOWLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs" Enabled: true INDEXSLOWLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs" Enabled: true AdvancedOptions: rest.action.multi.allowexplicitindex: true ``` ```json title="Positive test num. 2 - json file" hl_lines="26" { "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": "test", "ElasticsearchVersion": "7.10", "ElasticsearchClusterConfig": { "DedicatedMasterEnabled": true, "InstanceCount": "2", "ZoneAwarenessEnabled": true, "InstanceType": "m3.medium.elasticsearch", "DedicatedMasterType": "m3.medium.elasticsearch", "DedicatedMasterCount": "3" }, "EBSOptions": { "EBSEnabled": true, "Iops": "0", "VolumeSize": "20", "VolumeType": "gp2" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "es:*", "Resource": "arn:aws:es:us-east-1:123456789012:domain/test/*" } ] }, "LogPublishingOptions": { "ESAPPLICATIONLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs", "Enabled": true }, "SEARCHSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs", "Enabled": true }, "INDEXSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs", "Enabled": true } }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": true } } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: Creates ES Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: "test" ElasticsearchVersion: "7.10" ElasticsearchClusterConfig: DedicatedMasterEnabled: true InstanceCount: "2" ZoneAwarenessEnabled: true InstanceType: "m3.medium.elasticsearch" DedicatedMasterType: "m3.medium.elasticsearch" DedicatedMasterCount: "3" EBSOptions: EBSEnabled: true Iops: "0" VolumeSize: "20" VolumeType: "gp2" AccessPolicies: Version: "2012-10-17" Statement: Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/es-user" Action: "es:*" Resource: "arn:aws:es:us-east-1:846973539254:domain/test/*" LogPublishingOptions: ESAPPLICATIONLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs" Enabled: true SEARCHSLOWLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs" Enabled: true INDEXSLOWLOGS: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs" Enabled: true AdvancedOptions: rest.action.multi.allowexplicitindex: true ``` ```json title="Negative test num. 2 - json file" { "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": "test", "ElasticsearchVersion": "7.10", "ElasticsearchClusterConfig": { "DedicatedMasterEnabled": true, "InstanceCount": "2", "ZoneAwarenessEnabled": true, "InstanceType": "m3.medium.elasticsearch", "DedicatedMasterType": "m3.medium.elasticsearch", "DedicatedMasterCount": "3" }, "EBSOptions": { "EBSEnabled": true, "Iops": "0", "VolumeSize": "20", "VolumeType": "gp2" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/es-user" }, "Action": "es:*", "Resource": "arn:aws:es:us-east-1:123456789012:domain/test/*" } ] }, "LogPublishingOptions": { "ESAPPLICATIONLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs", "Enabled": true }, "SEARCHSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs", "Enabled": true }, "INDEXSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs", "Enabled": true } }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": true } } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster" } ```