Project: KICS (Provisioning / Security & Compliance)
File: a1120ee4-a712-42d9-8fb5-22595fed643b.md

title: Elasticsearch Logs Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a1120ee4-a712-42d9-8fb5-22595fed643b Query name: Elasticsearch Logs Disabled Platform: Pulumi Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: AWS Elasticsearch should have logs enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="14" name: aws-eks runtime: yaml description: An EKS cluster resources: exampleLogGroup: type: aws:cloudwatch:LogGroup exampleLogResourcePolicy: type: aws:cloudwatch:LogResourcePolicy properties: policyName: example policyDocument: ${examplePolicyDocument.json} exampleDomain: type: aws:elasticsearch:Domain properties: elasticsearchVersion: "7.10" elasticsearchClusterConfig: instanceType: "t2.small.elasticsearch" instanceCount: 1 ebsOptions: ebsEnabled: true volumeType: "gp2" volumeSize: 10 variables: examplePolicyDocument: fn::invoke: Function: aws:iam:getPolicyDocument Arguments: statements: effect: Allow principals: type: Service identifiers: es.amazonaws.com actions: logs:PutLogEvents logs:PutLogEventsBatch logs:CreateLogStream resources: arn:aws:logs:* ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="17" name: aws-eks runtime: yaml description: An EKS cluster resources: exampleLogGroup: type: aws:cloudwatch:LogGroup exampleLogResourcePolicy: type: aws:cloudwatch:LogResourcePolicy properties: policyName: example policyDocument: ${examplePolicyDocument.json} exampleDomain: type: aws:elasticsearch:Domain properties: logPublishingOptions: cloudwatchLogGroupArn: ${exampleLogGroup.arn} logType: INDEXSLOWLOGS cloudwatchLogGroupArn: ${exampleLogGroup.arn} logType: SEARCHSLOWLOGS enabled: true variables: examplePolicyDocument: fn::invoke: Function: aws:iam:getPolicyDocument Arguments: statements: effect: Allow principals: type: Service identifiers: es.amazonaws.com actions: logs:PutLogEvents logs:PutLogEventsBatch logs:CreateLogStream resources: arn:aws:logs:* ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="18" name: aws-eks runtime: yaml description: An EKS cluster resources: exampleLogGroup: type: aws:cloudwatch:LogGroup exampleLogResourcePolicy: type: aws:cloudwatch:LogResourcePolicy properties: policyName: example policyDocument: ${examplePolicyDocument.json} exampleDomain: type: aws:elasticsearch:Domain properties: logPublishingOptions: cloudwatchLogGroupArn: ${exampleLogGroup.arn} logType: INDEXSLOWLOGS enabled: false variables: examplePolicyDocument: fn::invoke: Function: aws:iam:getPolicyDocument Arguments: statements: effect: Allow principals: type: Service identifiers: es.amazonaws.com actions: logs:PutLogEvents logs:PutLogEventsBatch logs:CreateLogStream resources: arn:aws:logs:* ``` ```yaml title="Negative test num. 1 - yaml file" name: aws-eks runtime: yaml description: An EKS cluster resources: exampleLogGroup: type: aws:cloudwatch:LogGroup exampleLogResourcePolicy: type: aws:cloudwatch:LogResourcePolicy properties: policyName: example policyDocument: ${examplePolicyDocument.json} exampleDomain: type: aws:elasticsearch:Domain properties: logPublishingOptions: cloudwatchLogGroupArn: ${exampleLogGroup.arn} logType: INDEXSLOWLOGS enabled: true variables: examplePolicyDocument: fn::invoke: Function: aws:iam:getPolicyDocument Arguments: statements: effect: Allow principals: type: Service identifiers: es.amazonaws.com actions: logs:PutLogEvents logs:PutLogEventsBatch logs:CreateLogStream resources: arn:aws:logs:* ```