Project: KICS (Provisioning / Security & Compliance)
File: edbd62d4-8700-41de-b000-b3cfebb5e996.md

title: Elasticsearch Logs Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: edbd62d4-8700-41de-b000-b3cfebb5e996 Query name: Elasticsearch Logs Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: AWS Elasticsearch should have logs enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="34" AWSTemplateFormatVersion: "2010-09-09" Description: ElasticsearchDomain resource Resources: ElasticsearchDomain: Type: "AWS::Elasticsearch::Domain" Properties: DomainName: Ref: DomainName ElasticsearchVersion: Ref: ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: "1" InstanceType: Ref: InstanceType EBSOptions: EBSEnabled: "true" Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: Deny Principal: AWS: "*" Action: "es:*" Resource: "*" LogPublishingOptions: SEARCHSLOWLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs Enabled: "false" INDEXSLOWLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs Enabled: "true" ESAPPLICATIONLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs Enabled: "true" AUDIT_LOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-audit-logs Enabled: "true" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: ElasticsearchDomain resource Resources: ElasticsearchDomain: Type: "AWS::Elasticsearch::Domain" Properties: DomainName: Ref: DomainName ElasticsearchVersion: Ref: ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: "1" InstanceType: Ref: InstanceType EBSOptions: EBSEnabled: "true" Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: Deny Principal: AWS: "*" Action: "es:*" Resource: "*" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` ```json title="Positive test num. 3 - json file" hl_lines="44" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "ElasticsearchDomain resource", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": { "Ref": "DomainName" }, "ElasticsearchVersion": { "Ref": "ElasticsearchVersion" }, "ElasticsearchClusterConfig": { "InstanceCount": "1", "InstanceType": { "Ref": "InstanceType" } }, "EBSOptions": { "Iops": 0, "VolumeSize": 10, "VolumeType": "standard", "EBSEnabled": "true" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Action": "es:*", "Resource": "*", "Effect": "Deny", "Principal": { "AWS": "*" } } ] }, "LogPublishingOptions": { "SEARCHSLOWLOGS": { "Enabled": "false", "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs" } }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" } } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "ElasticsearchDomain resource", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "EBSOptions": { "EBSEnabled": "true", "Iops": 0, "VolumeSize": 10, "VolumeType": "standard" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Principal": { "AWS": "*" }, "Action": "es:*", "Resource": "*" } ] }, "AdvancedOptions": {

"true" }, "DomainName": { "Ref": "DomainName" }, "ElasticsearchVersion": { "Ref": "ElasticsearchVersion" }, "ElasticsearchClusterConfig": { "InstanceCount": "1", "InstanceType": { "Ref": "InstanceType" } } } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="43" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "ElasticsearchDomain resource", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": { "Ref": "DomainName" }, "ElasticsearchVersion": { "Ref": "ElasticsearchVersion" }, "ElasticsearchClusterConfig": { "InstanceCount": "1", "InstanceType": { "Ref": "InstanceType" } }, "EBSOptions": { "Iops": 0, "VolumeSize": 10, "VolumeType": "standard", "EBSEnabled": "true" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Version": "2012-10-17", "Statement": [ { "Action": "es:*", "Resource": "*", "Effect": "Deny", "Principal": { "AWS": "*" } } ] }, "LogPublishingOptions": { "SEARCHSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs" } }, "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: ElasticsearchDomain resource Resources: ElasticsearchDomain: Type: "AWS::Elasticsearch::Domain" Properties: DomainName: Ref: DomainName ElasticsearchVersion: Ref: ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: "1" InstanceType: Ref: InstanceType EBSOptions: EBSEnabled: "true" Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: "0" AccessPolicies: Version: "2012-10-17" Statement: Effect: Deny Principal: AWS: "*" Action: "es:*" Resource: "*" LogPublishingOptions: SEARCHSLOWLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs Enabled: "true" INDEXSLOWLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs Enabled: "true" ESAPPLICATIONLOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-application-logs Enabled: "true" AUDIT_LOGS: CloudWatchLogsLogGroupArn: >- arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-audit-logs Enabled: "true" AdvancedOptions: rest.action.multi.allowexplicitindex: "true" ``` ```json title="Negative test num. 2 - json file" { "document": [ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "ElasticsearchDomain resource", "Resources": { "ElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "AdvancedOptions": { "rest.action.multi.allowexplicitindex": "true" }, "DomainName": { "Ref": "DomainName" }, "ElasticsearchVersion": { "Ref": "ElasticsearchVersion" }, "ElasticsearchClusterConfig": { "InstanceCount": "1", "InstanceType": { "Ref": "InstanceType" } }, "EBSOptions": { "Iops": 0, "VolumeSize": 10, "VolumeType": "standard", "EBSEnabled": "true" }, "SnapshotOptions": { "AutomatedSnapshotStartHour": "0" }, "AccessPolicies": { "Statement": [ { "Effect": "Deny", "Principal": { "AWS": "*" }, "Action": "es:*", "Resource": "*" } ], "Version": "2012-10-17" }, "LogPublishingOptions": { "SEARCHSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-slow-logs", "Enabled": "true" }, "INDEXSLOWLOGS": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aes/domains/es-index-slow-logs", "Enabled": "true" } } } } }, "id": "c886b8d1-8c44-4f23-ba01-6e30a2f5be7b", "file": "C:\\Users\\foo\\Desktop\\Data\\yaml\\yaml.yaml" } ] } ``` ```yaml title="Negative test num. 3 - yaml file" Resources: ProductionElasticsearch: Type: AWS::Elasticsearch::Domain Properties: EBSOptions: EBSEnabled: true VolumeSize: 70 VolumeType: gp2 ElasticsearchClusterConfig: DedicatedMasterCount: 3 DedicatedMasterEnabled: true DedicatedMasterType: omitted InstanceCount: 3 InstanceType: omitted ZoneAwarenessConfig: AvailabilityZoneCount: 3 ZoneAwarenessEnabled: true ElasticsearchVersion: omitted LogPublishingOptions: "INDEXSLOWLOGS": CloudWatchLogsLogGroupArn: !GetAtt ProductionElasticsearchIndexSlowLogs.Arn Enabled: true "SEARCHSLOWLOGS": CloudWatchLogsLogGroupArn: !GetAtt ProductionElasticsearchSearchSlowLogs.Arn Enabled: true "ESAPPLICATIONLOGS": CloudWatchLogsLogGroupArn: !GetAtt ProductionElasticsearchApplicationLogs.Arn Enabled: true "AUDIT_LOGS": CloudWatchLogsLogGroupArn: !GetAtt ProductionElasticsearchAuditLogs.Arn Enabled: true ```