turbot/aws_compliance
Loading controls...

Control: 8 Connections to Elasticsearch domains should be encrypted using TLS 1.2

Description

This control checks whether connections to Elasticsearch domains are required to use TLS 1.2. The check fails if the Elasticsearch domain TLSSecurityPolicy is not Policy-Min-TLS-1-2-2019-07.

HTTPS (TLS) can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. Only encrypted connections over HTTPS (TLS) should be allowed. Encrypting data in transit can affect performance. You should test your application with this feature to understand the performance profile and the impact of TLS. TLS 1.2 provides several security enhancements over previous versions of TLS.de fails.

Remediation

To enable TLS encryption, use the UpdateElasticsearchDomainConfig wAPI operation to configure the DomainEndpointOptions in order to set the TLSSecurityPolicy. For more information, see the Amazon Elasticsearch Service Developer Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_es_8

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_es_8 --share

SQL

This control uses a named query:

es_domain_encrypted_using_tls_1_2

Tags