steampipe plugin install awssteampipe plugin install aws

Table: aws_elasticsearch_domain

Amazon ES is a managed service that helps to deploy, operate, and scale Elasticsearch clusters in the AWS Cloud. Domains are clusters with the settings, instance types, instance counts, and storage resources that you specify.

Example

Basic info

select
  domain_name,
  domain_id,
  arn,
  elasticsearch_version,
  created
from
  aws_elasticsearch_domain;

List domains that are not encrypted at rest

select
  domain_name,
  domain_id,
  encryption_at_rest_options ->> 'Enabled' as enabled,
  encryption_at_rest_options ->> 'KmsKeyId' as kms_key_id
from
  aws_elasticsearch_domain
where
  encryption_at_rest_options ->> 'Enabled' = 'false';

Get storage details for domains that are using EBS storage type

select
  domain_name,
  domain_id,
  ebs_options ->> 'VolumeSize' as volume_size,
  ebs_options ->> 'VolumeType' as volume_type,
  ebs_options ->> 'EBSEnabled' as ebs_enabled
from
  aws_elasticsearch_domain
where
  ebs_options ->> 'EBSEnabled' = 'true';

Get network details for each domain

select
  domain_name,
  vpc_options ->> 'AvailabilityZones' as availability_zones,
  vpc_options ->> 'SecurityGroupIds' as security_group_ids,
  vpc_options ->> 'SubnetIds' as subnet_ids,
  vpc_options ->> 'VPCId' as vpc_id
from
  aws_elasticsearch_domain
where
  vpc_options ->> 'AvailabilityZones' is not null;

Get the instance details for each domain

select
  domain_name,
  domain_id,
  elasticsearch_cluster_config ->> 'InstanceType' as instance_type,
  elasticsearch_cluster_config ->> 'InstanceCount' as instance_count
from
  aws_elasticsearch_domain;

List domains that grant anonymous access

select
  domain_name,
  p as principal,
  a as action,
  s ->> 'Effect' as effect
from
  aws_elasticsearch_domain,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  jsonb_array_elements_text(s -> 'Action') as a
where
  p = '*'
  and s ->> 'Effect' = 'Allow';

List domain log publishing options

select
  domain_name,
  domain_id,
  log_publishing_options
from
  aws_elasticsearch_domain;

List domain Search slow logs details

select
  domain_name,
  domain_id,
  log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' as enabled,
  log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' as cloud_watch_logs_log_group_arn
from
  aws_elasticsearch_domain;

Control examples

.inspect aws_elasticsearch_domain

AWS Elasticsearch Domain

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
access_policies	text	IAM access policy as a JSON-formatted string.
account_id	text	The AWS Account ID in which the resource is located.
advanced_options	jsonb	Specifies the status of the AdvancedOptions.
advanced_security_options	jsonb	Specifies The current status of the Elasticsearch domain's advanced security options.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) of the domain.
auto_tune_options	jsonb	The current status of the Elasticsearch domain's Auto-Tune options.
cognito_options	jsonb	The CognitoOptions for the specified domain.
created	boolean	The domain creation status.
deleted	boolean	The domain deletion status.
domain_endpoint_options	jsonb	The current status of the Elasticsearch domain's endpoint options.
domain_id	text	The id of the domain.
domain_name	text	The name of the domain.
ebs_options	jsonb	Specifies whether EBS-based storage is enabled.
elasticsearch_cluster_config	jsonb	The type and number of instances in the domain cluster.
elasticsearch_version	text	The version for the Elasticsearch domain.
enabled	boolean	Specifies the status of the NodeToNodeEncryptionOptions.
encryption_at_rest_options	jsonb	Specifies the status of the EncryptionAtRestOptions.
endpoint	text	The Elasticsearch domain endpoint that use to submit index and search requests.
log_publishing_options	jsonb	Log publishing options for the given domain.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy_std	jsonb	Contains the policy in a canonical form for easier searching.
processing	boolean	The status of the Elasticsearch domain configuration.
region	text	The AWS Region in which the resource is located.
service_software_options	jsonb	The current status of the Elasticsearch domain's service software.
snapshot_options	jsonb	Specifies the status of the SnapshotOptions.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the domain.
title	text	Title of the resource.
upgrade_processing	boolean	The status of an Elasticsearch domain version upgrade.
vpc_options	jsonb	The VPCOptions for the specified domain.

turbot/aws