Enforce Latest TLS Security Policy for Elasticsearch Domain Connections
Ensures that connections to Elasticsearch domains use the latest TLS security policy, providing strong encryption for data in transit.
| Rule | Connections to Elasticsearch domains should be encrypted using the latest TLS security policy |
| Framework | AWS Foundational Security Best Practices |
| Severity | ✔ Medium |
Rule Description:
Connections to Elasticsearch domains should be encrypted using the latest TLS security policy as part of the AWS Foundational Security Best Practices. This ensures that data transferred between clients and Elasticsearch domains is secured with the latest encryption standards.
Troubleshooting Steps:
If you encounter issues with establishing encrypted connections to Elasticsearch domains, follow these troubleshooting steps:
- 1.Check if the Elasticsearch domain is properly configured to use the latest TLS security policy.
- 2.Verify if the clients attempting to connect to the domain support the required TLS version.
- 3.Ensure that the security group associated with the Elasticsearch domain allows traffic on the SSL/TLS port.
- 4.Check for any network or firewall issues that may be blocking the encrypted connection.
Necessary Codes:
If you need to update the TLS security policy for an Elasticsearch domain, you can use the AWS CLI with the following command:
aws es update-elasticsearch-domain-config --domain-name your-domain-name --advanced-security-options OptionName=TLSSecurityPolicy,OptionState=ENABLED
Remediation Steps:
To ensure that connections to Elasticsearch domains are encrypted using the latest TLS security policy, follow these steps:
- 1.Open the AWS Management Console and navigate to the Amazon Elasticsearch Service.
- 2.Select the Elasticsearch domain for which you want to update the TLS security policy.
- 3.Click on the "Modify domain" button to make changes to the domain configuration.
- 4.In the domain configuration settings, locate the "Advanced security options" section.
- 5.Enable the TLS security policy by selecting the appropriate option that reflects the latest TLS version.
- 6.Save the changes to apply the updated TLS security policy to the Elasticsearch domain.
- 7.Verify that the connections to the domain are now encrypted using the latest TLS security policy by testing the client connections.
By following these steps, you can ensure that connections to Elasticsearch domains are encrypted using the latest TLS security policy, adhering to the AWS Foundational Security Best Practices.