Restrict Public Access to OpenSearch Domains

OpenSearch domains should not be publicly accessible for AWS Foundational Security Best Practices

Description:

Troubleshooting Steps:

2. 1.
   Check the access policies and settings of the OpenSearch domain to ensure that it is not publicly accessible.
4. 2.
   Review the network configuration and security groups associated with the OpenSearch domain to verify that only authorized entities have access.
6. 3.
   Monitor access logs and audit trails to detect any unauthorized access attempts to the OpenSearch domain.

Remediation Steps:

2. 1.
   Access the AWS Management Console and navigate to the OpenSearch service.
4. 2.
   Select the OpenSearch domain that needs to be secured and click on the "Modify access policy" option.
6. 3.
   Update the access policy to restrict access to specific IP ranges, VPCs, or IAM roles that require access to the domain.
8. 4.
   Ensure that the domain is not accessible from the public internet by configuring the network settings to only allow traffic from trusted sources.
10. 5.
    Save the changes to apply the updated access policy and verify that the OpenSearch domain is no longer publicly accessible.

Relevant Code/CLI Commands:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "es:*",
      "Resource": "arn:aws:es:region:account-id:domain/domain-name/*",
      "Condition": {
        "IpAddress": {
          "NotIpAddress": {
            "aws:SourceIp": [
              "x.x.x.x/x",
              "y.y.y.y/y"
            ]
          }
        }
      }
    }
  ]
}

CLI Commands:

2. 1.
   To update the access policy of an OpenSearch domain:

aws es update-elasticsearch-domain-config --domain-name example-domain --access-policies file://access-policy.json

2. 1.
   To configure network settings for an OpenSearch domain:

aws es update-elasticsearch-domain-config --domain-name example-domain --vpc-options SubnetIds=subnet-123456,SecurityGroupIds=sg-789012