Ensure Elasticsearch Domains are Encrypted at Rest
Verifies that Elasticsearch domains utilize encryption at rest to secure sensitive data, aligning with PCI DSS and NIST standards.
| Rule | Elasticsearch domains should have encryption at-rest enabled |
| Framework | PCI v3.2.1 |
| Severity | ✔ Medium |
Rule Description:
To ensure compliance with PCI v3 standards, all Elasticsearch domains must have encryption at-rest enabled. This security measure helps protect sensitive data stored within the Elasticsearch domain from unauthorized access or breaches.
Troubleshooting Steps:
If encryption at-rest is not enabled, follow these troubleshooting steps to remediate the issue:
- 1.Check the current configuration of the Elasticsearch domain to verify if encryption at-rest is enabled.
- 2.If encryption at-rest is not enabled, proceed with enabling this feature to meet PCI v3 requirements.
Necessary Codes:
To enable encryption at-rest for the Elasticsearch domain, you may need to alter the configuration settings. Depending on the Elasticsearch version and setup, the specific code may vary. Below is a general code snippet to enable encryption at-rest:
PUT /<your-elasticsearch-domain>/_settings
{
"settings": {
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}
}
Replace
<your-elasticsearch-domain>Step-by-Step Guide for Remediation:
Follow these steps to enable encryption at-rest for your Elasticsearch domain:
- 1.Identify the Elasticsearch domain that requires encryption at-rest enabling.
- 2.Access your Elasticsearch deployment using the appropriate CLI or web interface.
- 3.Determine the current configuration settings to verify if encryption at-rest is disabled.
- 4.Execute the provided code snippet above by sending a PUT request to the Elasticsearch domain.
- 5.Verify the settings have been updated successfully.
- 6.Reindex any necessary data if required after enabling encryption at-rest.
By following these steps and enabling encryption at-rest for your Elasticsearch domains, you can ensure compliance with PCI v3 standards and enhance the security of your Elasticsearch data.