Restrict Public Access to Elasticsearch Domains
Ensures that Elasticsearch domains are hosted within a VPC and not publicly accessible, complying with PCI DSS and NIST directives for secure network configurations.
| Rule | Elasticsearch domains should not be publicly accessible |
| Framework | PCI v3.2.1 |
| Severity | ✔ Critical |
Rule Description
Elasticsearch domains must not be publicly accessible for PCI v3 compliance. Exposing Elasticsearch to the public internet can pose a security risk and potentially lead to unauthorized access or data breaches, which could result in compliance violations.
Troubleshooting Steps
If Elasticsearch domains are found to be publicly accessible, follow the steps below to remediate the issue.
- 1.Check the network configuration of the Elasticsearch domain to ensure it is not exposed to the public internet.
- 2.Review the security group or network access control list (ACL) associated with the Elasticsearch domain to verify that inbound access is restricted to authorized sources only.
- 3.Confirm that appropriate authentication mechanisms (e.g., IAM roles, access policies) are in place to control access to the Elasticsearch domain.
- 4.Conduct a security audit to identify any potential vulnerabilities or misconfigurations that could lead to public exposure.
Remediation Steps
If Elasticsearch domains are publicly accessible, follow the steps below to secure the domain:
- 1.Access the AWS Management Console.
- 2.Go to the Amazon Elasticsearch Service console.
- 3.Select the Elasticsearch domain that is publicly accessible.
- 4.Update the domain's network configuration to restrict access to authorized sources only.
- 5.Modify the associated security group or network ACL to block public access.
- 6.Implement encryption in transit and at rest to enhance data security.
- 7.Enable access control mechanisms such as IAM roles and policies to restrict access to authorized users.
- 8.Regularly monitor and audit the Elasticsearch domain for security compliance.
CLI Commands (if applicable)
If you prefer using the AWS Command Line Interface (CLI) for remediation, the following commands can be utilized:
- 1.To update the Elasticsearch domain's access policy:
aws es update-elasticsearch-domain-config --domain-name <domain_name> --access-policies '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": "*"}, "Action": "es:*", "Resource": "arn:aws:es:region:account-id:domain/domain-name/*", "Condition": {"IpAddress": {"aws:SourceIp": "x.x.x.x/x"}}}]}'
- 1.To modify the security group associated with the Elasticsearch domain:
aws ec2 modify-security-group-rules --group-id <security_group_id> --ip-permissions IpProtocol=tcp,FromPort=443,ToPort=443,IpRanges=[{CidrIp=<authorized_cidr_block>}]
By following these remediation steps and securing the Elasticsearch domain, you can ensure compliance with PCI v3 regulations and protect sensitive data from unauthorized access.