Restrict Public Access to OpenSearch Domains
Evaluates whether OpenSearch domains are configured within a VPC and not publicly accessible, aligning with best practices for network security.
| Rule | OpenSearch domains should not be publicly accessible |
| Framework | PCI v3.2.1 |
| Severity | ✔ Critical |
Rule Description
OpenSearch domains should not be publicly accessible to ensure compliance with PCI v3 standards. Publicly accessible domains may pose a security risk by allowing unauthorized access to sensitive data.
Troubleshooting Steps
- 1.Verify the network security settings for the OpenSearch domain
- 2.Check the domain configuration for any misconfigurations
- 3.Review access control settings to ensure proper restrictions are in place
Remediation Steps
To remediate the issue of OpenSearch domains being publicly accessible, follow these steps:
Step 1: Modify Network Access Control
Adjust the network access control settings to restrict access to the OpenSearch domain. Use the following CLI command to update the security group rules:
aws ec2 authorize-security-group-ingress --group-id your-security-group-id --protocol tcp --port 443 --cidr your-allowed-IP-range
Replace
your-security-group-idyour-allowed-IP-rangeStep 2: Enable VPC Endpoints
Utilize VPC endpoints to allow private access to the OpenSearch domain within the Virtual Private Cloud. Create an endpoint service for OpenSearch using the AWS CLI:
aws ec2 create-vpc-endpoint-service-configuration --network-load-balancer-arns your-load-balancer-arn --acceptance-required
Replace
your-load-balancer-arnStep 3: Update IAM Policies
Adjust the IAM policies to control access to the OpenSearch domain. Limit permissions to only authorized users or services. Modify the policy using the AWS IAM console or CLI:
aws iam put-role-policy --role-name your-role-name --policy-name your-policy-name --policy-document file://your-policy-document.json
Replace
your-role-nameyour-policy-nameyour-policy-document.jsonConclusion
By following these remediation steps, you can secure the OpenSearch domain and ensure compliance with the PCI v3 standards. Regularly monitor and review the security settings to prevent unauthorized access to sensitive data.