Description

This policy ensures that all traffic to Amazon Elasticsearch Service (ES) domains is encrypted using HTTPS. This helps to protect the confidentiality of data in transit and prevent man-in-the-middle attacks.

Rationale

HTTPS is a secure protocol that encrypts all data sent between a client and a server. This prevents unauthorized parties from viewing or tampering with the data. Enforcing HTTPS for all traffic to ES domains helps to protect the confidentiality of data, such as user credentials and search queries.

Impact

Enabling enforce HTTPS for ES domains will have the following impact:

  • All traffic to ES domains will be encrypted using HTTPS.
  • This will help to protect the confidentiality of data in transit.
  • It will also help to prevent man-in-the-middle attacks.

Default Value

By default, AWS recommends that you enable enforce HTTPS for all ES domains.

Prerequisites

To implement this policy, you will need the following:

  • Access to the AWS Management Console or the AWS CLI.
  • The knowledge of how to modify ES domain settings.

Remediation Steps

To remediate this policy, you can follow these steps:

  1. Log in to the AWS Management Console.
  2. Go to the Amazon Elasticsearch Service page.
  3. Select the domain that you want to modify.
  4. Click the Actions menu and select Modify encryptions.
  5. Select the Require HTTPS for all traffic to the domain checkbox.
  6. Click Submit.

Test Plan

To test the effectiveness of this policy, you can follow these steps:

  1. Use a tool such as Wireshark to capture network traffic.
  2. Send a request to the ES domain over HTTP.
  3. Verify that the traffic is encrypted using HTTPS.

Implementation Plan

To implement this policy, you can follow these steps:

  1. Create a new AWS IAM policy that allows users to modify ES domain settings.
  2. Attach the policy to the IAM users or roles that need to be able to implement this policy.
  3. Update the ES domain settings to require HTTPS for all traffic.

AWS CLI Process

To implement this policy using the AWS CLI, you can follow these steps:

  1. Run the following command to create a new IAM policy:

aws iam create-policy --policy-name enforce-https-for-es-domains --policy-document file://enforce-https-for-es-domains.json

  1. Run the following command to attach the policy to an IAM user or role:

aws iam attach-policy --policy-arn arn:aws:iam::<account-id>:policy/enforce-https-for-es-domains --user-name <user-name>

  1. Run the following command to update the ES domain settings to require HTTPS for all traffic:
aws es modify-elasticsearch-domain --domain-name <domain-name> --enforce-https true

Using AWS GUI

To implement this policy using the AWS GUI, you can follow these steps:

  1. Go to the AWS Management Console.
  2. Go to the IAM page.
  3. Click the Policies tab.
  4. Click Create Policy.
  5. Select the JSON tab.
  6. Paste the following JSON code into the Policy Document field:
{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "es:ModifyElasticsearchDomain",      "Resource": "*"    }  ] }
  1. Click Review Policy.
  2. Enter a name for the policy and click Create.
  3. Go to the Elasticsearch Service page.
  4. Select the domain that you want to modify.
  5. Click the Actions menu and select Modify encryptions.
  6. Select the Require HTTPS for all traffic to the domain checkbox.
  7. Click Submit.

Backout Plan

To back out of this policy, you can follow these steps:

  1. Disable enforce HTTPS for the ES domain.
  2. Remove the IAM policy that allows users to modify ES domain settings.


Note:

This is a security best practice to ensure that all communications between your clients and your Amazon Elasticsearch Service (ES) domain are encrypted.

Reference:

  • Amazon Elasticsearch Service provides option to mandate HTTPS: https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-elasticsearch-service-provides-option-to-mandate-https/
  • Ensure AWS Elasticsearch domains have EnforceHTTPS enabled: https://docs.bridgecrew.io/docs/elasticsearch_6

Section 2: Tags and Keywords

  • Tags:
    • security
    • encryption
    • HTTPS
    • TLS
    • Amazon Elasticsearch Service (ES)
  • Keywords:
    • enforce HTTPS
    • require HTTPS
    • encrypt traffic
    • secure communications