# Ensure Amazon Elasticsearch Service (ES) domains has enforce HTTPS enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000229606-ensure-amazon-elasticsearch-service-es-domains-has-enforce-https-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

This policy ensures that all traffic to Amazon Elasticsearch Service (ES) domains is encrypted using HTTPS. This helps to protect the confidentiality of data in transit and prevent man-in-the-middle attacks.

**Rationale**

HTTPS is a secure protocol that encrypts all data sent between a client and a server. This prevents unauthorized parties from viewing or tampering with the data. Enforcing HTTPS for all traffic to ES domains helps to protect the confidentiality of data, such as user credentials and search queries.

**Impact**

Enabling enforce HTTPS for ES domains will have the following impact:

-   All traffic to ES domains will be encrypted using HTTPS.
-   This will help to protect the confidentiality of data in transit.
-   It will also help to prevent man-in-the-middle attacks.

**Default Value**

By default, AWS recommends that you enable enforce HTTPS for all ES domains.

**Prerequisites**

To implement this policy, you will need the following:

-   Access to the AWS Management Console or the AWS CLI.
-   The knowledge of how to modify ES domain settings.

**Remediation Steps**

To remediate this policy, you can follow these steps:

1.  Log in to the AWS Management Console.
2.  Go to the Amazon Elasticsearch Service page.
3.  Select the domain that you want to modify.
4.  Click the **Actions** menu and select **Modify encryptions**.
5.  Select the **Require HTTPS for all traffic to the domain** checkbox.
6.  Click **Submit**.

**Test Plan**

To test the effectiveness of this policy, you can follow these steps:

1.  Use a tool such as Wireshark to capture network traffic.
2.  Send a request to the ES domain over HTTP.
3.  Verify that the traffic is encrypted using HTTPS.

**Implementation Plan**

To implement this policy, you can follow these steps:

1.  Create a new AWS IAM policy that allows users to modify ES domain settings.
2.  Attach the policy to the IAM users or roles that need to be able to implement this policy.
3.  Update the ES domain settings to require HTTPS for all traffic.

**AWS CLI Process**

To implement this policy using the AWS CLI, you can follow these steps:

1.  Run the following command to create a new IAM policy:

aws iam create-policy --policy-name enforce-https-for-es-domains --policy-document file://enforce-https-for-es-domains.json

2.  Run the following command to attach the policy to an IAM user or role:

aws iam attach-policy --policy-arn arn:aws:iam::<account-id>:policy/enforce-https-for-es-domains --user-name <user-name>

3.  Run the following command to update the ES domain settings to require HTTPS for all traffic:

```
aws es modify-elasticsearch-domain --domain-name <domain-name> --enforce-https true
```

**Using AWS GUI**

To implement this policy using the AWS GUI, you can follow these steps:

1.  Go to the AWS Management Console.
2.  Go to the IAM page.
3.  Click the **Policies** tab.
4.  Click **Create Policy**.
5.  Select the **JSON** tab.
6.  Paste the following JSON code into the **Policy Document** field:

```
{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "es:ModifyElasticsearchDomain",      "Resource": "*"    }  ] }
```

7.  Click **Review Policy**.
8.  Enter a name for the policy and click **Create**.
9.  Go to the Elasticsearch Service page.
10.  Select the domain that you want to modify.
11.  Click the **Actions** menu and select **Modify encryptions**.
12.  Select the **Require HTTPS for all traffic to the domain** checkbox.
13.  Click **Submit**.

**Backout Plan**

To back out of this policy, you can follow these steps:

1.  Disable enforce HTTPS for the ES domain.
2.  Remove the IAM policy that allows users to modify ES domain settings.

  

**Note:**

This is a security best practice to ensure that all communications between your clients and your Amazon Elasticsearch Service (ES) domain are encrypted.

**Reference:**

-   Amazon Elasticsearch Service provides option to mandate HTTPS: https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-elasticsearch-service-provides-option-to-mandate-https/
-   Ensure AWS Elasticsearch domains have EnforceHTTPS enabled: https://docs.bridgecrew.io/docs/elasticsearch\_6

**Section 2: Tags and Keywords**

-   **Tags:**
    -   security
    -   encryption
    -   HTTPS
    -   TLS
    -   Amazon Elasticsearch Service (ES)
-   **Keywords:**
    -   enforce HTTPS
    -   require HTTPS
    -   encrypt traffic
    -   secure communications

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.