Profile Applicability:
Level 1
Description:
Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) provides a fully managed service to run OpenSearch clusters in the AWS cloud. Node-to-node encryption ensures that data transferred between nodes in an OpenSearch cluster is encrypted, providing confidentiality for internal communications within the cluster. Enabling node-to-node encryption ensures that data remains protected while in transit between nodes, especially in multi-AZ or multi-node configurations.
Rationale:
Node-to-node encryption is critical for securing data as it moves between nodes in the OpenSearch cluster. Without node-to-node encryption, the data transferred between nodes could be exposed to interception or tampering, compromising the confidentiality and integrity of your data. By enabling node-to-node encryption, AWS ensures that the internal communication between nodes remains secure.
Impact:
If node-to-node encryption is not enabled:
Data transferred between nodes may be exposed to unauthorized access.
Internal communication may be intercepted or modified, leading to potential security breaches.
The environment may not meet regulatory or organizational security standards that require encryption in transit.
The organization may be at higher risk of security vulnerabilities.
Default Value:
By default, Amazon OpenSearch Service enables node-to-node encryption for new domains. However, for existing domains, it needs to be explicitly enabled during domain creation or through configuration changes. If not configured correctly, node-to-node encryption may be disabled.
Pre-requisites:
Access to the AWS Management Console or AWS CLI with the necessary IAM permissions.
An existing Amazon OpenSearch domain.
Basic understanding of node-to-node encryption and encryption in transit.
Test Plan:
Using AWS Console:
Open the Amazon OpenSearch Service console.
Navigate to Domains.
Select the domain you wish to check.
In the Domain details section, scroll down to Encryption in transit.
Look for the Node-to-node encryption setting:
If node-to-node encryption is enabled, it will display as Enabled.
If node-to-node encryption is disabled, it will display as Disabled.
Using AWS CLI:
Use the following command to list all OpenSearch domains:
aws opensearch list-domain-names
For each domain, describe its configuration:
aws opensearch describe-domain --domain-name <domain-name>
In the output, look for the NodeToNodeEncryptionOptions section:
If "Enabled": true, node-to-node encryption is enabled.
If "Enabled": false or the section is missing, node-to-node encryption is not enabled.
Implementation Plan:
Using AWS Console:
In the Amazon OpenSearch Service console.
select the domain for which you want to enable node-to-node encryption.
In the Domain details section, click Edit under Encryption in transit.
Enable Node-to-node encryption by checking the appropriate option.
Save the changes to apply the configuration.
Verify that node-to-node encryption is now enabled by reviewing the domain details.
Using AWS CLI:
Run the aws opensearch describe-domain command to check if node-to-node encryption is enabled.
aws opensearch describe-domain --domain-name <domain-name>
If node-to-node encryption is not enabled, run the following command to enable it:
aws opensearch update-domain-config --domain-name <domain-name> --node-to-node-encryption-options "Enabled=true"
Verify that node-to-node encryption is enabled by describing the domain again.
Backout Plan:
If enabling node-to-node encryption causes issues (e.g., performance degradation or connectivity issues):
Identify the affected domain and review the node-to-node encryption configuration.
Revert the changes by disabling node-to-node encryption:
aws opensearch update-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=false
Monitor the domain to ensure it is functioning correctly and that access is restored.
Note:
Encryption Key Management: If using AWS KMS for node-to-node encryption, ensure that the encryption key is properly managed and rotated to maintain security best practices.
Performance Impact: While node-to-node encryption is designed to be efficient, monitor the cluster’s performance after enabling it to ensure it meets your performance requirements, particularly for large clusters with high data throughput.
