# Ensure Amazon OpenSearch Service domains have audit logging enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292217755313-ensure-amazon-opensearch-service-domains-have-audit-logging-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon OpenSearch Service domain (formerly Amazon Elasticsearch Service) publishes audit logs to Amazon CloudWatch Logs. Audit logs record user activity on the domain, such as authentication successes and failures, requests to indexes and changes to security settings. **Rationale** Without audit logs, there is no record of who accessed the domain or what they did. Unauthorized access, misuse of privileges and tampering with indexes can go undetected, and investigations after an incident lack the evidence needed to understand what happened. Enabling audit logs and sending them to a central, protected log store with suitable retention supports detection, incident response and forensics. **Impact** - Provides an audit trail of access to and activity on the domain - Supports detection of unauthorized access and investigation of security incidents - Audit logs require fine-grained access control on the domain, and CloudWatch Logs storage and ingestion are charged, depending on the volume of logged activity **Default Value** Audit logs are disabled by default for new OpenSearch Service domains. **Pre-Requisites** - IAM permissions: es:ListDomainNames, es:DescribeDomain, es:UpdateDomainConfig, logs:CreateLogGroup and logs:PutResourcePolicy - Fine-grained access control enabled on the domain, and an OpenSearch or Elasticsearch 6.7 or later engine version - A CloudWatch Logs log group for the audit logs, and a CloudWatch Logs resource policy that allows OpenSearch Service to write to it **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon OpenSearch Service console and select **Domains**. 3. Select a domain and open the **Logs** tab. 4. Check whether **Audit logs** are enabled. 5. Repeat for each domain in each region in use. 6. If audit logs are not enabled, follow the implementation steps. **CLI:** List the domains in the region: aws opensearch list-domain-names --region --query "DomainNames\[\].DomainName" --output table Show the log publishing settings of a domain: aws opensearch describe-domain --region --domain-name --query "DomainStatus.LogPublishingOptions" A domain fails if the output has no AUDIT\_LOGS entry, or if AUDIT\_LOGS has Enabled set to false. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon OpenSearch Service console, select **Domains** and select the affected domain. 3. If fine-grained access control is not enabled, enable it first in the domain's security configuration. Before you do, note the following: - fine-grained access control cannot be disabled once it is enabled, - it requires HTTPS enforcement for all traffic to the domain, node-to-node encryption and encryption at rest to be enabled, - enabling it on an existing domain triggers a blue/green deployment, - it can change how existing clients access the domain, so map users and IAM roles to OpenSearch roles first to avoid losing access. 4. Open the **Logs** tab, find **Audit logs** and choose **Enable**. 5. Create a new CloudWatch log group or select an existing one. 6. Choose or create the access policy that allows OpenSearch Service to write to the log group. 7. Choose **Enable**. 8. Repeat for each affected domain in each region in use. **CLI:** Create a log group for the audit logs: aws logs create-log-group --region --log-group-name Save the following as opensearch-logs-policy.json: {"Version":"2012-10-17","Statement":\[{"Effect":"Allow","Principal":{"Service":"es.amazonaws.com"},"Action":\["logs:PutLogEvents","logs:CreateLogStream"\],"Resource":"arn:aws:logs:::log-group::\*"}\]} Allow OpenSearch Service to write to the log group: aws logs put-resource-policy --region --policy-name --policy-document file://opensearch-logs-policy.json Enable audit log publishing for the domain: aws opensearch update-domain-config --region --domain-name --log-publishing-options "AUDIT\_LOGS={CloudWatchLogsLogGroupArn=,Enabled=true}" **Backout Plan** Before making changes, save the current log publishing settings: aws opensearch describe-domain --region --domain-name --query "DomainStatus.LogPublishingOptions" > opensearch-logging-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon OpenSearch Service console, select **Domains** and select the domain. 3. Open the **Logs** tab, find **Audit logs** and choose **Disable**. **CLI:** aws opensearch update-domain-config --region --domain-name --log-publishing-options "AUDIT\_LOGS={CloudWatchLogsLogGroupArn=,Enabled=false}" Only audit logging can be turned off. If fine-grained access control was enabled as part of this change, it cannot be rolled back, because it cannot be disabled once enabled. Note: disabling audit logs removes the record of activity on the domain. Logs already written to CloudWatch Logs are kept until the log group's retention period ends. **Reference** - [https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html) - [https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html) - [https://docs.aws.amazon.com/cli/latest/reference/opensearch/update-domain-config.html](https://docs.aws.amazon.com/cli/latest/reference/opensearch/update-domain-config.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.