Description

Ensure that no Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) domain allows open access. A domain is considered open when it uses a public endpoint and its access policy allows any principal (*) without a condition that limits who can connect. Domains placed inside a VPC are not reachable from the Internet and are considered private.

Rationale

An openly accessible domain lets anyone on the Internet search, add or delete data in its indices. Attackers can read sensitive logs or personal data, tamper with analytics results or delete indices, causing data loss and service outages. Placing domains in a VPC and limiting the access policy to known IAM principals applies least privilege and keeps the data available only to authorized users and applications.

Impact

  • Prevents anonymous access to the data stored in the domain

  • Reduces the risk of data exposure, tampering and deletion

  • Clients that currently access the domain without signing their requests, or from outside the account, lose access until they are granted IAM permissions or connect through an allowed path

  • An existing domain with a public endpoint cannot be moved into a VPC; doing so requires creating a new domain and migrating the data

Default Value

OpenSearch Service does not allow open access by default. Open access exists only when a domain was created with public network access and an access policy that allows all principals (*).

Pre-Requisites

  • IAM permissions: es:ListDomainNames, es:DescribeDomain, es:DescribeDomainConfig and es:UpdateDomainConfig

  • A list of the IAM users, roles or accounts that legitimately need access to each domain

  • Confirmation from the application owner of how clients currently connect to the domain

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon OpenSearch Service console and select Domains.

  3. Select a domain and check its network type. Domains with VPC access pass.

  4. For a domain with Public access, open the Security configuration tab and review the Access policy.

  5. Check for any statement with "Effect": "Allow" and a principal of "*" or {"AWS": "*"} that has no condition restricting it to specific accounts, organizations, VPC endpoints or private IP ranges.

  6. Repeat for each domain in each region in use.

  7. If such a statement exists, follow the implementation steps.

CLI:

List the domains in a region:

aws opensearch list-domain-names --region <REGION> --query "DomainNames[].DomainName"

Show the VPC and access policy of a domain:

aws opensearch describe-domain --region <REGION> --domain-name <DOMAIN_NAME> --query "DomainStatus.[DomainName,VPCOptions.VPCId,AccessPolicies]" --output text

A domain fails if it has no VPC ID and its access policy has an Allow statement with principal * that is not limited by a condition on specific accounts, organizations, VPC endpoints or private IP ranges.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon OpenSearch Service console and select Domains.

  3. Select the domain found in the Test Plan and open the Security configuration tab.

  4. Choose Edit and, in the Access policy section, select the JSON editor.

  5. Replace the open statement with one that only allows trusted IAM principals, for example your own account:

    • "Principal": {"AWS": "arn:aws:iam::<ACCOUNT_ID>:root"}

    • "Resource": "arn:aws:es:<REGION>:<ACCOUNT_ID>:domain/<DOMAIN_NAME>/*"

  6. Choose Save changes.

  7. For new domains, select VPC access as the network type so that the domain is not reachable from the Internet.

  8. Repeat for each affected domain in each region in use.

CLI:

Save the following as access-policy.json:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<ACCOUNT_ID>:root"},"Action":"es:*","Resource":"arn:aws:es:<REGION>:<ACCOUNT_ID>:domain/<DOMAIN_NAME>/*"}]}

Replace the access policy of the domain:

aws opensearch update-domain-config --region <REGION> --domain-name <DOMAIN_NAME> --access-policies file://access-policy.json

Backout Plan

Before making changes, save the current access policy:

aws opensearch describe-domain-config --region <REGION> --domain-name <DOMAIN_NAME> --query "DomainConfig.AccessPolicies.Options" --output text > access-policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon OpenSearch Service console and select the domain.

  3. Open the Security configuration tab and choose Edit.

  4. Paste the saved policy into the access policy JSON editor.

  5. Choose Save changes.

CLI:

aws opensearch update-domain-config --region <REGION> --domain-name <DOMAIN_NAME> --access-policies file://access-policy-backup.json

Note: rolling back makes the domain openly accessible from the Internet again. Use it only as a temporary measure.

Reference