AWS Elasticsearch domain has Dedicated master set to disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_59
Category - Subcategory	Compute - Overprovisioned
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	ea657be6-6810-4964-9a15-81a8f0177784

Impact

This rule checks if Elasticsearch/OpenSearch clusters are configured with a dedicated master node. Having a dedicated master node for Elasticsearch/OpenSearch clusters helps ensure that the cluster’s state and health status is managed properly and prevents the cluster from becoming unstable in case of failures.

How to Fix

Resource: aws_opensearch_domain, aws_elasticsearch_domain

• Arguments: cluster_config.dedicated_master_enabled

To fix the issue, ensure the 'dedicated_master_enabled' configuration is set to 'true' inside the 'cluster_config' block of the Elasticsearch or OpenSearch domain resource.

Secure code example:

The above code is secure as it enables a dedicated master node in the Elasticsearch/OpenSearch domain, which provides better control and stability over the cluster's state and health status. [source,go] ----resource "aws_elasticsearch_domain" "example" { domain_name = "example"

cluster_config { instance_count = 5

• dedicated_master_enabled = true dedicated_master_type = "m3.medium.elasticsearch" } }

---