AWS OpenSearch Fine-grained access control is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_52
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	512be9cc-ed41-4e18-a4ba-c5419c07b5e7

Impact

This rule detects AWS ElasticSearch/OpenSearch domains that do not have fine-grained access control enabled. Fine-grained access control allows you to manage access to specific domain actions based on user roles and permissions.

How to Fix

Resource: aws_opensearch_domain, aws_elasticsearch_domain

• Arguments: advanced_security_options.internal_user_database_enabled, advanced_security_options.enabled

To fix the issue, set the fine_grained_access_control_enabled argument to true in the aws_elasticsearch_domain resource.

Secure code example:

Enabling internal_user_database_enabled ensures that AWS ElasticSearch/OpenSearch domains have fine-grained access control enabled, providing more granular control over user roles and permissions. [source,go]

resource "aws_elasticsearch_domain" "example" { // other arguments advanced_security_options {

• enabled = true
• internal_user_database_enabled = true } }

---