Elasticsearch Domain Audit Logging is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_317
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule is checking for the activation of audit logging on an Elasticsearch Domain. It ensures that all the changes and alterations made within the domain are being tracked and recorded for future analysis. If this feature is not enabled, it can pose serious security risks as malicious activities or unauthorized changes could go undetected. It can also make troubleshooting difficult in case of an unforeseen issue. Hence, enabling audit logging not only enhances security but also aids system management and optimization.

How to Fix

To fix this issue, ensure that the Enabled property under AUDIT_LOGS in the LogPublishingOptions configuration of the AWS::Elasticsearch::Domain or AWS::OpenSearchService::Domain resource is set to true.

Example: [source,go]

{ "Resources": { "MyElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": "example-domain", "LogPublishingOptions": { "AUDIT_LOGS": { "Enabled": true, ... } }, ... } } } }

Resources: MyOpenSearchDomain: Type: AWS::OpenSearchService::Domain Properties: DomainName: example-domain LogPublishingOptions: AUDIT_LOGS: Enabled: true ... ...