AWS Elasticsearch domain logging is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_84
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Amazon Elasticsearch Service (Amazon ES) exposes logs through CloudWatch. ES logs enable troubleshooting performance and stability issues, as well as audit logs to track user activity for compliance purposes. Supported ES logs include error logs, search slow logs, index slow logs, and audit logs. All logs are disabled by default.

We recommend you enable Elasticsearch domain logging.

NOTE: If enabled, standard CloudWatch pricing applies.

How to Fix

Resource: AWS::Elasticsearch::Domain

• Arguments: Properties.LogPublishingOptions.AUDIT_LOGS.Enabled [source,go]

---

{ "Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: ... LogPublishingOptions: AUDIT_LOGS:

• Enabled: True ... ",

---