AWS Elasticsearch does not have node-to-node encryption enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_6
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

The AWS Elasticsearch Service allows you to host sensitive workloads with node-to-node encryption using Transport Layer Security (TLS) for all communications between instances in a cluster. Node-to-node encryption ensures that any data sent to the Amazon Elasticsearch Service domain over HTTPS remains encrypted in-flight while it is being distributed and replicated between the nodes.

How to Fix

Resource: AWS::Elasticsearch::Domain

• Argument: Properties.NodeToNodeEncryptionOptions.Enabled [source,go]

---

{ "Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: ... NodeToNodeEncryptionOptions:

• Enabled: True", }

---