AWS Elasticsearch domain is not configured with HTTPS misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_83
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	10a1868c-c97b-4fd1-8dd3-dc2ac172f2f1

Impact

This rule identifies Elasticsearch domains that are not configured with HTTPS. Amazon Elasticsearch domains allow all traffic to be submitted over HTTPS, ensuring all communications between application and domain are encrypted. It is recommended to enable HTTPS so that all communication between the application and all data access goes across an encrypted communication channel to eliminate man-in-the-middle attacks.

How to Fix

Resource: AWS::Elasticsearch::Domain

• Argument: Properties.DomainEndpointOptions.EnforceHTTPS [source,go]

---

Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: ... DomainEndpointOptions:

• EnforceHTTPS: True

---