AWS all data stored in the Elasticsearch domain is not encrypted using a Customer Managed Key (CMK)

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_247
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

This rule identifies Elasticsearch domain which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your Elasticsearch domain data. It gives you full control over the encrypted data.

How to Fix

[source,go]

resource "aws_elasticsearch_domain" "pass" { domain_name = "example"

cluster_config { instance_type = "r5.large.elasticsearch" }

encrypt_at_rest { kms_key_id = aws_kms_key.example.arn } }