AWS Elasticsearch domain Encryption for data at rest is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_5
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	bbd8196f-89c4-4018-8f28-cbad9e2a6841

Impact

This rule identifies Elasticsearch domains for which encryption is disabled. Encryption of data at rest is required to prevent unauthorized users from accessing the sensitive information available on your Elasticsearch domains components. This may include all data of file systems, primary and replica indices, log files, memory swap files and automated snapshots. The Elasticsearch uses AWS KMS service to store and manage the encryption keys. It is highly recommended to implement encryption at rest when you are working with production data that have sensitive information, to protect from unauthorized access.

How to Fix

Resource: AWS::Elasticsearch::Domain

• Argument: Properties.EncryptionAtRestOptions.Enabled

To mitigate this issue, ensure that the EncryptAtRestOptions property in the AWS::Elasticsearch::Domain resource is properly configured to enable encryption at rest.

Example: [source,go]

{ "Resources": { "ExampleElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "DomainName": "example", "EncryptAtRestOptions": { "Enabled": true } ... } } } }

Resources: ExampleElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: example EncryptAtRestOptions: Enabled: true ...