OpenSearch domain has no fine-grained access control

What this check finds

Fine-grained access control is off, so anyone the access policy lets in can read and write every index; there are no index-, document- or field-level permissions. The details say whether the domain is in a VPC or has a public endpoint.

Passing looks like: OpenSearch domains use fine-grained access control.

How to fix it

Enable fine-grained access control with an IAM master user or the internal user database, and map roles to the indices each user needs. It requires encryption at rest, node-to-node encryption and HTTPS.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More OpenSearch checks

• HighElasticSearch cluster is publicly accessible
• MediumOpenSearch domain accepts plain HTTP
• MediumOpenSearch domain does not encrypt traffic between its nodes
• MediumOpenSearch domain is not encrypted at rest
• LowOpenSearch domain allows TLS 1.0

All OpenSearch checks