ElasticSearch cluster is publicly accessible

Severity: High
Service: OpenSearch
Check ID: ES_PUBLIC

What this check finds

ElasticSearch databases should not be public. Change the resource policy to fix this.

Passing looks like: ElasticSearch not publicly accessible.

How to fix it

Update the Elasticsearch domain access policy to restrict access to specific IAM principals or VPC endpoints, and remove public access.

AWS CLI

aws es update-elasticsearch-domain-config --domain-name DOMAIN --access-policies 'POLICY_JSON'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

Elasticsearch Service → Domains → select domain → Actions → Modify access policy.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to ElasticSearch cluster is publicly accessible
Framework	Controls
HIPAA Security Rule	164.312(e)(2) Network segmentation — protect ePHI network segments
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls C1.2 Access Restrictions and Secure Disposal
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs