Skip to main content

🛡️ AWS OpenSearch Domain has a public endpoint🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS OpenSearch Domains that are configured with a public endpoint, making them accessible from the internet instead of being deployed within a VPC, which provides an additional layer of network security.

Rationale​

Hosting OpenSearch domains within a VPC isolates them from the public internet and allows you to control access using security groups and network ACLs. Conversely, exposing an OpenSearch domain through a public endpoint increases its attack surface, making it more susceptible to unauthorized access, data exfiltration, and denial-of-service (DoS) attacks.

Impact​

Even when protected by fine-grained access control policies, a public endpoint remains a less secure configuration compared to VPC isolation.

Remediation requires re-creating the domain within a VPC and migrating data from the existing public domain to the new, VPC-based one.

Audit​

This policy flags an AWS OpenSearch Domain as INCOMPLIANT if the Endpoint field is not empty, indicating that the domain is configured with a public endpoint and does not reside within a VPC.

Remediation​

Open File

Remediation​

OpenSearch Domain Migration: Public to VPC​

Prerequisites​
  • Existing snapshot repository registered and functional
  • IAM roles & permissions already configured for snapshot operations
  • S3 bucket with appropriate access policies
  • VPC infrastructure prepared (subnets, security groups, route tables)
  • Application team engaged for coordinated cutover
Migration Steps​
1. Create a Snapshot​

Take a manual snapshot from the existing public domain:

curl -XPUT -u {{master-username}}:{{password}} \
"https://{{public-endpoint}}/_snapshot/{{existing-repository}}/migration-$(date +%Y%m%d-%H%M)" \
?wait_for_completion=true

Verification:

curl -XGET -u {{master-username}}:{{password}} \
"https://{{public-endpoint}}/_snapshot/{{existing-repository}}/_all"
2. Provision VPC Domain​

Create the new domain with the same configuration:

aws opensearch create-domain \
    --domain-name {{new-domain-name}} \
    --vpc-options SubnetIds={{subnet-ids}},SecurityGroupIds={{security-group-ids}} \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.2] Elasticsearch domains should not be publicly accessible1no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.2] OpenSearch domains should not be publicly accessible1no data
💼 Cloudaware Framework → 💼 Public and Anonymous Access102no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3769no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23785no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1149no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81158no data
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)9no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10859no data
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)9no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)31no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)9no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)25no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)69no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)36no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)69no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)169no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)658no data
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)9no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)748no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)9no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)31no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events146no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained72no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties117no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected159no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected135no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected151no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage98no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15541no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control15no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326995no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3749no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102351no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing29no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29461no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points9no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services31no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic15no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic25no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components26no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation9no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components25no data
💼 PCI DSS v3.2.1 → 💼 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic.1058no data
💼 PCI DSS v3.2.1 → 💼 1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.622no data
💼 PCI DSS v3.2.1 → 💼 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.22no data
💼 PCI DSS v3.2.1 → 💼 1.3.4 Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.9no data
💼 PCI DSS v3.2.1 → 💼 1.3.5 Permit only “established” connections into the network.22no data
💼 PCI DSS v3.2.1 → 💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.7no data
💼 PCI DSS v4.0.1 → 💼 1.3.1 Inbound traffic to the CDE is restricted.58no data
💼 PCI DSS v4.0.1 → 💼 1.3.2 Outbound traffic from the CDE is restricted.58no data
💼 PCI DSS v4.0.1 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.22no data
💼 PCI DSS v4.0.1 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.7no data
💼 PCI DSS v4.0 → 💼 1.3.1 Inbound traffic to the CDE is restricted.758no data
💼 PCI DSS v4.0 → 💼 1.3.2 Outbound traffic from the CDE is restricted.58no data
💼 PCI DSS v4.0 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.722no data
💼 PCI DSS v4.0 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.7no data