Control: 8 Connections to Elasticsearch domains should be encrypted using TLS 1.2
Description
This control checks whether connections to Elasticsearch domains are required to use TLS 1.2. The check fails if the Elasticsearch domain TLSSecurityPolicy is not Policy-Min-TLS-1-2-2019-07.
HTTPS (TLS) can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. Only encrypted connections over HTTPS (TLS) should be allowed. Encrypting data in transit can affect performance. You should test your application with this feature to understand the performance profile and the impact of TLS. TLS 1.2 provides several security enhancements over previous versions of TLS.de fails.
Remediation
To enable TLS encryption, use the UpdateElasticsearchDomainConfig wAPI operation to configure the DomainEndpointOptions in order to set the TLSSecurityPolicy. For more information, see the Amazon Elasticsearch Service Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_es_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_es_8 --shareSQL
This control uses a named query:
es_domain_encrypted_using_tls_1_2