Control: Elasticsearch domains should be configured with at least three dedicated master nodes

Description

This control checks whether Elasticsearch domains are configured with at least three dedicated master nodes. This control fails if the domain does not use dedicated master nodes. This control passes if Elasticsearch domains have five dedicated master nodes. However, using more than three master nodes might be unnecessary to mitigate the availability risk, and will result in additional cost.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.es_domain_dedicated_master_nodes_min_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.es_domain_dedicated_master_nodes_min_3 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when elasticsearch_cluster_config ->> 'DedicatedMasterEnabled' = 'false' then 'alarm'
    when
      elasticsearch_cluster_config ->> 'DedicatedMasterEnabled' = 'true'
      and (elasticsearch_cluster_config ->> 'DedicatedMasterCount')::integer >= 3 then 'ok'
    else 'alarm'
  end status,
  case
    when elasticsearch_cluster_config ->> 'DedicatedMasterEnabled' = 'false' then title || ' dedicated master nodes disabled.'
    else title || ' has ' || (elasticsearch_cluster_config ->> 'DedicatedMasterCount') || ' dedicated master node(s).'
  end as reason
  
  , region, account_id
from
  aws_elasticsearch_domain;

Control: Elasticsearch domains should be configured with at least three dedicated master nodes

Description

Usage

SQL

Tags