Control: 1 Elasticsearch domains should have encryption at-rest enabled

Description

This control checks whether Amazon ES domains have encryption at rest configuration enabled.

Remediation

By default, domains do not encrypt data at rest, and you cannot configure existing domains to use the feature.

To enable the feature, you must create another domain and migrate your data. For information about creating domains, see the Amazon Elasticsearch Service Developer Guide.

Encryption of data at rest requires Amazon ES 5.1 or later. For more information about encrypting data at rest for Amazon ES, see the Amazon Elasticsearch Service Developer Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_es_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_es_1 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when encryption_at_rest_options ->> 'Enabled' = 'false' then 'alarm'
    else 'ok'
  end status,
  case
    when encryption_at_rest_options ->> 'Enabled' = 'false' then title || ' encryption at rest not enabled.'
    else title || ' encryption at rest enabled.'
  end reason
  
  , region, account_id
from
  aws_elasticsearch_domain;

Control: 1 Elasticsearch domains should have encryption at-rest enabled

Description

Remediation

Usage

SQL

Tags