Control: OpenSearch domains should use HTTPS
Description
This control checks whether connections to OpenSearch domains are using HTTPS. The rule is non-compliant if the OpenSearch domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSSecurityPolicy' is not in 'tlsPolicies'.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.opensearch_domain_https_requiredSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.opensearch_domain_https_required --shareSQL
This control uses a named query:
select arn as resource, case when (domain_endpoint_options ->> 'EnforceHTTPS' = 'false') or (domain_endpoint_options ->> 'EnforceHTTPS' = 'true' and domain_endpoint_options ->> 'TLSSecurityPolicy' not in ('tlsPolicies')) then 'alarm' else 'ok' end status, case when (domain_endpoint_options ->> 'EnforceHTTPS' = 'false') or (domain_endpoint_options ->> 'EnforceHTTPS' = 'true' and domain_endpoint_options ->> 'TLSSecurityPolicy' not in ('tlsPolicies')) then title || ' does not use HTTPS.' else title || ' uses HTTPS.' end as reason , region, account_idfrom aws_opensearch_domain;