Skip to content

Latest commit

 

History

History
41 lines (27 loc) · 1.2 KB

aws-elastic-search-enable-domain-encryption.md

File metadata and controls

41 lines (27 loc) · 1.2 KB

Pattern: Disabled domain encryption for AWS Elasticsearch

Issue: -

Description

You should ensure your Elasticsearch data is encrypted at rest to help prevent sensitive information from being read by unauthorized users.

Resolution: Enable Elasticsearch domain encryption.

Examples

The following example will fail the aws-elastic-search-enable-domain-encryption check.

 resource "aws_elasticsearch_domain" "bad_example" {
   domain_name = "domain-foo"
 
   encrypt_at_rest {
     enabled = false
   }
 }
 

The following example will pass the aws-elastic-search-enable-domain-encryption check.

 resource "aws_elasticsearch_domain" "good_example" {
   domain_name = "domain-foo"
 
   encrypt_at_rest {
     enabled = true
   }
 }

Further reading