Link Search Menu Expand Document

ElasticSearch nodes should communicate with node to node encryption enabled.

Explanation

Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES.

By default, domains do not use node-to-node encryption, and you can’t configure existing domains to use the feature.

Node-to-node encryption enables TLS 1.2 encryption for all communications within the VPC.

Insecure Example

The following example will fail the AWS055 check.

resource "aws_elasticsearch_domain" "bad_example" {
  domain_name           = "example"
  elasticsearch_version = "1.5"

  domain_endpoint_options {
    enforce_https = false
  }
}

resource "aws_elasticsearch_domain" "bad_example" {
  domain_name           = "example"
  elasticsearch_version = "1.5"

  domain_endpoint_options {
    enforce_https = false
  }

  node_to_node_encryption {
    enabled = false
  }
}

Secure Example

The following example will pass the AWS055 check.

resource "aws_elasticsearch_domain" "good_example" {
  domain_name           = "example"
  elasticsearch_version = "1.5"

  domain_endpoint_options {
    enforce_https = false
  }

  node_to_node_encryption {
    enabled = true
  }
}