Connections to Elasticsearch domains should be encrypted using TLS 1.2

Severity: Medium

Resource Types: AWS::ElasticsearchService::Domain

Description

This control checks whether connections to Elasticsearch domains are required to use TLS 1.2. The check fails if the Elasticsearch domain TLSSecurityPolicy is not Policy-Min-TLS-1-2-2019-07.

HTTPS (TLS) can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. Only encrypted connections over HTTPS (TLS) should be allowed. Encrypting data in transit can affect performance. You should test your application with this feature to understand the performance profile and the impact of TLS. TLS 1.2 provides several security enhancements over previous versions of TLS.de fails.

Remediation

To enable TLS encryption, use the UpdateElasticsearchDomainConfig wAPI operation to configure the DomainEndpointOptions in order to set the TLSSecurityPolicy. For more information, see the Amazon Elasticsearch Service Developer Guide.