> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch Clusters Should Have Dedicated Master Enabled

### More Info:

Your AWS Elasticsearch Service (ES) clusters should be using dedicated master nodes to improve their environmental stability by offloading all the management tasks from the cluster data nodes.

### Risk Level

Low

### Address

Reliability, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions on how to remediate the Elasticsearch cluster misconfiguration in AWS:

        1. Log in to your AWS Management Console.
        2. Go to the Elasticsearch service dashboard.
        3. Select the Elasticsearch cluster that needs remediation.
        4. Click on the "Modify" button.
        5. Scroll down to the "Dedicated master nodes" section.
        6. Enable the "Dedicated master nodes" option.
        7. Select the instance type for the dedicated master nodes.
        8. Choose the number of dedicated master nodes you want to have.
        9. Click on the "Review and Submit" button.
        10. Review the changes you made and click on the "Submit" button to apply the changes.

        Once you have completed these steps, your Elasticsearch cluster will have dedicated master nodes enabled, which will help to improve the cluster's stability and reliability.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Elasticsearch cluster misconfiguration in AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local computer or EC2 instance.

        2. Get the Elasticsearch domain name using the following command:

        ```
        aws es list-domain-names
        ```

        3. Get the Elasticsearch cluster configuration using the following command:

        ```
        aws es describe-elasticsearch-domain --domain-name <your_domain_name>
        ```

        4. Check if the Dedicated Master is enabled or not. If it is not enabled, you will see "false" in the output of the above command.

        5. To enable the Dedicated Master, use the following command:

        ```
        aws es update-elasticsearch-domain-config --domain-name <your_domain_name> --elasticsearch-cluster-config '{"DedicatedMasterEnabled":true,"ZoneAwarenessEnabled":true,"DedicatedMasterCount":3,"InstanceType":"m4.large.elasticsearch","ZoneAwarenessConfig":{"AvailabilityZoneCount":2}}'
        ```

        6. Wait for a few minutes for the changes to take effect.

        7. Verify the configuration by running the same command as step 3.

        8. Check if the Dedicated Master is enabled or not. If it is enabled, you will see "true" in the output of the above command.

        By following these steps, you can remediate the Elasticsearch cluster misconfiguration of not having Dedicated Master enabled in AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Elasticsearch cluster misconfiguration for AWS using Python, follow these steps:

        1. Install the AWS SDK for Python (Boto3) using the following command:

        ```
        pip install boto3
        ```

        2. Create an AWS Elastic Cloud Compute (EC2) instance and install Elasticsearch on it. You can use the following code to create an EC2 instance:

        ```python theme={null}
        import boto3

        ec2 = boto3.resource('ec2', region_name='your_region')

        instance = ec2.create_instances(
            ImageId='your_ami_id',
            InstanceType='your_instance_type',
            KeyName='your_key_pair_name',
            MinCount=1,
            MaxCount=1
        )
        ```

        3. Install the Elasticsearch Python client using the following command:

        ```
        pip install elasticsearch
        ```

        4. Use the Elasticsearch Python client to enable dedicated master nodes for the Elasticsearch cluster. You can use the following code:

        ```python theme={null}
        from elasticsearch import Elasticsearch

        es = Elasticsearch([
            {'host': 'your_elasticsearch_host', 'port': 'your_elasticsearch_port'}
        ])

        # Enable dedicated master nodes
        es.cluster.put_settings(body={
            "persistent": {
                "discovery": {
                    "zen": {
                        "minimum_master_nodes": 2
                    }
                }
            }
        })
        ```

        5. Verify that dedicated master nodes have been enabled by checking the Elasticsearch cluster settings using the following code:

        ```python theme={null}
        # Get Elasticsearch cluster settings
        settings = es.cluster.get_settings()

        # Check if dedicated master nodes are enabled
        if settings['persistent']['discovery']['zen']['minimum_master_nodes'] == 2:
            print("Dedicated master nodes enabled")
        else:
            print("Dedicated master nodes not enabled")
        ```

        6. Delete the EC2 instance that you created in step 2 using the following code:

        ```python theme={null}
        # Get EC2 instance ID
        instance_id = instance[0].instance_id

        # Terminate EC2 instance
        ec2.instances.filter(InstanceIds=[instance_id]).terminate()
        ```

        By following these steps, you can remediate the Elasticsearch cluster misconfiguration for AWS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_elasticsearch_domain" "this" {
          domain_name = "DOMAIN_NAME" # replace with your domain name, e.g. "prod-logs"

          elasticsearch_version = "ELASTICSEARCH_VERSION" # replace with the desired ES version

          cluster_config {
            instance_type  = "DATA_INSTANCE_TYPE"  # existing data node type, e.g. "r6g.large.elasticsearch"
            instance_count = DATA_INSTANCE_COUNT   # existing data node count, e.g. 2

            # Remediation: enable dedicated master nodes
            dedicated_master_enabled = true
            dedicated_master_type    = "MASTER_INSTANCE_TYPE" # e.g. "r6g.large.elasticsearch"
            dedicated_master_count   = 3                      # recommended minimum for production
          }

          # keep any other existing settings (ebs_options, snapshot_options, vpc_options, etc.)
        }
        ```

        Enabling dedicated master nodes in `cluster_config` updates the existing domain in place (no forced replacement), but it will trigger a configuration change that can take significant time and incur additional cost for the new master instances.

        After editing, `terraform plan` should show an in-place `update` on `aws_elasticsearch_domain.this` with `dedicated_master_enabled` changing from `false` to `true`, `dedicated_master_type` set to `MASTER_INSTANCE_TYPE`, and `dedicated_master_count` set to `3`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html)