> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch Domain Should Be Encrypted with KMS CMKs

### More Info:

Your Amazon ElasticSearch (ES) domains should be encrypted with KMS Customer Master Keys (CMKs) instead of AWS managed-keys

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* HIPAA
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step by step instructions to remediate the Elasticsearch Domain Should Be Encrypted with KMS CMKs on AWS:

        1. Login to your AWS console and navigate to the Elasticsearch service.

        2. Select the Elasticsearch domain that needs to be remediated.

        3. Click on the "Configure" button in the "Security" section.

        4. In the "Encryption" section, select the "KMS" option.

        5. Select the appropriate KMS CMK from the list of available keys. If you don't have a KMS CMK, you can create one by clicking the "Create a new key" button.

        6. Once you have selected the KMS CMK, click the "Save changes" button to apply the encryption.

        7. Wait for the changes to take effect. This may take a few minutes.

        8. Verify that the Elasticsearch domain is now encrypted with the selected KMS CMK. You can do this by checking the "Encryption" section in the Elasticsearch domain's configuration.

        That's it! You have successfully remediated the Elasticsearch Domain Should Be Encrypted with KMS CMKs issue on AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Elasticsearch Domain misconfiguration in AWS using AWS CLI, you can follow these steps:

        1. Identify the Elasticsearch domain that needs to be encrypted with KMS CMKs.

        2. Create a KMS Customer Master Key (CMK) if you don't already have one.

        3. Enable AWS Key Management Service (KMS) encryption for the Elasticsearch domain using the following command:

        ```
        aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<your-KMS-CMK-ARN>
        ```

        Replace `<your-domain-name>` with the name of your Elasticsearch domain and `<your-KMS-CMK-ARN>` with the ARN of the KMS CMK you want to use for encryption.

        4. Verify that the Elasticsearch domain is encrypted with KMS CMKs by running the following command:

        ```
        aws es describe-elasticsearch-domain --domain-name <your-domain-name> --query 'DomainStatus.EncryptionAtRestOptions.Status'
        ```

        If the output is `ENABLED`, it means that the Elasticsearch domain is encrypted with KMS CMKs.

        5. Repeat the above steps for all Elasticsearch domains that need to be encrypted with KMS CMKs.

        Note: Enabling KMS encryption for an Elasticsearch domain may cause a temporary outage as the domain is reconfigured. It is recommended to perform this during a maintenance window.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Elasticsearch Domain should be encrypted with KMS CMKs misconfiguration for AWS using python, you can follow the below steps:

        1. First, you need to identify the Elasticsearch Domain that is not encrypted with KMS CMKs. You can use the following AWS CLI command to get the list of Elasticsearch domains:

        ```
        aws es list-domain-names
        ```

        2. Once you have identified the Elasticsearch Domain, you need to enable encryption using KMS CMKs. You can use the following AWS CLI command to enable encryption:

        ```
        aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<kms-key-id>
        ```

        Replace `<domain-name>` with the name of your Elasticsearch Domain and `<kms-key-id>` with the ID of the KMS CMK that you want to use for encryption.

        3. Verify that the Elasticsearch Domain is encrypted with KMS CMKs. You can use the following AWS CLI command to get the Elasticsearch Domain configuration:

        ```
        aws es describe-elasticsearch-domain --domain-name <domain-name>
        ```

        This command will return the Elasticsearch Domain configuration, which should include the `EncryptionAtRestOptions` parameter with the value `Enabled=true` and `KmsKeyId=<kms-key-id>`.

        4. Finally, you can confirm that the Elasticsearch Domain is encrypted with KMS CMKs by checking the AWS KMS console. The KMS CMK that you specified in step 2 should have been used to encrypt the Elasticsearch Domain.

        Note: You can use the AWS SDK for Python (Boto3) to automate these steps.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # KMS CMK for the Elasticsearch domain
        resource "aws_kms_key" "ES_DOMAIN_KMS_KEY" {
          description             = "KMS CMK for Elasticsearch domain ENCRYPTED_ES_DOMAIN_NAME"
          deletion_window_in_days = 30

          # Optional: tighten the policy further as needed. This simple policy allows the
          # account root full control and lets Elasticsearch use the key for encryption.
          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Sid      = "EnableRootPermissions"
                Effect   = "Allow"
                Principal = {
                  AWS = "arn:aws:iam::ACCOUNT_ID:root"        # replace ACCOUNT_ID
                }
                Action   = "kms:*"
                Resource = "*"
              },
              {
                Sid      = "AllowElasticsearchUseOfTheKey"
                Effect   = "Allow"
                Principal = {
                  Service = "es.amazonaws.com"
                }
                Action = [
                  "kms:Encrypt",
                  "kms:Decrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*",
                  "kms:DescribeKey"
                ]
                Resource = "*"
              }
            ]
          })
        }

        # Elasticsearch domain with encryption-at-rest using the CMK
        resource "aws_elasticsearch_domain" "ENCRYPTED_ES_DOMAIN" {
          domain_name = "ENCRYPTED_ES_DOMAIN_NAME" # replace with your ES domain name

          # ... your existing cluster_config, ebs_options, vpc_options, etc. ...

          encryption_at_rest {
            enabled   = true
            kms_key_id = aws_kms_key.ES_DOMAIN_KMS_KEY.arn
          }
        }
        ```

        Enabling `encryption_at_rest` or changing `kms_key_id` on an existing `aws_elasticsearch_domain` forces resource replacement in Terraform; this recreates the domain and you must plan for data migration and potential downtime. AWS also makes encryption-at-rest irreversible and, if the domain is already encrypted (e.g., with an AWS-managed key), you cannot change the KMS key without creating a new domain and migrating data.

        For verification, `terraform plan` should show creation of `aws_kms_key.ES_DOMAIN_KMS_KEY` and either:

        * an update to add `encryption_at_rest.enabled = true` and `kms_key_id = ...` (if Terraform/provider allows in-place), or
        * a destroy/create cycle (replacement) of `aws_elasticsearch_domain.ENCRYPTED_ES_DOMAIN` with the new `encryption_at_rest` block configured.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html)