Elasticsearch domain node-to-node encryption should be enabled

Without node-to-node encryption, traffic between Elasticsearch nodes travels in plaintext within the VPC. An attacker with network-level access (through a compromised instance, misconfigured security group, or VPC peering) can passively sniff index data, search queries, and cluster state flowing between nodes. This includes the actual document content stored in your indices.

Enabling node-to-node encryption has no meaningful performance penalty on modern instance types and eliminates an entire class of eavesdropping risk. AWS requires it for certain Elasticsearch versions (6.0+) when using fine-grained access control, so skipping it also limits your future access control options.

Implementation

Choose the approach that matches how you manage Terraform.

resource "aws_elasticsearch_domain" "this" {
  advanced_security_options {
    enabled                        = true
    internal_user_database_enabled = true

    master_user_options {
      master_user_name     = "admin"
      master_user_password = "ChangeMe123!"
    }
  }

  cluster_config {
    dedicated_master_count   = 3
    dedicated_master_enabled = true
    dedicated_master_type    = "m5.large.elasticsearch"
    instance_count           = 3
    instance_type            = "m5.large.elasticsearch"

    zone_awareness_config {
      availability_zone_count = 3
    }

    zone_awareness_enabled = true
  }

  cognito_options {
    enabled          = true
    identity_pool_id = "us-east-1:12345678-1234-1234-1234-123456789012"
    role_arn         = "arn:aws:iam::123456789012:role/example-role"
    user_pool_id     = "us-east-1_AbCdEfGhI"
  }

  domain_endpoint_options {
    enforce_https       = true
    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
  }

  domain_name = "pofix-abc123"

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "gp3"
  }

  elasticsearch_version = "7.10"

  encrypt_at_rest {
    enabled = true
  }

  log_publishing_options {
    cloudwatch_log_group_arn = local.es_log_group_arn
    log_type                 = "AUDIT_LOGS"
  }
  log_publishing_options {
    cloudwatch_log_group_arn = local.es_log_group_arn
    log_type                 = "ES_APPLICATION_LOGS"
  }
  log_publishing_options {
    cloudwatch_log_group_arn = local.es_log_group_arn
    log_type                 = "SEARCH_SLOW_LOGS"
  }
  log_publishing_options {
    cloudwatch_log_group_arn = local.es_log_group_arn
    log_type                 = "INDEX_SLOW_LOGS"
  }

  vpc_options {
    security_group_ids = ["sg-12345678"]
    subnet_ids         = ["subnet-12345678", "subnet-12345678", "subnet-12345678"]
  }

  node_to_node_encryption {
    enabled = true
  }
}

What this control checks

The control checks that the domain resource has node-to-node encryption enabled. For aws_opensearch_domain, the node_to_node_encryption block must be present with enabled = true. The legacy aws_elasticsearch_domain resource uses the same block and argument. A domain that omits the block entirely, or sets enabled = false, fails. No KMS key is required; node-to-node encryption uses AWS-managed TLS certificates.

Common pitfalls

Audit evidence

An auditor expects AWS Config rule results for elasticsearch-node-to-node-encryption-check showing compliant evaluations across all in-scope domains. Console screenshots of the domain security configuration page with 'Node-to-node encryption' shown as Enabled work as supplementary evidence. For programmatic verification, aws es describe-elasticsearch-domain --domain-name <name> should return "NodeToNodeEncryptionOptions": {"Enabled": true}.

AWS Security Hub dashboards tracking this Config rule over time strengthen the audit trail by showing the control was not briefly disabled between reviews. Third-party CSPM platforms that ingest Config findings serve the same purpose.

Related controls

• OpenSearch domains should use HTTPS

• DynamoDB tables should have AWS KMS encryption enabled

• Neptune DB clusters should be encrypted at rest

• DMS endpoints for Redis OSS should have TLS enabled

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf Control: es_domain_node_to_node_encryption_enabled

• AWS Config Managed Rule: ELASTICSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK

• Checkov Check: CKV_AWS_6

• Powerpipe Controls: aws_compliance.control.es_domain_node_to_node_encryption_enabled, aws_compliance.control.opensearch_domain_node_to_node_encryption_enabled

• Prowler Check: opensearch_service_domains_node_to_node_encryption_enabled

• AWS Security Hub Control: ES.3

• KICS Query: 967eb3e6-26fc-497d-8895-6428beb6e8e2

• Trivy Check: AWS-0043

Last reviewed: 2026-03-09