Terraform AWS OpenSearch¶
Terraform module which creates Amazon OpenSearch Service domain resources with comprehensive features including VPC endpoints, encryption, fine-grained access control, SAML authentication, and auto-tune.
Implemented Controls¶
The following compliance controls are implemented in this module.
- Elasticsearch domain error logging to CloudWatch Logs should be enabled
- OpenSearch domains should have audit logging enabled.
- OpenSearch domains cognito authentication should be enabled for kibana
- OpenSearch domains should have at least three data nodes
- OpenSearch domains should have encryption at rest enabled
- OpenSearch domains should have fine-grained access control enabled
- OpenSearch domains should use HTTPS
- OpenSearch domains should be in a VPC
- OpenSearch domains internal user database should be disabled
- OpenSearch domains logs to AWS CloudWatch Logs
- OpenSearch domains node-to-node encryption should be enabled
Compliance.tf registry endpoints¶
module "opensearch" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "acscism2023.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "awscontroltower.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "awsgenai.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cccsmedium.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cis.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cisv500.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cisv600.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "fedramplow.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "ffiec.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "gdpr.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "hipaa.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "iso27001.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "nist800171.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "nist80053.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "nistcsf.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "nydfs23.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "pcidss.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
module "opensearch" {
source = "soc2.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "<version>"
# ... your arguments here
}
See the Technical Usage Guide to get started and read the Features section for more details on how to customize the module for your requirements.
Mapped compliance frameworks¶
ISM-0859: Event log retention
- OpenSearch domains should have audit logging enabled.
- OpenSearch domains should have encryption at rest enabled
- OpenSearch domains should have fine-grained access control enabled
- OpenSearch domains should use HTTPS
- OpenSearch domains should be in a VPC
- OpenSearch domains logs to AWS CloudWatch Logs
- OpenSearch domains node-to-node encryption should be enabled