Elasticsearch domains should have audit logging enabled

How to fix it

• Affects another check: Audit logs need fine-grained access control, so on a domain that also fails Opensearch.7, fix that check first.
• Interrupts service: Turning on audit log publishing runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Logs

Audit logs

Enabled

CloudWatch log group

A new log group, or an existing one kept for this domain's audit logs

Access policy

One letting es.amazonaws.com call logs:CreateLogStream and logs:PutLogEvents on the log group

Enable audit logging

Also selected in Kibana, under Security, Audit logs; AWS requires both steps

With the AWS CLI

aws es update-elasticsearch-domain-config --domain-name <domain-name> --log-publishing-options "AUDIT_LOGS={CloudWatchLogsLogGroupArn=<log-group-arn>,Enabled=true}" --region <region>

With Terraform

• Overwrites existing settings: log_publishing_options blocks are the domain's whole set in Terraform, so a log type left out is turned off; keep a block for every log already published.

resource "aws_elasticsearch_domain" "this" {
  domain_name = var.domain_name

  log_publishing_options {
    log_type                 = "AUDIT_LOGS"
    cloudwatch_log_group_arn = var.log_group_arn
  }
}