All checks
Medium
Elasticsearch domains should encrypt data sent between nodes
Checks that the Elasticsearch domain has node-to-node encryption enabled, so traffic between its nodes is encrypted with TLS 1.2 and data stays encrypted as the cluster distributes it. A version that does not support it fails, and enabling it on an existing domain needs Elasticsearch 6.7 or later.
- service
- Elasticsearch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can't be undone: Node-to-node encryption cannot be turned off once on; going back means a new domain built from a manual snapshot of this one.
- Interrupts service: Turning it on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.
In the console
OpenSearch Service → Domains → the domain → Actions → Edit security configuration → Encryption
- Node-to-node encryption
- Selected
With the AWS CLI
aws es update-elasticsearch-domain-config --domain-name <domain-name> --node-to-node-encryption-options Enabled=true --region <region>With Terraform
- Replaces the resource: Below elasticsearch_version 6.7, enabling node_to_node_encryption in Terraform destroys the domain and builds an empty one, so upgrade the domain before you apply.
resource "aws_elasticsearch_domain" "this" {
domain_name = var.domain_name
node_to_node_encryption {
enabled = true
}
}See which of your accounts this check is failing on.
Book a live scan