OpenSearch domains should have fine-grained access control enabled

How to fix it

• Can't be undone: Fine-grained access control, encryption at rest and node-to-node encryption cannot be turned off once on.
• Can break clients: Under an open or IP-based policy, requests without credentials fail as soon as this is on, or when the migration period ends, so map roles and update clients during it.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit security configuration

Enable fine-grained access control

Selected

Set IAM ARN as master user

An IAM role ARN, so requests are signed; or Create master user for a user name and password with basic authentication

Enable migration period for open/IP-based access policy

Selected if the access policy is open or IP-based; it ends by itself after 30 days

Require HTTPS for all traffic to the domain

Selected; fine-grained access control requires it

Enable encryption of data at rest

Selected; also required

Node-to-node encryption

Selected; also required

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --advanced-security-options '{"Enabled":true,"MasterUserOptions":{"MasterUserARN":"<master-user-arn>"}}' --encryption-at-rest-options '{"Enabled":true}' --node-to-node-encryption-options '{"Enabled":true}' --domain-endpoint-options '{"EnforceHTTPS":true}' --region <region>

With Terraform

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  encrypt_at_rest {
    enabled = true
  }

  node_to_node_encryption {
    enabled = true
  }

  domain_endpoint_options {
    enforce_https = true
  }

  advanced_security_options {
    enabled = true

    master_user_options {
      master_user_arn = var.master_user_arn
    }
  }
}