AWS-ES-Internal-User-Database

Severity : Medium

Description: This control ensures that AWS Elasticsearch Service domains does not have build-in user database enabled for for accessing the domains. The build-in user database have username and password configured for users and allows basic HTTP authentication. For best security practice Its recommended to not use basic authentication using internal user database. The ES service should configured fine-grained access control using IAM integration with Amazon cognito authentication.

Remediation Steps:

Perform following to use access policy for ES Service domains:

Login to the AWS Management Console at https://console.aws.amazon.com.

Create an IAM role to delegate permission to users

Navigate to IAM console in service.
In navigation, choose Roles and then choose Create role.
Choose the Another AWS account role type.
For Account ID, type the AWS account ID to which to grant access to resources.
Select Require external ID, if granting permissions to users from an account not under control and users will assume the role to access programatically.
If MFA is required, select Require MFA.
Choose Next: Permissions.
Select a policy to use for the permissions policy or choose Create policy.
Set permission boundaries and choose Use a permissions boundary to control the maximum role permissions. Select the policy to use for the permissions boundary.
Choose Next: Tags.
Choose Next: Review.
For Role name, type a name for the role.
For Role description, type a description for the new role.
Choose Create role.

Create an IAM role to delegate permission to AWS service

Navigate to IAM console in service.
In navigation, choose Roles and then choose Create role.
For Select type of trusted entity, choose AWS service.
Choose the service that is allow to assume this role.
Choose the use case for your service.
Choose Next: Permissions.
Select a policy to use for the permissions policy or choose Create policy.
Set permission boundaries and choose Use a permissions boundary to control the maximum role permissions. Select the policy to use for the permissions boundary.
Choose Next: Tags.
Choose Next: Review.
For Role name, type a name for the role.
For Role description, type a description for the new role.
Choose Create role.

Update the fine-grained access control on the domain

In left navigation, select Domains.
Select domain reported and choose Actions and Edit security configuration.
Edit the access policy JSON to create a resource based access policy with least privilege configuration.
Select Enable fine-grained access control.
Choose Set IAM ARN as master user and specify the ARN for an IAM role.
Select Enable migration period for open/IP-based access policy to enable a transition duration for existing users to required roles.
Choose Save changes.

Important:

Fine-grained access control requires OpenSearch or Elasticsearch 6.7 or later.

Reference: