OpenSearch domain has fine-grained access control enabled

Check ID: opensearch_service_domains_access_control_enabled
Provider: AWS
Service: opensearch
Severity: HIGH
Categories: identity-access
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains are evaluated for fine-grained access control being enabled in advanced-security-options, ensuring role-based authorization at index, document, and field levels for API and Dashboards access.

Risk

Without fine-grained access control, identities may gain overly broad permissions, enabling unauthorized reads or writes across indices and Dashboards. This undermines confidentiality and integrity, facilitates lateral movement, and increases the blast radius of a compromised account.

Recommendation

Enable fine-grained access control in advanced-security-options. Define granular, role-based permissions (index/document/field) and map them to federated identities. Apply least privilege, deny-by-default, and separation of duties. Limit public access and regularly review role mappings.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --advanced-security-options '{"Enabled":true,"MasterUserOptions":{"MasterUserARN":"<MASTER_USER_ARN>"}}'

# Enable fine-grained access control (FGAC) on an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  advanced_security_options {
    enabled = true  # Critical: Turns on FGAC
    master_user_options {
      master_user_arn = "<MASTER_USER_ARN>"  # Critical: Required to enable FGAC using an IAM principal
    }
  }
}

# CloudFormation: Enable fine-grained access control (FGAC) on an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      AdvancedSecurityOptions:
        Enabled: true  # Critical: Turns on FGAC
        MasterUserOptions:
          MasterUserARN: <MASTER_USER_ARN>  # Critical: Required to enable FGAC using an IAM principal

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_access_control_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Network Firewall policy has a rule group associated Amazon OpenSearch Service domain has audit logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires