Amazon OpenSearch Service domain has audit logging enabled

Check ID: opensearch_service_domains_audit_logging_enabled
Provider: AWS
Service: opensearch
Severity: HIGH
Categories: logging, forensics-ready
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains have audit logs enabled via AUDIT_LOGS

Risk

Without audit logs, critical actions lack accountability, reducing confidentiality and integrity. Unauthorized access, privilege misuse, and index tampering can go undetected, hindering incident response and forensics, and enabling data exfiltration and lateral movement without traceability.

Recommendation

Enable AUDIT_LOGS for all domains and route them to a centralized, durable log store. Tune categories to record auth failures and sensitive index operations. Apply least privilege to log access, enforce retention and immutability, and integrate alerts to provide defense in depth and timely response.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <example_resource_name> --log-publishing-options "AUDIT_LOGS={CloudWatchLogsLogGroupArn=<CLOUDWATCH_LOG_GROUP_ARN>,Enabled=true}"

# Enable AUDIT_LOGS for an OpenSearch domain
resource "aws_opensearch_domain" "example" {
  domain_name = "<example_resource_name>"

  log_publishing_options {
    log_type                 = "AUDIT_LOGS"
    cloudwatch_log_group_arn = "<CLOUDWATCH_LOG_GROUP_ARN>"  # Critical: destination for audit logs
    enabled                  = true                           # Critical: turns on AUDIT_LOGS to pass the check
  }
}

# CloudFormation: Enable AUDIT_LOGS for an OpenSearch domain
Resources:
  OpenSearchDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      LogPublishingOptions:
        AUDIT_LOGS:
          CloudWatchLogsLogGroupArn: <CLOUDWATCH_LOG_GROUP_ARN>  # Critical: where audit logs are sent
          Enabled: true  # Critical: turns on AUDIT_LOGS to pass the check

References

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/audit-logs.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_audit_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has fine-grained access control enabled OpenSearch domain sends slow logs to CloudWatch Logs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires