OpenSearch domain has HTTPS enforcement enabled

Check ID: opensearch_service_domains_https_communications_enforced
Provider: AWS
Service: opensearch
Severity: HIGH
Categories: encryption
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains with HTTPS enforcement require encrypted connections. This assessment identifies domains missing Require HTTPS for all traffic, indicating that unencrypted HTTP is accepted.

Risk

Allowing HTTP exposes queries, credentials, and results in cleartext, enabling interception and session hijacking. Adversaries can alter requests or responses, compromising confidentiality and integrity, and harvest auth data for lateral movement.

Recommendation

Enable Require HTTPS for all traffic on every domain to enforce TLS. Prefer strong protocols (TLS 1.2+), and block HTTP via network controls for defense in depth. Apply least privilege access policies and use private connectivity to minimize exposure and downgrade risks.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <example_resource_name> --domain-endpoint-options EnforceHTTPS=true

# Enable HTTPS enforcement on an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  domain_endpoint_options {
    enforce_https = true  # Critical: requires HTTPS for all requests
  }
}

# CloudFormation - Enable HTTPS enforcement on an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainEndpointOptions:
        EnforceHTTPS: true  # Critical: requires all traffic to use HTTPS, fixing the finding

References

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_https_communications_enforced. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has at least 3 dedicated master nodes OpenSearch domain has internal user database disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires