OpenSearch domain has internal user database disabled

Check ID: opensearch_service_domains_internal_user_database_enabled
Provider: AWS
Service: opensearch
Severity: MEDIUM
Categories: identity-access
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains are evaluated for the internal user database setting (InternalUserDatabaseEnabled). The finding identifies domains that rely on built-in HTTP basic users instead of external identity providers.

Risk

An enabled internal user database creates credential sprawl and weak account lifecycle. Missing centralized MFA, rotation, and revocation raises unauthorized access risk, impacting confidentiality and integrity. Basic auth on exposed endpoints eases brute force and reduces auditability.

Recommendation

Prefer federated authentication (IAM, SAML, or Amazon Cognito) and disable the internal user database. Enforce least privilege roles, require MFA, centralize credential rotation and offboarding, and log access. Use VPC access and restrictive policies; avoid HTTP basic auth to minimize exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <example_resource_name> --advanced-security-options '{"InternalUserDatabaseEnabled":false}'

# Terraform: disable internal user database for the domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  advanced_security_options {
    internal_user_database_enabled = false  # Critical: disables internal user DB to pass the check
  }
}

# CloudFormation: disable internal user database for the domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      AdvancedSecurityOptions:
        InternalUserDatabaseEnabled: false  # Critical: disables internal user DB to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_internal_user_database_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has HTTPS enforcement enabled OpenSearch domain has node-to-node encryption enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires