OpenSearch domain has node-to-node encryption enabled

Check ID: opensearch_service_domains_node_to_node_encryption_enabled
Provider: AWS
Service: opensearch
Severity: HIGH
Categories: encryption
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch domains with node-to-node encryption use TLS to protect traffic between cluster nodes. The finding evaluates the domain’s node_to_node_encryption configuration for intra-cluster communications.

Risk

Unencrypted intra-cluster traffic enables interception and manipulation by anyone with network foothold.

Confidentiality: exposure of documents, credentials, metadata
Integrity: tampering with queries and shard replication
Availability: spoofing/MITM can disrupt coordination and cause outages

Recommendation

Enable node-to-node encryption (node_to_node_encryption: true) to enforce TLS for inter-node traffic. Apply defense in depth: require HTTPS for clients, restrict network exposure, and use least privilege. Validate performance in staging and plan carefully, as the setting is effectively irreversible.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearchservice update-domain-config --domain-name <DOMAIN_NAME> --node-to-node-encryption-options Enabled=true

# Terraform: Enable node-to-node encryption for an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  node_to_node_encryption {
    enabled = true  # Critical: encrypts intra-cluster traffic to pass the check
  }
}

# CloudFormation: Enable node-to-node encryption for an OpenSearch domain
Resources:
  OpenSearchDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      NodeToNodeEncryptionOptions:
        Enabled: true  # Critical: enables TLS between nodes to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_node_to_node_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has internal user database disabled Amazon OpenSearch Service domain is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires