OpenSearch domain uses Cognito or SAML auth for Kibana

Check ID: opensearch_service_domains_use_cognito_authentication_for_kibana
Provider: AWS
Service: opensearch
Severity: MEDIUM
Categories: identity-access
Resource type: AwsOpenSearchServiceDomain

What this check verifies

OpenSearch Service domains use Amazon Cognito or SAML to authenticate access to Kibana/OpenSearch Dashboards. The evaluation identifies domains where either provider is enabled for Dashboards access.

Risk

Without federated authentication, Dashboards can be reached using weak or shared credentials or broad IP rules, enabling unauthorized queries and admin actions. This threatens:

Confidentiality: data exposure
Integrity: index changes or deletion
Availability: heavy queries degrading the cluster

Recommendation

Enable Cognito or SAML for Dashboards and apply least privilege with fine-grained access control. Prefer SSO with MFA, avoid shared/basic credentials, and restrict access via VPC/private endpoints and network controls. Monitor with audit logs and enforce separation of duties.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --cognito-options Enabled=true,UserPoolId=<USER_POOL_ID>,IdentityPoolId=<IDENTITY_POOL_ID>,RoleArn=<ROLE_ARN>

# Enable Amazon Cognito authentication for OpenSearch Dashboards
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  cognito_options {
    enabled          = true  # Critical: Enables Cognito auth for Dashboards to pass the check
    user_pool_id     = "<USER_POOL_ID>"
    identity_pool_id = "<IDENTITY_POOL_ID>"
    role_arn         = "<ROLE_ARN>"
  }
}

# Enable Amazon Cognito authentication for OpenSearch Dashboards
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      CognitoOptions:
        Enabled: true  # Critical: Enables Cognito auth for Dashboards to pass the check
        UserPoolId: <USER_POOL_ID>
        IdentityPoolId: <IDENTITY_POOL_ID>
        RoleArn: <ROLE_ARN>

References

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_use_cognito_authentication_for_kibana. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain runs the latest service software AWS account is a member of an active AWS Organization

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires