Checks whether the virtual private clouds (VPCs) associated with an Elasticsearch cluster fall within the VPC range specified by the input parameter. If no input parameter is set, checks whether the cluster's network type is VPC.
Scenarios
Elasticsearch clusters deployed in a VPC are accessible only within that VPC, keeping all traffic off the public internet. VPC security groups provide fine-grained access control over who can reach the cluster. Clusters using public endpoints lack this isolation and expose a broader attack surface.
Use this rule to verify that all Elasticsearch clusters run inside a VPC.
Risk level
Default risk level: medium.
You can change the risk level when you apply this rule.
Compliance evaluation logic
Compliant: The input parameter is set and the VPCs associated with the Elasticsearch cluster fall within the specified VPC range. Or, the input parameter is not set and the cluster's network type is VPC.
Non-compliant: The input parameter is set but the VPCs associated with the cluster fall outside the specified range. Or, the input parameter is not set and the cluster uses a classic network. For remediation steps, see Non-compliance remediation.
Rule details
| Item | Description |
| Rule name | elasticsearch-instance-in-vpc |
| Rule ID | elasticsearch-instance-in-vpc |
| Tag | Elasticsearch and VPC |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | Elasticsearch cluster |
| Input parameter | vpcIds
Note Separate multiple parameter values with commas (,). |
Non-compliance remediation
Create an Elasticsearch cluster with the network type set to VPC. For more information, see Getting Started.