Checks whether HTTPS is enabled for an Elasticsearch cluster. If so, the evaluation result is Compliant.
Scenarios
HTTPS is a recommended secure transmission protocol to meet the requirements for compliance and access control. This rule applies when you need to use HTTPS to improve data security, integrity, and reliability of an Elasticsearch cluster.
Risk level
Default risk level: medium.
When you apply this rule, you can change the risk level based on your business requirements.
Compliance evaluation logic
If HTTPS is enabled for an Elasticsearch cluster, the evaluation result is Compliant.
If HTTPS is not enabled for an Elasticsearch cluster, the evaluation result is Non-compliant.
Rule details
Item | Description |
Rule name | elasticsearch-instance-used-https-protocol |
Rule identifier | |
Tag | Elasticsearch and Instance |
Automatic remediation | Not supported |
Trigger type | Periodic execution |
Evaluation frequency | Every 24 hours |
Supported resource type | Elasticsearch cluster |
Input parameter | None |
Non-compliance remediation
Enable HTTPS for an Elasticsearch cluster and use HTTP over SSL to ensure the security of data transmission. For more information, see Enable HTTPS.