Encrypted Domain
Ensures ElasticSearch domains are encrypted with KMS. ElasticSearch domains should be encrypted to ensure data at rest is secured.
Addresses: Security
Additional Reading:
Audit your Elastic Search to safe gaurd your data
Ensures ElasticSearch domains are encrypted with KMS. ElasticSearch domains should be encrypted to ensure data at rest is secured.
Addresses: Security
Additional Reading:
Ensures ElasticSearch domains are configured to enforce HTTPS connections. ElasticSearch domains should be configured to enforce HTTPS connections for all clients to ensure encryption of data in transit.
Addresses: Security
Additional Reading:
Ensures ElasticSearch domains are configured to log data to CloudWatch. ElasticSearch domains should be configured with logging enabled with logs sent to CloudWatch for analysis and long-term storage.
Addresses: Security, Operational Maturity
Additional Reading:
ElasticSearch domain traffic is encrypted in transit between nodes. ElasticSearch domains should use node-to-node encryption to ensure data in transit remains encrypted using TLS 1.2.
Addresses: Security
Additional Reading:
Ensures ElasticSearch domains are created with private VPC endpoint options. ElasticSearch domains can either be created with a public endpoint or with a VPC configuration that enables internal VPC communication. Domains should be created without a public endpoint to prevent potential public access to the domain.
Addresses: Security
Additional Reading:
Ensures ElasticSearch domains are running the latest service software. ElasticSearch domains should be configured to run the latest service software which often contains security updates.
Addresses: Security, Operational Maturity
Additional Reading:
Ensure that your AWS ElasticSearch (ES) clusters are healthy, i.e. they all have shard allocation status set to "Green"
Addresses: Reliability
Ensure that your Amazon ElasticSearch (ES) domains are encrypted with KMS Customer Master Keys (CMKs) instead of AWS managed-keys
Addresses: Security
Identify any Amazon ElasticSearch (ES) clusters that appear to run low on disk space and scale them up to help mitigate any issues
Addresses: Reliability, Operational Maturity
Ensure that the access to your Elasticsearch Service (ES) domains is made based on whitelisted IP addresses only in order to protect them against unauthorized access
Addresses: Security
Ensure that all your Elasticsearch Service (ES) clusters are configured to allow access only to trusted AWS users and accounts in order to protect against unauthorized cross account access
Addresses: Security
Ensure that your AWS Elasticsearch Service (ES) clusters are using dedicated master nodes to improve their environmental stability by offloading all the management tasks from the cluster data nodes.
Addresses: Reliability
Determine if the Elasticsearch (ES) instances provisioned in your AWS account have the desired instance type established by your organization based on the workload deployed.
Addresses: Security
Identify any publicly accessible AWS Elasticsearch domains and update their access policy in order to stop any unsigned requests made to these resources
Addresses: Security
Ensure that your Amazon Elasticsearch (ES) clusters are using General Purpose SSD (gp2) data nodes instead of Provisioned IOPS SSD (io1) nodes for cost-effective storage that fits a broad range of workloads
Addresses: Cost Optimisation
Ensure that the number of Amazon Elasticsearch cluster instances provisioned in your AWS account has not reached the limit quota established by your organization
Addresses: Security
Ensure that your AWS Elasticsearch Reserved Instances (RIs) are renewed before expiration in order to get a significant discount on the hourly charges.
Addresses: Cost Optimisation
Ensure that your AWS Elasticsearch Reserved Instances (RIs) are renewed before expiration in order to get a significant discount on the hourly charges.
Addresses: Cost Optimisation
Identify any failed Amazon Elasticsearch (ES) Reserved Instances available within your AWS account
Addresses: Cost Optimisation
Identify any pending Amazon Elasticsearch (ES) Reserved Instances available in your AWS account and solve these incomplete ES reservations by requesting AWS Support to retry the necessary payments
Addresses: Cost Optimisation
Ensure that all active Amazon Elasticsearch (ES) Reserved Instance purchases are reviewed every 7 days to make sure that no unwanted RI purchase has been placed recently.
Addresses: Cost Optimisation
Ensure that AWS Elasticsearch (ES) cross-zone replication (Zone Awareness) is enabled to increase the availability of your ES clusters
Addresses: Reliability
Identify any Amazon Elasticsearch (ES) clusters that appear to be idle and remove them from your account to help lower the cost of your monthly AWS bill.
Addresses: Cost Optimisation
If you are not yet convinced to sign up with Cloudanix, that's not a problem. We recommend you use a comprehensive checklist which your team can use to perform a manual assessment of your workload.