Back to Checks
aws

Amazon OpenSearch Service domain has fine-grained access control enabled

opensearch_service_domains_access_control_enabled
Service: opensearchSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains are evaluated for fine-grained access control being enabled in advanced-security-options, ensuring role-based authorization at index, document, and field levels for API and Dashboards access.

Prowler logoProwlerprowler-provider-aws

Risk

Without fine-grained access control, identities may gain overly broad permissions, enabling unauthorized reads or writes across indices and Dashboards. This undermines confidentiality and integrity, facilitates lateral movement, and increases the blast radius of a compromised account.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_access_control_enabled

Recommendation

Enable fine-grained access control in advanced-security-options. Define granular, role-based permissions (index/document/field) and map them to federated identities. Apply least privilege, deny-by-default, and separation of duties. Limit public access and regularly review role mappings.

Remediation

CLI

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --advanced-security-options '{"Enabled":true,"MasterUserOptions":{"MasterUserARN":"<MASTER_USER_ARN>"}}'

Terraform

# Enable fine-grained access control (FGAC) on an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  advanced_security_options {
    enabled = true  # Critical: Turns on FGAC
    master_user_options {
      master_user_arn = "<MASTER_USER_ARN>"  # Critical: Required to enable FGAC using an IAM principal
    }
  }
}

NativeIaC

# CloudFormation: Enable fine-grained access control (FGAC) on an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      AdvancedSecurityOptions:
        Enabled: true  # Critical: Turns on FGAC
        MasterUserOptions:
          MasterUserARN: <MASTER_USER_ARN>  # Critical: Required to enable FGAC using an IAM principal

Other

1In the AWS Console, go to Amazon OpenSearch Service
2Select your domain and choose Edit security configuration
3Enable Fine-grained access control
4Set the master user (choose IAM ARN and enter <MASTER_USER_ARN> or create an internal master user)
5Save changes and wait for the update to complete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_access_control_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "FAIL"
            report.status_extended = f"Opensearch domain {domain.name} does not have fine grained access control enabled."
            if domain.advanced_settings_enabled:
                report.status = "PASS"
                report.status_extended = f"Opensearch domain {domain.name} has fine grained access control enabled."

            findings.append(report)

        return findings

References