Back to Checks
aws

Amazon OpenSearch Service domain has audit logging enabled

opensearch_service_domains_audit_logging_enabled
Service: opensearchSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains have audit logs enabled via AUDIT_LOGS

Prowler logoProwlerprowler-provider-aws

Risk

Without audit logs, critical actions lack accountability, reducing confidentiality and integrity.

Unauthorized access, privilege misuse, and index tampering can go undetected, hindering incident response and forensics, and enabling data exfiltration and lateral movement without traceability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_audit_logging_enabled

Recommendation

Enable AUDIT_LOGS for all domains and route them to a centralized, durable log store.

Tune categories to record auth failures and sensitive index operations. Apply least privilege to log access, enforce retention and immutability, and integrate alerts to provide defense in depth and timely response.

Remediation

CLI

aws opensearch update-domain-config --domain-name <example_resource_name> --log-publishing-options "AUDIT_LOGS={CloudWatchLogsLogGroupArn=<CLOUDWATCH_LOG_GROUP_ARN>,Enabled=true}"

Terraform

# Enable AUDIT_LOGS for an OpenSearch domain
resource "aws_opensearch_domain" "example" {
  domain_name = "<example_resource_name>"

  log_publishing_options {
    log_type                 = "AUDIT_LOGS"
    cloudwatch_log_group_arn = "<CLOUDWATCH_LOG_GROUP_ARN>"  # Critical: destination for audit logs
    enabled                  = true                           # Critical: turns on AUDIT_LOGS to pass the check
  }
}

NativeIaC

# CloudFormation: Enable AUDIT_LOGS for an OpenSearch domain
Resources:
  OpenSearchDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      LogPublishingOptions:
        AUDIT_LOGS:
          CloudWatchLogsLogGroupArn: <CLOUDWATCH_LOG_GROUP_ARN>  # Critical: where audit logs are sent
          Enabled: true  # Critical: turns on AUDIT_LOGS to pass the check

Other

1Open the AWS console and go to OpenSearch Service
2Select the domain <example_resource_name>
3Open the Logs tab, find Audit logs, and click Enable
4Choose or create a CloudWatch log group and confirm the resource policy if prompted
5Click Save changes to enable AUDIT_LOGS
6If Fine-grained access control is not enabled, enable it first, then repeat steps 3-5

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_audit_logging_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "FAIL"
            report.status_extended = (
                f"Opensearch domain {domain.name} AUDIT_LOGS disabled."
            )
            for logging_item in domain.logging:
                if logging_item.name == "AUDIT_LOGS" and logging_item.enabled:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Opensearch domain {domain.name} AUDIT_LOGS enabled."
                    )

            findings.append(report)

        return findings

References