Back to Checks
aws

OpenSearch domain has HTTPS enforcement enabled

opensearch_service_domains_https_communications_enforced
Service: opensearchSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains with HTTPS enforcement require encrypted connections. This assessment identifies domains missing Require HTTPS for all traffic, indicating that unencrypted HTTP is accepted.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing HTTP exposes queries, credentials, and results in cleartext, enabling interception and session hijacking. Adversaries can alter requests or responses, compromising confidentiality and integrity, and harvest auth data for lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_https_communications_enforced

Recommendation

Enable Require HTTPS for all traffic on every domain to enforce TLS. Prefer strong protocols (TLS 1.2+), and block HTTP via network controls for defense in depth. Apply least privilege access policies and use private connectivity to minimize exposure and downgrade risks.

Remediation

CLI

aws opensearch update-domain-config --domain-name <example_resource_name> --domain-endpoint-options EnforceHTTPS=true

Terraform

# Enable HTTPS enforcement on an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  domain_endpoint_options {
    enforce_https = true  # Critical: requires HTTPS for all requests
  }
}

NativeIaC

# CloudFormation - Enable HTTPS enforcement on an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainEndpointOptions:
        EnforceHTTPS: true  # Critical: requires all traffic to use HTTPS, fixing the finding

Other

1Open the Amazon OpenSearch Service console
2Go to Domains and select your domain
3Click Actions > Edit security configuration
4Check "Require HTTPS for all traffic to the domain"
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_https_communications_enforced(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = (
                f"Opensearch domain {domain.name} has enforce HTTPS enabled."
            )
            if not domain.enforce_https:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} does not have enforce HTTPS enabled."

            findings.append(report)

        return findings

References