Back to Checks
aws

Amazon OpenSearch Service domain has internal user database disabled

opensearch_service_domains_internal_user_database_enabled
Service: opensearchSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains are evaluated for the internal user database setting (InternalUserDatabaseEnabled). The finding identifies domains that rely on built-in HTTP basic users instead of external identity providers.

Prowler logoProwlerprowler-provider-aws

Risk

An enabled internal user database creates credential sprawl and weak account lifecycle. Missing centralized MFA, rotation, and revocation raises unauthorized access risk, impacting confidentiality and integrity.

Basic auth on exposed endpoints eases brute force and reduces auditability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_internal_user_database_enabled

Recommendation

Prefer federated authentication (IAM, SAML, or Amazon Cognito) and disable the internal user database. Enforce least privilege roles, require MFA, centralize credential rotation and offboarding, and log access. Use VPC access and restrictive policies; avoid HTTP basic auth to minimize exposure.

Remediation

CLI

aws opensearch update-domain-config --domain-name <example_resource_name> --advanced-security-options '{"InternalUserDatabaseEnabled":false}'

Terraform

# Terraform: disable internal user database for the domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  advanced_security_options {
    internal_user_database_enabled = false  # Critical: disables internal user DB to pass the check
  }
}

NativeIaC

# CloudFormation: disable internal user database for the domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      AdvancedSecurityOptions:
        InternalUserDatabaseEnabled: false  # Critical: disables internal user DB to pass the check

Other

1In AWS console, go to Amazon OpenSearch Service > Domains
2Select the domain and choose Edit security configuration
3Under Fine-grained access control, turn off Internal user database
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_internal_user_database_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = f"Opensearch domain {domain.name} does not have internal user database enabled."
            if domain.internal_user_database:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} has internal user database enabled."

            findings.append(report)

        return findings

References