Back to Checks
aws

Amazon OpenSearch Service domain has node-to-node encryption enabled

opensearch_service_domains_node_to_node_encryption_enabled
Service: opensearchSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch domains with node-to-node encryption use TLS to protect traffic between cluster nodes. The finding evaluates the domain's node_to_node_encryption configuration for intra-cluster communications.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted intra-cluster traffic enables interception and manipulation by anyone with network foothold.

  • Confidentiality: exposure of documents, credentials, metadata
  • Integrity: tampering with queries and shard replication
  • Availability: spoofing/MITM can disrupt coordination and cause outages

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_node_to_node_encryption_enabled

Recommendation

Enable node-to-node encryption (node_to_node_encryption: true) to enforce TLS for inter-node traffic. Apply defense in depth: require HTTPS for clients, restrict network exposure, and use least privilege. Validate performance in staging and plan carefully, as the setting is effectively irreversible.

Remediation

CLI

aws opensearchservice update-domain-config --domain-name <DOMAIN_NAME> --node-to-node-encryption-options Enabled=true

Terraform

# Terraform: Enable node-to-node encryption for an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  node_to_node_encryption {
    enabled = true  # Critical: encrypts intra-cluster traffic to pass the check
  }
}

NativeIaC

# CloudFormation: Enable node-to-node encryption for an OpenSearch domain
Resources:
  OpenSearchDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      NodeToNodeEncryptionOptions:
        Enabled: true  # Critical: enables TLS between nodes to pass the check

Other

1In the AWS Console, go to OpenSearch Service > Domains
2Select the target domain
3Click Edit (or Actions > Edit security configuration)
4Under Encryption, enable Node-to-node encryption
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_node_to_node_encryption_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = (
                f"Opensearch domain {domain.name} has node-to-node encryption enabled."
            )
            if not domain.node_to_node_encryption:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} does not have node-to-node encryption enabled."

            findings.append(report)

        return findings

References