Back to Checks
aws

Amazon OpenSearch Service domain has either Amazon Cognito or SAML authentication enabled for Kibana

opensearch_service_domains_use_cognito_authentication_for_kibana
Service: opensearchSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsOpenSearchServiceDomain

OpenSearch Service domains use Amazon Cognito or SAML to authenticate access to Kibana/OpenSearch Dashboards.

The evaluation identifies domains where either provider is enabled for Dashboards access.

Prowler logoProwlerprowler-provider-aws

Risk

Without federated authentication, Dashboards can be reached using weak or shared credentials or broad IP rules, enabling unauthorized queries and admin actions. This threatens:

  • Confidentiality: data exposure
  • Integrity: index changes or deletion
  • Availability: heavy queries degrading the cluster

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_use_cognito_authentication_for_kibana

Recommendation

Enable Cognito or SAML for Dashboards and apply least privilege with fine-grained access control. Prefer SSO with MFA, avoid shared/basic credentials, and restrict access via VPC/private endpoints and network controls. Monitor with audit logs and enforce separation of duties.

Remediation

CLI

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --cognito-options Enabled=true,UserPoolId=<USER_POOL_ID>,IdentityPoolId=<IDENTITY_POOL_ID>,RoleArn=<ROLE_ARN>

Terraform

# Enable Amazon Cognito authentication for OpenSearch Dashboards
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  cognito_options {
    enabled          = true  # Critical: Enables Cognito auth for Dashboards to pass the check
    user_pool_id     = "<USER_POOL_ID>"
    identity_pool_id = "<IDENTITY_POOL_ID>"
    role_arn         = "<ROLE_ARN>"
  }
}

NativeIaC

# Enable Amazon Cognito authentication for OpenSearch Dashboards
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      CognitoOptions:
        Enabled: true  # Critical: Enables Cognito auth for Dashboards to pass the check
        UserPoolId: <USER_POOL_ID>
        IdentityPoolId: <IDENTITY_POOL_ID>
        RoleArn: <ROLE_ARN>

Other

1In the AWS console, go to **OpenSearch Service** > **Domains** and select your domain
2Click **Edit**
3Under **OpenSearch Dashboards authentication**, choose **Amazon Cognito** and enable it
4Enter the **User pool ID**, **Identity pool ID**, and **IAM role** for Cognito
5Click **Save changes** and wait for the domain update to complete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_use_cognito_authentication_for_kibana(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = f"Opensearch domain {domain.name} has either Amazon Cognito or SAML authentication for Kibana enabled."
            if not domain.cognito_options and not domain.saml_enabled:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} has neither Amazon Cognito nor SAML authentication for Kibana enabled."

            findings.append(report)

        return findings

References