AWS Elasticsearch Best Practices
Amazon Elasticsearch Service is a managed service, easy to deploy, operate, and scale Elasticsearch in the Cloud. Elasticsearch is a popular open-source search and analytics engine for use cases such as log analytics, real-time application monitoring, and click stream analytics.
Cloud Conformity monitors Amazon Elasticsearch Service following the following rules:
Ensure that Slow Logs feature is enabled for your Amazon Elasticsearch (ES) clusters.
Ensure that Amazon ElasticSearch (ES) clusters are healthy (Green).
Ensure AWS ElasticSearch domains are encrypted with KMS Customer Master Keys.
Identify AWS ElasticSearch clusters with low free storage space and scale them to optimize their performance.
Ensure node-to-node encryption is enabled for your Amazon ElasticSearch (ES) clusters.
Ensure only whitelisted IP addresses can access your Amazon Elasticsearch domains.
Ensure Amazon Elasticsearch clusters do not allow unknown cross account access.
Ensure Amazon Elasticsearch clusters are using dedicated master nodes to increase the production environment stability.
Ensure that all your Amazon Elasticsearch cluster instances are of given instance types.
Ensure Amazon Elasticsearch Service (ES) domains are not exposed to everyone.
Ensure AWS Elasticsearch domains are accessible from a Virtual Private Cloud (VPC).
Ensure Elasticsearch nodes are using General Purpose SSD storage instead of Provisioned IOPS SSD storage to optimize the service costs.
Ensure fewer AWS Elasticsearch cluster instances than provided limit in your AWS account.
Ensure Amazon Elasticsearch (ES) Reserved Instances are renewed before expiration.
Ensure Amazon Elasticsearch (ES) Reserved Instances are renewed before expiration.
Ensure AWS Elasticsearch Reserved Instance (RI) purchases have not failed.
Ensure AWS Elasticsearch Reserved Instance (RI) purchases are not pending.
Ensure Elasticsearch Reserved Instance (RI) purchases are regularly reviewed (informational).
Ensure that you always use the latest version of Elasticsearch engine for your AWS Elasticsearch domains.
Ensure high availability for your Amazon Elasticsearch clusters by enabling the Zone Awareness feature.
Ensure at-rest encryption is enabled for your Amazon ElasticSearch domains.