Elasticsearch Accessible Only From Safelisted IP Addresses

01 Login to the AWS Management Console.

02 Navigate to Elasticsearch (ES) dashboard at https://console.aws.amazon.com/es/.

03 Click on the ES domain that you want to examine, e.g.

04 On the selected domain description page, click the Modify access policy button from the dashboard top menu to access the domain policy.

05 Verify if the access policy's Condition element includes one or more unapproved IP addresses.

06 Repeat steps no. 3 - 5 to determine the access policy type for other Elasticsearch domains available in the current region.

07 Change the AWS region from the navigation bar and repeat the process for the other regions.

01 Run list-domain-names command (OSX/Linux/UNIX) to list the names of all AWS Elasticsearch (ES) domains currently available in the selected region:

aws es list-domain-names
	--region us-east-1

02 The command output should return the requested ES domain name(s):

{
    "DomainNames": [
        {
            "DomainName": "cloudconformity-es-cluster"
        },
        {
            "DomainName": "web-analytics-cc-cluster"
        }


    ]
}

03 Run describe-elasticsearch-domain command (OSX/Linux/UNIX) using the ES domain name returned at the previous step and custom query filters to describe the access policy used by the selected domain:

aws es describe-elasticsearch-domain
	--domain-name cloudconformity-es-cluster
	--region us-east-1
	--query 'DomainStatus.AccessPolicies'

04 The command output should return the ES domain policy document in JSON format:

"{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "*"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-east-1:123456789012:
                   domain/cloudconformity-es-cluster/*"
    }
  ]
}"

05 Repeat steps no. 3 and 4 to determine the access policy type for other Elasticsearch domains available in the current region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 - 5 to perform the audit process for other regions.

01 Login to the AWS Management Console.

02 Navigate to Elasticsearch (ES) dashboard at https://console.aws.amazon.com/es/.

03 Click on the ES domain that you want to reconfigure (see Audit section part I to identify the right resource).

04 On the selected domain description page, click the Modify access policy button from the dashboard top menu to access the domain policy.

05 On the Modify the access policy for <DOMAIN NAME> page, select Allow access to the domain from specific IP(s) and provide one of the following:

1. A specific IPv4 address, e.g. to limit the domain access to that IP address only.
2. A comma-separated list of IPv4 addresses, e.g. to limit the ES domain access to those IP addresses only.
3. An IPv4 address range (CIDR block), e.g. to limit the domain access only to the IPs available in the specified range.

06 Click OK to update the policy.

07 Click Submit to apply the access policy changes.

08 In the Change your access policy dialog box, click OK to confirm the action. The Elasticsearch domain status should change from Active to Processing. The status should return to Active before your modified access policy takes effect.

09 Repeat steps no. 3 - 8 to update the policies for other AWS ES domains available in the current region in order to implement IP-based access.

10 Change the AWS region from the navigation bar and repeat the process for other regions.

01 First, define the necessary access policy for your Elasticsearch domain(s) and save it in a JSON document (e.g. elasticsearch-ip-based-access-policy.json). The following example contains an access policy document that allows access only to a specific IP address, i.e. 52.47.160.25, using the Condition element:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "52.47.160.25/32"
          ]
        }
      },
      "Resource": "arn:aws:es:us-east-1:123456789012:
                   domain/cloudconformity-es-cluster/*"
    }
  ]
}

02 Run update-elasticsearch-domain-config command (OSX/Linux/UNIX) using the name of the Elasticsearch domain that you want to reconfigure (see Audit section part II to identify the right ES resource) to replace the existing access policy with the one defined at the previous step (i.e. elasticsearch-ip-based-access-policy.json):

aws es update-elasticsearch-domain-config
	--domain-name cloudconformity-es-cluster
	--region us-east-1
	--access-policies file:// elasticsearch-ip-based-access-policy.json

03 The command output should return the configuration metadata for the modified Elasticsearch domain (including the new IP-based access policy - highlighted):

{
    "DomainConfig": {
        "ElasticsearchClusterConfig": {
            "Status": {
                "PendingDeletion": false,
                "State": "Active",
                "CreationDate": 1480672766.759,
                "UpdateVersion": 6,
                "UpdateDate": 1480673260.278
            },
            "Options": { ... }
        },
        "ElasticsearchVersion": {
            "Status": {
                "PendingDeletion": false,
                "State": "Active",
                "CreationDate": 1480672766.759,
                "UpdateVersion": 6,
                "UpdateDate": 1480673260.278
            },
            "Options": "2.3"
        },


        ...


        "AdvancedOptions": {
            "Status": {
                "PendingDeletion": false,
                "State": "Active",
                "CreationDate": 1480672766.759,
                "UpdateVersion": 6,
                "UpdateDate": 1480673260.278
            },
            "Options": { ... }
        },
        "AccessPolicies": {
            "Status": {
                "PendingDeletion": false,
                "State": "Processing",
                "CreationDate": 1480672766.759,
                "UpdateVersion": 13,
                "UpdateDate": 1480681103.781
            },
            "Options": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"es:*\",\"Resource\":\"arn:aws:es:us-east-1:123456789012:domain/cloudconformity-es-cluster/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"52.47.160.25/32\"}}}]}"
        }
    }
}

04 Repeat steps no. 1 - 3 to update the policies for other Amazon Elasticsearch domains available in the current region in order to implement IP-based access.

05 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 - 4 to perform the entire process for other regions.