Fix CRLY.01146: Enforce HTTPS for Elasticsearch Domain

[curly-review]

Issue Details

ID: CRLY.01146
Severity: HIGH
File: sam/cfn/cfn-elasticsearch-domain.json

---

Remediation Summary

Description

The current configuration of the Elasticsearch Domain does not enforce HTTPS, which can expose sensitive data to potential interception. To enhance security, HTTPS should be enforced for all data in transit.

Steps

1. Update the AWS::Elasticsearch::Domain resource in your CloudFormation template to include the TLSSecurityPolicy property.
2. Set the TLSSecurityPolicy property to a policy that enforces HTTPS, such as Policy-Min-TLS-1-2-2019-07.

Here is an example of how to update the CloudFormation template:

EsDomain:
  Type: "AWS::Elasticsearch::Domain"
  Properties:
    AccessPolicies:
      Version: "2012-10-17"
      Statement:
        - Effect: "Allow"
          Principal:
            AWS:
              - !Ref "AWS::AccountId"
          Action:
            - "es:*"
          Resource:
            Fn::Join:
              - ""
              - - "arn:aws:es:us-east-1:"
                - !Ref "AWS::AccountId"
                - ":domain/tailor/*"
        - Effect: "Allow"
          Principal:
            AWS: "*"
          Action:
            - "es:*"
          Resource:
            Fn::Join:
              - ""
              - - "arn:aws:es:us-east-1:"
                - !Ref "AWS::AccountId"
                - ":domain/tailor/*"
          Condition:
            IpAddress:
              aws:SourceIp: "132.188.0.0/16"
    AdvancedOptions:
      rest.action.multi.allow_explicit_index: "true"
    EBSOptions:
      EBSEnabled: true
      VolumeSize: "20"
      VolumeType: "gp2"
    DomainName: "tailor"
    ElasticsearchClusterConfig:
      InstanceCount: 2
      InstanceType: "t2.small.elasticsearch"
      ZoneAwarenessEnabled: true
    ElasticsearchVersion: "5.1"
    SnapshotOptions:
      AutomatedSnapshotStartHour: 0
    Tags:
      - Key: "Name"
        Value: "tailor-es"
      - Key: "app"
        Value: "tailor"
      - Key: "stack"
        Value: "prd"
    TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07"