Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · ES

ES.5: ES domains should have audit logging

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ES.5 check?

ES.5 fails when a legacy Elasticsearch domain does not have audit logging enabled. Audit logs record user activity on the cluster (authentication successes and failures, requests to the domain, index changes, and the incoming search queries themselves) published to CloudWatch Logs.

Why does ES.5 matter?

Without audit logs a domain can answer "what data exists" but never "who looked at it, when, and from where". On a store that frequently holds the most queryable copy of an organisation's sensitive data, that means no trail when a departing employee bulk-exports records or a credential is misused. Several frameworks, PCI DSS among them, require logging of access to systems handling regulated data.

How do I fix ES.5?

  1. Enable fine-grained access control on the domain, which audit logging depends on.
  2. Create a CloudWatch Logs group and grant the domain permission to write to it.
  3. Turn on audit-log publishing in the domain's logging options.
  4. Set retention and feed the logs into your SIEM for access monitoring.

Remediation script · bash

# Enable the EKS audit log type (non-disruptive), then bound the cost with retention.
aws eks update-cluster-config \
  --name prod-platform \
  --logging '{"clusterLogging":[{"types":["audit"],"enabled":true}]}'

aws logs put-retention-policy \
  --log-group-name /aws/eks/prod-platform/cluster \
  --retention-in-days 90

# Turn on GuardDuty EKS Audit Log Monitoring and auto-enable for the whole org.
DETECTOR=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)
aws guardduty update-detector --detector-id "$DETECTOR" \
  --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'
aws guardduty update-organization-configuration --detector-id "$DETECTOR" \
  --features '[{"Name":"EKS_AUDIT_LOGS","AutoEnable":"ALL"}]'

Full walkthrough (console steps, edge cases and verification) in the lesson Enable cluster and search audit logging.

Is ES.5 a false positive?

Audit logging requires fine-grained access control to be enabled first: a domain without FGAC cannot satisfy ES.5 just by ticking the audit-log box.

Full lesson Enable cluster and search audit logging Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ES controls ↗ Check your own account for ES.5 →
Part of the learning path See what's happening

More ES controls

  • ES.1 ES domains should encrypt at rest
  • ES.2 A legacy Elasticsearch domain is publicly accessible
  • ES.3 ES should encrypt node-to-node traffic
  • ES.4 ES error logging to CW should be enabled
  • ES.6 ES domains should have >= 3 data nodes
  • ES.7 ES domains should have >= 3 dedicated master nodes
  • ES.8 ES should use latest TLS policy