Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · ES

ES.8: ES should use latest TLS policy

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ES.8 check?

ES.8 checks DomainEndpointOptions.TLSSecurityPolicy on each domain and fails if it isn't pinned to the latest supported policy (currently Policy-Min-TLS-1-2-PFS-2023-10) or if HTTPS isn't enforced at all. The policy decides which TLS versions and cipher suites the HTTPS endpoint will negotiate.

Why does ES.8 matter?

As long as the endpoint advertises a policy that still accepts TLS 1.0/1.1, an attacker on the network path can attempt to force a connection down to the weakest mutually supported protocol and target known weaknesses in those older ciphers. Pinning the latest policy stops the negotiation slipping backwards. The control maps to NIST 800-53 SC-8/SC-13/SC-23 and the data-in-transit requirements of PCI DSS.

How do I fix ES.8?

  1. Enforce HTTPS on the domain endpoint.
  2. Set TLSSecurityPolicy to the latest supported policy (Policy-Min-TLS-1-2-PFS-2023-10).
  3. Confirm clients can negotiate TLS 1.2+ before pinning the stricter policy.
  4. Default new domains to the latest TLS policy in your templates.

Remediation script · bash

# Raise the search-domain TLS policy and keep HTTPS enforced (no downtime, no re-index).
aws opensearch update-domain-config \
  --domain-name logs-prod \
  --domain-endpoint-options '{"EnforceHTTPS":true,"TLSSecurityPolicy":"Policy-Min-TLS-1-2-PFS-2023-10"}'

# Pin an API Gateway custom domain to a recommended (enhanced 2025) TLS security policy.
# Enhanced policies require endpointAccessMode=STRICT, set in the same call.
aws apigateway update-domain-name \
  --domain-name api.example.com \
  --patch-operations '[{"op":"replace","path":"/securityPolicy","value":"SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"},{"op":"replace","path":"/endpointAccessMode","value":"STRICT"}]'

# Confirm the live policy once the domain settles.
aws opensearch describe-domain-config --domain-name logs-prod \
  --query 'DomainConfig.DomainEndpointOptions.Options.TLSSecurityPolicy' \
  --output text

Full walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on APIs and search domains.

Is ES.8 a false positive?

The control demands the single latest policy (Policy-Min-TLS-1-2-PFS-2023-10), so a domain that is already HTTPS-only and pinned to an earlier but still-modern TLS 1.2 policy such as Policy-Min-TLS-1-2-2019-07 still fails, even though every connection is encrypted with TLS 1.2. That older policy is sometimes a deliberate choice: it keeps a wider cipher set so legacy clients or SDKs that can't negotiate the stricter PFS-2023-10 suites can still connect. If those clients are real and you can't move them yet, document the constraint and suppress the finding rather than breaking them; treat it as a tracked exception with a date to revisit, not a config to silently change.

Full lesson Enforce TLS on APIs and search domains Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ES controls ↗ Check your own account for ES.8 →
Part of the learning path Encrypt everything

More ES controls

  • ES.1 ES domains should encrypt at rest
  • ES.2 A legacy Elasticsearch domain is publicly accessible
  • ES.3 ES should encrypt node-to-node traffic
  • ES.4 ES error logging to CW should be enabled
  • ES.5 ES domains should have audit logging
  • ES.6 ES domains should have >= 3 data nodes
  • ES.7 ES domains should have >= 3 dedicated master nodes