Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · ES

ES.8: ES should use latest TLS policy

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ES.8 check?

ES.8 checks DomainEndpointOptions.TLSSecurityPolicy on each domain and fails if it isn't pinned to the latest supported policy (currently Policy-Min-TLS-1-2-PFS-2023-10) or if HTTPS isn't enforced at all. The policy decides which TLS versions and cipher suites the HTTPS endpoint will negotiate.

Why does ES.8 matter?

As long as the endpoint advertises a policy that still accepts TLS 1.0/1.1, an attacker on the network path can attempt to force a connection down to the weakest mutually supported protocol and target known weaknesses in those older ciphers. Pinning the latest policy stops the negotiation slipping backwards. The control maps to NIST 800-53 SC-8/SC-13/SC-23 and the data-in-transit requirements of PCI DSS.

How do I fix ES.8?

  1. Enforce HTTPS on the domain endpoint.
  2. Set TLSSecurityPolicy to the latest supported policy (Policy-Min-TLS-1-2-PFS-2023-10).
  3. Confirm clients can negotiate TLS 1.2+ before pinning the stricter policy.
  4. Default new domains to the latest TLS policy in your templates.

Remediation script · bash

# Raise the search-domain TLS policy and keep HTTPS enforced (no downtime, no re-index).
aws opensearch update-domain-config \
  --domain-name logs-prod \
  --domain-endpoint-options '{"EnforceHTTPS":true,"TLSSecurityPolicy":"Policy-Min-TLS-1-2-PFS-2023-10"}'

# Pin an API Gateway custom domain to a recommended TLS security policy.
aws apigateway update-domain-name \
  --domain-name api.example.com \
  --patch-operations op=replace,path=/securityPolicy,value=TLS_1_2

# Confirm the live policy once the domain settles.
aws opensearch describe-domain-config --domain-name logs-prod \
  --query 'DomainConfig.DomainEndpointOptions.Options.TLSSecurityPolicy' \
  --output text

Full walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on APIs and search domains.

Full lesson Enforce TLS on APIs and search domains Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ES controls ↗ Check your own account for ES.8 →
Part of the learning path Encrypt everything

More ES controls

  • ES.1 ES domains should encrypt at rest
  • ES.2 A legacy Elasticsearch domain is publicly accessible
  • ES.3 ES should encrypt node-to-node traffic
  • ES.4 ES error logging to CW should be enabled
  • ES.5 ES domains should have audit logging
  • ES.6 ES domains should have >= 3 data nodes
  • ES.7 ES domains should have >= 3 dedicated master nodes