Skip to main content
emnode
Sign up
Compliance High severity

AWS Security Hub · Opensearch

Opensearch.7: OpenSearch has no fine-grained access control

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub Opensearch.7 check?

Opensearch.7 fails when a domain does not have fine-grained access control (FGAC) enabled in its advanced security options. FGAC layers a master user and index- and field-level role mapping on top of the domain access policy.

Why does Opensearch.7 matter?

Without FGAC, access is all-or-nothing at the domain level: anyone the access policy lets in can free-text search every index. That is how an engineer with a latency dashboard ends up able to read customer support transcripts or partial card data sitting in the same cluster. FGAC narrows reach to specific indexes and fields, turning a broad grant into genuine least privilege.

How do I fix Opensearch.7?

  1. Confirm the prerequisites are on: node-to-node encryption, encryption at rest, and HTTPS enforcement.
  2. Enable FGAC with update-domain-config, defining a master user backed by IAM or an internal user.
  3. Map roles to specific indexes and fields so each principal only reaches what it needs.
  4. Add a Config rule so new domains are created with FGAC enabled by default.

Remediation script · bash

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql

Full walkthrough (console steps, edge cases and verification) in the lesson Harden database auth, ports and access.

Is Opensearch.7 a false positive?

Enabling FGAC clears the control, but a single all-access master user is not least privilege: the finding can pass while access is still effectively wide open until the roles are scoped.

Full lesson Harden database auth, ports and access Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for Opensearch controls ↗ Check your own account for Opensearch.7 →
Part of the learning path Tighten your databases

More Opensearch controls