OpenSearch domain should have fine-grained access control enabled

What it checks

OpenSearch domain: fine-grained access control is not enabled.

Where it applies

Terraform: aws_opensearch_domain, aws_elasticsearch_domain

CloudFormation: AWS::OpenSearchService::Domain, AWS::Elasticsearch::Domain

How to fix it

1. Enable fine-grained access control with IAM master user. Set up index patterns, roles, and role mappings in OpenSearch Dashboards.

Frameworks

• AWS FSBP Opensearch.7
• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules