OpenSearch domain should have audit logging enabled

What it checks

OpenSearch domain: no log publishing options configured.

Where it applies

Terraform: aws_opensearch_domain, aws_elasticsearch_domain

CloudFormation: AWS::OpenSearchService::Domain, AWS::Elasticsearch::Domain

How to fix it

1. Add log_publishing_options for AUDIT_LOGS (and optionally INDEX_SLOW_LOGS, SEARCH_SLOW_LOGS) pointing to a CloudWatch log group.

Frameworks

• AWS FSBP Opensearch.5
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.2.1
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules