aws.elasticsearch
Filters
cross-account
Filter to return all elasticsearch domains with cross account access permissions
- example:
policies:
- name: check-elasticsearch-cross-account
resource: aws.elasticsearch
filters:
- type: cross-account
properties:
actions:
items:
type: string
type: array
everyone_only:
type: boolean
return_allowed:
type: boolean
type:
enum:
- cross-account
whitelist:
items:
type: string
type: array
whitelist_conditions:
items:
type: string
type: array
whitelist_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_org_units:
items:
type: string
type: array
whitelist_org_units_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_orgids:
items:
type: string
type: array
whitelist_orgids_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_patterns:
items:
type: string
type: array
whitelist_patterns_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_vpc:
items:
type: string
type: array
whitelist_vpc_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_vpce:
items:
type: string
type: array
whitelist_vpce_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
required:
- type
Permissions - es:DescribeElasticsearchDomainConfig
cross-cluster
Filter to return all elasticsearch domains with inbound cross-cluster with the given info
- example:
policies:
- name: check-elasticsearch-cross-cluster
resource: aws.elasticsearch
filters:
- type: cross-cluster
inbound:
key: SourceDomainInfo.OwnerId
op: eq
value: '123456789'
outbound:
key: SourceDomainInfo.OwnerId
op: eq
value: '123456789'
properties:
inbound:
additionalProperties: false
properties:
default:
type: object
key:
type: string
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
- mod
tag_key_transforms:
items:
type: string
type: array
type:
enum:
- inbound
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
value_path:
type: string
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
- version
- float
required:
- key
- value
type: object
outbound:
additionalProperties: false
properties:
default:
type: object
key:
type: string
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
- mod
tag_key_transforms:
items:
type: string
type: array
type:
enum:
- outbound
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
value_path:
type: string
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
- version
- float
required:
- key
- value
type: object
type:
enum:
- cross-cluster
required:
- type
Permissions - es:ESCrossClusterGet
has-statement
Find resources with matching access policy statements.
If you want to return resource statements that include the listed key, e.g. Action, you can use PartialMatch instead of an exact match.
- example:
policies:
- name: sns-check-statement-id
resource: sns
filters:
- type: has-statement
statement_ids:
- BlockNonSSL
policies:
- name: sns-check-block-non-ssl
resource: sns
filters:
- type: has-statement
statements:
- Effect: Deny
Action: 'SNS:Publish'
Principal: '*'
Condition:
Bool:
"aws:SecureTransport": "false"
PartialMatch: 'Action'
properties:
statement_ids:
items:
type: string
type: array
statements:
items:
properties:
Action:
anyOf:
- type: string
- type: array
Condition:
type: object
Effect:
enum:
- Allow
- Deny
type: string
NotAction:
anyOf:
- type: string
- type: array
NotPrincipal:
anyOf:
- type: object
- type: array
NotResource:
anyOf:
- type: string
- type: array
PartialMatch:
anyOf:
- enum:
- Action
- NotAction
- Principal
- NotPrincipal
- Resource
- NotResource
- Condition
type: string
- items:
- enum:
- Action
- NotAction
- Principal
- NotPrincipal
- Resource
- NotResource
- Condition
type: string
type: array
Principal:
anyOf:
- type: string
- type: object
- type: array
Resource:
anyOf:
- type: string
- type: array
Sid:
type: string
required:
- Effect
type: object
type: array
type:
enum:
- has-statement
required:
- type
json-diff
Compute the diff from the current resource to a previous version.
A resource matches the filter if a diff exists between the current resource and the selected revision.
Utilizes config as a resource revision database.
Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).
properties:
selector:
enum:
- previous
- date
- locked
selector_value:
type: string
type:
enum:
- json-diff
required:
- type
Permissions - config:GetResourceConfigHistory
kms-key
Filter a resource by its associated kms key and optionally the aliasname of the kms key by using ‘c7n:AliasName’
- example:
Match a specific key alias:
policies: - name: dms-encrypt-key-check resource: dms-instance filters: - type: kms-key key: "c7n:AliasName" value: alias/aws/dms
Or match against native key attributes such as KeyManager, which
more explicitly distinguishes between AWS and CUSTOMER-managed
keys. The above policy can also be written as:
policies: - name: dms-aws-managed-key resource: dms-instance filters: - type: kms-key key: KeyManager value: AWS
properties:
default:
type: object
key:
type: string
match-resource:
type: boolean
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
- mod
operator:
enum:
- and
- or
tag_key_transforms:
items:
type: string
type: array
type:
enum:
- kms-key
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
value_path:
type: string
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
- version
- float
required:
- type
Permissions - kms:ListKeys, tag:GetResources, kms:ListResourceTags, kms:DescribeKey
source-ip
ValueFilter-based filter for verifying allowed source ips in an ElasticSearch domain’s access policy. Useful for checking to see if an ElasticSearch domain allows traffic from non approved IP addresses/CIDRs.
- example:
Find ElasticSearch domains that allow traffic from IP addresses not in the approved list (string matching)
Same as above but using cidr matching instead of string matching
properties:
default:
type: object
key:
type: string
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
- mod
tag_key_transforms:
items:
type: string
type: array
type:
enum:
- source-ip
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
value_path:
type: string
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
- version
- float
required:
- type
Permissions - es:DescribeElasticsearchDomainConfig
upgrade-available
Scans for available upgrade-compatible ES versions
This will check all the ElasticSearch domains on the resources, and return a list of viable upgrade options.
- example:
policies:
- name: elasticsearch-upgrade-available
resource: elasticsearch
filters:
- type: upgrade-available
major: False
properties:
major:
type: boolean
type:
enum:
- upgrade-available
value:
type: boolean
required:
- type
Permissions - es:GetCompatibleVersions
Actions
delete
Parent base class for filters and actions.
properties:
type:
enum:
- delete
required:
- type
Permissions - es:DeleteElasticsearchDomain
enable-auditlog
Action to enable audit logs on a domain endpoint
- example:
policies:
- name: enable-auditlog
resource: elasticsearch
filters:
- type: value
key: 'LogPublishingOptions.AUDIT_LOGS.Enabled'
op: eq
value: false
actions:
- type: enable-auditlog
state: True
loggroup_prefix: "/aws/es/domains"
properties:
delay:
type: number
loggroup_prefix:
type: string
state:
type: boolean
type:
enum:
- enable-auditlog
required:
- state
- type
Permissions - es:UpdateElasticsearchDomainConfig, es:ListDomainNames, logs:DescribeLogGroups, logs:CreateLogGroup, logs:PutResourcePolicy
remove-matched-source-ips
Action to remove matched source ips from a Access Policy. This action needs to be used in conjunction with the source-ip filter. It can be used for removing non-approved IP addresses from the the access policy of a ElasticSearch domain.
- example:
policies:
- name: es-access-revoke
resource: elasticsearch
filters:
- type: source-ip
value_type: cidr
op: not-in
value_from:
url: s3://my-bucket/allowed_cidrs.csv
actions:
- type: remove-matched-source-ips
properties:
type:
enum:
- remove-matched-source-ips
required:
- type
Permissions - es:UpdateElasticsearchDomainConfig
remove-statements
Action to remove policy statements from elasticsearch
- example:
policies:
- name: elasticsearch-cross-account
resource: aws.elasticsearch
filters:
- type: cross-account
actions:
- type: remove-statements
statement_ids: matched
properties:
statement_ids:
oneOf:
- enum:
- matched
- '*'
- items:
type: string
type: array
type:
enum:
- remove-statements
required:
- statement_ids
- type
Permissions - es:DescribeElasticsearchDomainConfig, es:UpdateElasticsearchDomainConfig
update-domain-config
A general-purpose action that forwards parameters to the AWS UpdateElasticsearchDomainConfig API.
- example:
policies:
- name: es-update-ebs-volume-type
resource: aws.elasticsearch
filters:
- type: value
key: EBSOptions.VolumeType
op: eq
value: gp2
actions:
- type: update-domain-config
EBSOptions:
VolumeType: gp3
properties:
AccessPolicies:
type: string
AdvancedOptions:
patternProperties:
^.+$:
type: string
type: object
AdvancedSecurityOptions:
properties:
AnonymousAuthEnabled:
type: boolean
Enabled:
type: boolean
InternalUserDatabaseEnabled:
type: boolean
MasterUserOptions:
properties:
MasterUserARN:
type: string
MasterUserName:
type: string
MasterUserPassword:
type: string
type: object
SAMLOptions:
properties:
Enabled:
type: boolean
Idp:
properties:
EntityId:
type: string
MetadataContent:
type: string
type: object
MasterBackendRole:
type: string
MasterUserName:
type: string
RolesKey:
type: string
SessionTimeoutMinutes:
type: integer
SubjectKey:
type: string
type: object
type: object
AutoTuneOptions:
properties:
DesiredState:
enum:
- ENABLED
- DISABLED
type: string
MaintenanceSchedules:
items:
properties:
CronExpressionForRecurrence:
type: string
Duration:
properties:
Unit:
enum:
- HOURS
type: string
Value:
type: number
type: object
StartAt:
type: string
type: object
type: array
RollbackOnDisable:
enum:
- NO_ROLLBACK
- DEFAULT_ROLLBACK
type: string
type: object
AutomatedSnapshotPauseOptions:
properties:
Enabled:
type: boolean
EndTime:
type: string
StartTime:
type: string
type: object
CognitoOptions:
properties:
Enabled:
type: boolean
IdentityPoolId:
type: string
RoleArn:
type: string
UserPoolId:
type: string
type: object
DeploymentStrategyOptions:
properties:
DeploymentStrategy:
enum:
- Default
- CapacityOptimized
type: string
type: object
DomainEndpointOptions:
properties:
CustomEndpoint:
type: string
CustomEndpointCertificateArn:
type: string
CustomEndpointEnabled:
type: boolean
EnforceHTTPS:
type: boolean
TLSSecurityPolicy:
enum:
- Policy-Min-TLS-1-0-2019-07
- Policy-Min-TLS-1-2-2019-07
- Policy-Min-TLS-1-2-PFS-2023-10
- Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08
type: string
type: object
DryRun:
type: boolean
EBSOptions:
properties:
EBSEnabled:
type: boolean
Iops:
type: integer
Throughput:
type: integer
VolumeSize:
type: integer
VolumeType:
enum:
- standard
- gp2
- io1
- gp3
type: string
type: object
ElasticsearchClusterConfig:
properties:
ColdStorageOptions:
properties:
Enabled:
type: boolean
type: object
DedicatedMasterCount:
type: integer
DedicatedMasterEnabled:
type: boolean
DedicatedMasterType:
enum:
- m3.medium.elasticsearch
- m3.large.elasticsearch
- m3.xlarge.elasticsearch
- m3.2xlarge.elasticsearch
- m4.large.elasticsearch
- m4.xlarge.elasticsearch
- m4.2xlarge.elasticsearch
- m4.4xlarge.elasticsearch
- m4.10xlarge.elasticsearch
- m5.large.elasticsearch
- m5.xlarge.elasticsearch
- m5.2xlarge.elasticsearch
- m5.4xlarge.elasticsearch
- m5.12xlarge.elasticsearch
- r5.large.elasticsearch
- r5.xlarge.elasticsearch
- r5.2xlarge.elasticsearch
- r5.4xlarge.elasticsearch
- r5.12xlarge.elasticsearch
- c5.large.elasticsearch
- c5.xlarge.elasticsearch
- c5.2xlarge.elasticsearch
- c5.4xlarge.elasticsearch
- c5.9xlarge.elasticsearch
- c5.18xlarge.elasticsearch
- ultrawarm1.medium.elasticsearch
- ultrawarm1.large.elasticsearch
- t2.micro.elasticsearch
- t2.small.elasticsearch
- t2.medium.elasticsearch
- r3.large.elasticsearch
- r3.xlarge.elasticsearch
- r3.2xlarge.elasticsearch
- r3.4xlarge.elasticsearch
- r3.8xlarge.elasticsearch
- i2.xlarge.elasticsearch
- i2.2xlarge.elasticsearch
- d2.xlarge.elasticsearch
- d2.2xlarge.elasticsearch
- d2.4xlarge.elasticsearch
- d2.8xlarge.elasticsearch
- c4.large.elasticsearch
- c4.xlarge.elasticsearch
- c4.2xlarge.elasticsearch
- c4.4xlarge.elasticsearch
- c4.8xlarge.elasticsearch
- r4.large.elasticsearch
- r4.xlarge.elasticsearch
- r4.2xlarge.elasticsearch
- r4.4xlarge.elasticsearch
- r4.8xlarge.elasticsearch
- r4.16xlarge.elasticsearch
- i3.large.elasticsearch
- i3.xlarge.elasticsearch
- i3.2xlarge.elasticsearch
- i3.4xlarge.elasticsearch
- i3.8xlarge.elasticsearch
- i3.16xlarge.elasticsearch
type: string
InstanceCount:
type: integer
InstanceType:
enum:
- m3.medium.elasticsearch
- m3.large.elasticsearch
- m3.xlarge.elasticsearch
- m3.2xlarge.elasticsearch
- m4.large.elasticsearch
- m4.xlarge.elasticsearch
- m4.2xlarge.elasticsearch
- m4.4xlarge.elasticsearch
- m4.10xlarge.elasticsearch
- m5.large.elasticsearch
- m5.xlarge.elasticsearch
- m5.2xlarge.elasticsearch
- m5.4xlarge.elasticsearch
- m5.12xlarge.elasticsearch
- r5.large.elasticsearch
- r5.xlarge.elasticsearch
- r5.2xlarge.elasticsearch
- r5.4xlarge.elasticsearch
- r5.12xlarge.elasticsearch
- c5.large.elasticsearch
- c5.xlarge.elasticsearch
- c5.2xlarge.elasticsearch
- c5.4xlarge.elasticsearch
- c5.9xlarge.elasticsearch
- c5.18xlarge.elasticsearch
- ultrawarm1.medium.elasticsearch
- ultrawarm1.large.elasticsearch
- t2.micro.elasticsearch
- t2.small.elasticsearch
- t2.medium.elasticsearch
- r3.large.elasticsearch
- r3.xlarge.elasticsearch
- r3.2xlarge.elasticsearch
- r3.4xlarge.elasticsearch
- r3.8xlarge.elasticsearch
- i2.xlarge.elasticsearch
- i2.2xlarge.elasticsearch
- d2.xlarge.elasticsearch
- d2.2xlarge.elasticsearch
- d2.4xlarge.elasticsearch
- d2.8xlarge.elasticsearch
- c4.large.elasticsearch
- c4.xlarge.elasticsearch
- c4.2xlarge.elasticsearch
- c4.4xlarge.elasticsearch
- c4.8xlarge.elasticsearch
- r4.large.elasticsearch
- r4.xlarge.elasticsearch
- r4.2xlarge.elasticsearch
- r4.4xlarge.elasticsearch
- r4.8xlarge.elasticsearch
- r4.16xlarge.elasticsearch
- i3.large.elasticsearch
- i3.xlarge.elasticsearch
- i3.2xlarge.elasticsearch
- i3.4xlarge.elasticsearch
- i3.8xlarge.elasticsearch
- i3.16xlarge.elasticsearch
type: string
WarmCount:
type: integer
WarmEnabled:
type: boolean
WarmType:
enum:
- ultrawarm1.medium.elasticsearch
- ultrawarm1.large.elasticsearch
type: string
ZoneAwarenessConfig:
properties:
AvailabilityZoneCount:
type: integer
type: object
ZoneAwarenessEnabled:
type: boolean
type: object
EncryptionAtRestOptions:
properties:
Enabled:
type: boolean
KmsKeyId:
type: string
type: object
LogPublishingOptions:
patternProperties:
^.+$:
CloudWatchLogsLogGroupArn:
type: string
Enabled:
type: boolean
type: object
NodeToNodeEncryptionOptions:
properties:
Enabled:
type: boolean
type: object
SnapshotOptions:
properties:
AutomatedSnapshotStartHour:
type: integer
type: object
VPCOptions:
properties:
SecurityGroupIds:
items:
type: string
type: array
SubnetIds:
items:
type: string
type: array
type: object
type:
enum:
- update-domain-config
required:
- type
Permissions - es:UpdateElasticsearchDomainConfig
update-tls-config
Action to update tls-config on a domain endpoint
- example:
policies:
- name: update-tls-config
resource: elasticsearch
filters:
- type: value
key: 'DomainEndpointOptions.TLSSecurityPolicy'
op: eq
value: "Policy-Min-TLS-1-0-2019-07"
actions:
- type: update-tls-config
value: "Policy-Min-TLS-1-2-2019-07"
properties:
type:
enum:
- update-tls-config
value:
enum:
- Policy-Min-TLS-1-0-2019-07
- Policy-Min-TLS-1-2-2019-07
- Policy-Min-TLS-1-2-PFS-2023-10
type: string
required:
- value
- type
Permissions - es:UpdateElasticsearchDomainConfig, es:ListDomainNames