{
    "Provider": "aws",
    "CheckID": "opensearch_service_domains_node_to_node_encryption_enabled",
    "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains have node-to-node encryption enabled",
    "CheckType": ["Protect", "Data protection", "Encryption of data in transit"],
    "ServiceName": "opensearch",
    "SubServiceName": "",
    "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
    "Severity": "medium",
    "ResourceType": "AwsOpenSearchDomain",
    "Description": "Check if Amazon Elasticsearch/Opensearch Service domains have node-to-node encryption enabled",
    "Risk": "Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure.",
    "RelatedUrl": "",
    "Remediation": {
      "Code": {
        "CLI": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Elasticsearch/node-to-node-encryption.html",
        "NativeIaC": "https://docs.bridgecrew.io/docs/elasticsearch_5#fix---builtime",
        "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Elasticsearch/node-to-node-encryption.html",
        "Terraform": ""
      },
      "Recommendation": {
        "Text": "Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console; Actions; and Modify encryption.",
        "Url": "https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html"
      }
    },
    "Categories": [],
    "Tags": {
      "Tag1Key": "value",
      "Tag2Key": "value"
    },
    "DependsOn": [],
    "RelatedTo": [],
    "Notes": "",
    "Compliance": []
  }
