97 lines
3.3 KiB
Plaintext
97 lines
3.3 KiB
Plaintext
include::../opensearch_description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../opensearch_recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.Domain.html[aws-cdk-lib.aws_opensearchservice.Domain]:
|
|
|
|
[source,javascript]
|
|
----
|
|
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';
|
|
|
|
const exampleDomain = new opensearchservice.Domain(this, 'ExampleDomain', {
|
|
version: EngineVersion.OPENSEARCH_1_3,
|
|
}); // Sensitive, encryption must be explicitly enabled
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.CfnDomain.html[aws-cdk-lib.aws_opensearchservice.CfnDomain]:
|
|
|
|
[source,javascript]
|
|
----
|
|
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';
|
|
|
|
const exampleCfnDomain = new opensearchservice.CfnDomain(this, 'ExampleCfnDomain', {
|
|
engineVersion: 'OpenSearch_1.3',
|
|
}); // Sensitive, encryption must be explicitly enabled
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.Domain.html[aws-cdk-lib.aws_opensearchservice.Domain]:
|
|
|
|
[source,javascript]
|
|
----
|
|
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';
|
|
|
|
const exampleDomain = new opensearchservice.Domain(this, 'ExampleDomain', {
|
|
version: EngineVersion.OPENSEARCH_1_3,
|
|
encryptionAtRest: {
|
|
enabled: true,
|
|
},
|
|
});
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.CfnDomain.html[aws-cdk-lib.aws_opensearchservice.CfnDomain]:
|
|
|
|
[source,javascript]
|
|
----
|
|
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';
|
|
|
|
const exampleCfnDomain = new opensearchservice.CfnDomain(this, 'ExampleCfnDomain', {
|
|
engineVersion: 'OpenSearch_1.3',
|
|
encryptionAtRestOptions: {
|
|
enabled: true,
|
|
},
|
|
});
|
|
----
|
|
|
|
|
|
include::../opensearch_see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
For CfnDomain:
|
|
|
|
* If `encryptionAtRestOptions.enabled` is explicitly set to `false`: Make sure that using unencrypted {OpenSearch|Elasticsearch} domains is safe here.
|
|
* In any other case: Omitting `encryptionAtRestOptions` causes encryption of data at rest to be disabled for this {OpenSearch|Elasticsearch} domain. Make sure it is safe here.
|
|
|
|
For Domain:
|
|
|
|
* If `encryptionAtRest.enabled` is explicitly set to `false`: Make sure that using unencrypted {OpenSearch|Elasticsearch} domains is safe here.
|
|
* In any other case: Omitting `encryptionAtRest` causes encryption of data at rest to be disabled for this {OpenSearch|Elasticsearch} domain. Make sure it is safe here.
|
|
|
|
=== Highlighting
|
|
|
|
For CfnDomain:
|
|
* Highlight the initializer function if it does not contain the third argument `props`.
|
|
* Highlight the `props` object if it does not contain the property `encryptionAtRestOptions`.
|
|
* Highlight the `encryptionAtRestOptions` property if it does not contain the property `enabled`.
|
|
* Highlight the `encryptionAtRestOptions.enabled` property if it is not set to `true`.
|
|
|
|
For Domain:
|
|
* Highlight the `props` object if it does not contain `encryptionAtRest`.
|
|
* Highlight the `encryptionAtRest` property if it does not contain the property `enabled`.
|
|
* Highlight the `encryptionAtRest.enabled` property if it is not set to `true`.
|
|
|
|
endif::env-github,rspecator-view[]
|
|
|