Skip to main content
LOWOpenSearchSecurity

OpenSearch Logging Disabled

opensearch-logging-disabled

What this rule checks

Detects OpenSearch domains without audit logs or application logs published to CloudWatch.

How to fix it

  1. 1Enable AUDIT_LOGS in LogPublishingOptions
  2. 2Enable ES_APPLICATION_LOGS in LogPublishingOptions
FlaggedThe domain (already hardened with FGAC, VPC and encryption) publishes no logs: LogPublishingOptions omits AUDIT_LOGS and ES_APPLICATION_LOGS, so there is no audit trail or application-error visibility in CloudWatch. CDK Insights flags AWS::OpenSearchService::Domain resources without audit or application logs.
import { CfnDomain } from 'aws-cdk-lib/aws-opensearchservice';

new CfnDomain(this, 'SearchDomain', {
  engineVersion: 'OpenSearch_2.11',
  clusterConfig: { instanceType: 'r6g.large.search', instanceCount: 2 },
  vpcOptions: {
    subnetIds: ['subnet-0abc123'],
    securityGroupIds: ['sg-0def456'],
  },
  encryptionAtRestOptions: { enabled: true },
  nodeToNodeEncryptionOptions: { enabled: true },
  domainEndpointOptions: { enforceHttps: true },
  advancedSecurityOptions: {
    enabled: true,
    internalUserDatabaseEnabled: false,
    masterUserOptions: {
      masterUserArn: 'arn:aws:iam::111122223333:role/OpenSearchAdmin',
    },
  },
});
FixedlogPublishingOptions now enables both AUDIT_LOGS and ES_APPLICATION_LOGS to a CloudWatch log group. The finding clears once audit and application logging are published.
import { CfnDomain } from 'aws-cdk-lib/aws-opensearchservice';

const logArn =
  'arn:aws:logs:us-east-1:111122223333:log-group:/aws/opensearch/search:*';
new CfnDomain(this, 'SearchDomain', {
  engineVersion: 'OpenSearch_2.11',
  clusterConfig: { instanceType: 'r6g.large.search', instanceCount: 2 },
  vpcOptions: {
    subnetIds: ['subnet-0abc123'],
    securityGroupIds: ['sg-0def456'],
  },
  encryptionAtRestOptions: { enabled: true },
  nodeToNodeEncryptionOptions: { enabled: true },
  domainEndpointOptions: { enforceHttps: true },
  advancedSecurityOptions: {
    enabled: true,
    internalUserDatabaseEnabled: false,
    masterUserOptions: {
      masterUserArn: 'arn:aws:iam::111122223333:role/OpenSearchAdmin',
    },
  },
  logPublishingOptions: {
    AUDIT_LOGS: { enabled: true, cloudWatchLogsLogGroupArn: logArn },
    ES_APPLICATION_LOGS: { enabled: true, cloudWatchLogsLogGroupArn: logArn },
  },
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

AWS::OpenSearchService::DomainAWS::Elasticsearch::Domain

Compliance frameworks

SOC2HIPAAPCI-DSSNIST

AWS documentation

Read the AWS guidance

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss opensearch-logging-disabled and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "opensearch-logging-disabled", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::opensearch-logging-disabled',
  reason: 'Why this is intentional',
});

Use the rule ID opensearch-logging-disabled shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

Catch this in your stack

$ npx cdk-insights scan

CDK Insights runs this and 118+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.

More OpenSearch rules

HIGHOpenSearch Encryption DisabledMEDIUMOpenSearch Access Control Weak
All rulesHow static analysis works