Question 1

Is domain_endpoint_options enforced for EU GMP Annex 11?

Accepted Answer

Yes, This control checks whether connections to OpenSearch domains are using HTTPS. The rule is non-compliant if the OpenSearch domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSSecurityPolicy' is not in 'tlsPolicies'.

Question 2

Is encrypt_at_rest enforced for EU GMP Annex 11?

Accepted Answer

Yes, This control checks whether AWS OpenSearch domains have encryption-at-rest configuration enabled. The check fails if encryption at rest is not enabled.

Question 3

Is node_to_node_encryption enforced for EU GMP Annex 11?

Accepted Answer

Yes, This control checks if AWS OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain.

AWS OpenSearch Terraform module

Terraform Module Source