diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/__init__.py b/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.metadata.json b/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.metadata.json new file mode 100644 index 0000000000..cd49712258 --- /dev/null +++ b/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.metadata.json @@ -0,0 +1,32 @@ +{ + "Provider": "aws", + "CheckID": "opensearch_domain_data_nodes_fault_tolerant", + "CheckTitle": "OpenSearch Domain should have at least three data nodes", + "CheckType": [], + "ServiceName": "opensearch", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:es:region:account-id:domain/resource-id", + "Severity": "medium", + "ResourceType": "AwsOpenSearchServiceDomain", + "Description": "An OpenSearch domain requires at least three data nodes for high availability and fault-tolerance. Deploying an OpenSearch domain with at least three data nodes ensures cluster operations if a node fails.", + "Risk": "A single point of failure exists in the OpenSearch domain, which can lead to data loss or service disruption.", + "RelatedUrl": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-6", + "Terraform": "" + }, + "Recommendation": { + "Text": "Configure the OpenSearch domain with at least three data nodes to ensure high availability and fault tolerance.", + "Url": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains" + } + }, + "Categories": [ + "redundancy" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.py b/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.py new file mode 100644 index 0000000000..d6b7a9549d --- /dev/null +++ b/prowler/providers/aws/services/opensearch/opensearch_domain_data_nodes_fault_tolerant/opensearch_domain_data_nodes_fault_tolerant.py @@ -0,0 +1,25 @@ +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.opensearch.opensearch_client import ( + opensearch_client, +) + + +class opensearch_domain_data_nodes_fault_tolerant(Check): + def execute(self): + findings = [] + for domain in opensearch_client.opensearch_domains: + report = Check_Report_AWS(self.metadata()) + report.resource_id = domain.name + report.resource_arn = domain.arn + report.region = domain.region + report.resource_tags = domain.tags + report.status = "PASS" + report.status_extended = f"Opensearch domain {domain.name} has {domain.data_nodes_count} data nodes." + + if domain.data_nodes_count < 3: + report.status = "FAIL" + report.status_extended = f"Opensearch domain {domain.name} does not have at least 3 data nodes, which is recommended for fault tolerance." + + findings.append(report) + + return findings