Elasticsearch HTTPS Required Policy

1# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-https-required.sentinel
2# Conversion quality: Good
3
4resource_policy "aws_elasticsearch_domain" "https_required" {
5    locals {
6        endpoint_options = core::try(attrs.domain_endpoint_options, [])
7        endpoint_options_present = core::length(local.endpoint_options) > 0
8        enforce_https = core::try(local.endpoint_options[0].enforce_https, false)
9        tls_security_policy = core::try(local.endpoint_options[0].tls_security_policy, "")
10    }
11
12    enforce {
13        condition = local.endpoint_options_present
14        error_message = "Elasticsearch domains must define domain_endpoint_options"
15    }
16
17    enforce {
18        condition = local.enforce_https == true
19        error_message = "Elasticsearch domains must set domain_endpoint_options.enforce_https = true"
20    }
21
22    enforce {
23        condition = local.tls_security_policy == "Policy-Min-TLS-1-2-PFS-2023-10"
24        error_message = "Elasticsearch domains must use tls_security_policy 'Policy-Min-TLS-1-2-PFS-2023-10'"
25    }
26}