Is encrypt_at_rest enforced for NIST SP 800-53 Rev 5?

Yes, This control checks whether AWS OpenSearch domains have encryption-at-rest configuration enabled. The check fails if encryption at rest is not enabled.

Is log_publishing_options enforced for NIST SP 800-53 Rev 5?

Yes, This control checks whether AWS OpenSearch Service domains are configured to send logs to CloudWatch logs. The rule is non-compliant if logging is not configured.

Is node_to_node_encryption enforced for NIST SP 800-53 Rev 5?

Yes, This control checks if AWS OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain.

terraform-aws-modules/opensearch/aws for NIST SP 800-53 Rev 5

Controls

6 controls from NIST SP 800-53 Rev 5 apply to this module.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AC-16(b)	AC-16(b)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled AU-9(3)	AU-9(3)
OpenSearch domains should have encryption at rest enabledopensearch_domain_encryption_at_rest_enabled AU-9(3)	AU-9(3)
OpenSearch domains should have logging to CloudWatch Logs enabledopensearch_domain_logs_to_cloudwatch None	None
OpenSearch domains node-to-node encryption should be enabledopensearch_domain_node_to_node_encryption_enabled AC-4(22)	AC-4(22)
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7