Elasticsearch domains should not be publicly accessible

How to fix it

Set at creation: fixing it means replacing the resource.

Have the data the named domain holds reachable only from inside a VPC. A domain created with a public endpoint cannot be moved into one afterwards, so this is a replacement and a data migration: create the new domain with VPC access, snapshot the existing one and restore into it, repoint every client, and only then delete the public domain, which is what clears the finding. In Terraform this is not a migration: adding a VPC configuration to an existing domain forces a replacement, destroying it and building an empty one, so the snapshot must exist before the apply.

In the console

OpenSearch Service → Domains → Create domain → Network

With Terraform

resource "aws_elasticsearch_domain" "this" {
  domain_name = var.domain_name

  vpc_options {
    subnet_ids         = var.subnet_ids
    security_group_ids = var.security_group_ids
  }
}