OpenSearch domains should have fine-grained access control enabled

How to fix it

Turn fine-grained access control on for the named domain, with a master user and role mappings that describe who may read what. AWS rejects the change unless the domain already requires HTTPS, encrypts data at rest and encrypts traffic between nodes, so turn those on in the same change. Two things make it hard to reverse: it cannot be turned off again once it is on, and until roles are mapped it refuses every request, so a domain reached through an open or address-based access policy needs the migration period, which ends by itself after a fixed window.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit security configuration

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --advanced-security-options '{"Enabled":true,"MasterUserOptions":{"MasterUserARN":"<master-user-arn>"}}' --encryption-at-rest-options '{"Enabled":true}' --node-to-node-encryption-options '{"Enabled":true}' --domain-endpoint-options '{"EnforceHTTPS":true}' --region <region>

With Terraform

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  encrypt_at_rest {
    enabled = true
  }

  node_to_node_encryption {
    enabled = true
  }

  domain_endpoint_options {
    enforce_https = true
  }

  advanced_security_options {
    enabled = true

    master_user_options {
      master_user_arn = var.master_user_arn
    }
  }
}