Is encrypt_at_rest enforced for FedRAMP Moderate Baseline Rev 4?

Yes, This control checks whether AWS OpenSearch domains have encryption-at-rest configuration enabled. The check fails if encryption at rest is not enabled.

Is log_publishing_options enforced for FedRAMP Moderate Baseline Rev 4?

Yes, This control checks whether AWS OpenSearch Service domains are configured to send logs to CloudWatch logs. The rule is non-compliant if logging is not configured.

Is node_to_node_encryption enforced for FedRAMP Moderate Baseline Rev 4?

Yes, This control checks if AWS OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain.

terraform-aws-modules/opensearch/aws for FedRAMP Moderate Baseline Rev 4

Controls

6 controls from FedRAMP Moderate Baseline Rev 4 apply to this module.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AU-6(1)(3)	AU-6(1)(3)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled None	None
OpenSearch domains should have encryption at rest enabledopensearch_domain_encryption_at_rest_enabled None	None
OpenSearch domains should have logging to CloudWatch Logs enabledopensearch_domain_logs_to_cloudwatch AC-2(g)	AC-2(g)
OpenSearch domains node-to-node encryption should be enabledopensearch_domain_node_to_node_encryption_enabled None	None
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7