aws-opensearch-public-permissive-endpoint

id: aws-opensearch-public-permissive-endpoint
emits: ExposedToInternet
description: OpenSearch domain with a public endpoint and Principal:* access policy is reachable from
  the internet; unauthenticated if FGAC is also disabled.
match:
- - domain: null
  - CanRead
  - domain: null
where:
- node_type(?domain) == SearchService
- ?domain.VPCOptions is null or empty (public endpoint)
- ?domain access policy contains Principal AWS '*' or Principal '*' with an Allow for es:ESHttp* and no
  effective Condition restricting to specific IPs or VPC
emit:
  source_type: SearchService
  target_type: AnonymousIdentity
  source: ?domain
  target: <AnonymousIdentity>
  permissions:
  - es:ESHttpGet
  - es:ESHttpPost
  conditions:
  - resource_policy
  - condition_expression
  state_logic: "ACTIVE when: (a) domain has no VPCOptions (public endpoint), (b) domain access policy\
    \ explicitly allows es:ESHttp* for Principal:* with no condition restricting source IP or VPC, AND\
    \ (c) FGAC is disabled (so unsigned requests are admitted without IAM auth). CONDITIONAL(condition_expression)\
    \ when FGAC is enabled \u2014 IAM authentication is required even for Principal:*, so the endpoint\
    \ is publicly routed but not truly anonymous. CONDITIONAL(condition_expression) when the access policy\
    \ has an aws:SourceIp condition (still public endpoint but IP-filtered). BLOCKED if VPCOptions is\
    \ set (domain is not publicly routed). Do not emit if the Principal:* statement has a Deny in a more\
    \ specific statement covering the same actions."
  false_positive_note: "A VPC domain is NEVER internet-exposed regardless of its access policy \u2014\
    \ do not emit when VPCOptions is set. FGAC-enabled domains with Principal:* still require IAM SigV4\
    \ authentication; these are NOT anonymously accessible, only broadly-IAM-accessible \u2014 emit CONDITIONAL,\
    \ not ACTIVE. Honor any aws:SourceIp or aws:VpcSourceIp condition that is present; those restrict\
    \ the effective internet exposure. Do not rely solely on the absence of a Condition block; check whether\
    \ the Principal:* Allow is effective after evaluating SCPs and IAM deny statements."
  narrative: "OpenSearch domain {domain.name} has a public endpoint and its domain access policy allows\
    \ es:ESHttp* for all principals without credential requirements \u2014 any internet host can query\
    \ or write to its search indices without authentication (FGAC disabled) or with any valid AWS identity\
    \ (FGAC enabled)."