diff --git a/rules/S6258/terraform/rule.adoc b/rules/S6258/terraform/rule.adoc index fd52e031836..d5d8a24f533 100644 --- a/rules/S6258/terraform/rule.adoc +++ b/rules/S6258/terraform/rule.adoc @@ -14,6 +14,18 @@ resource "aws_s3_bucket" "mynoncompliantbucket" { # Sensitive } ---- +For https://aws.amazon.com/opensearch-service/[Amazon OpenSearch] service, or Amazon Elasticsearch service: + +---- +resource "aws_elasticsearch_domain" "domain" { + log_publishing_options { + cloudwatch_log_group_arn = "arn:aws:logs:us-east-1:1234:log-group:es-audit-logs" + log_type = "AUDIT_LOGS" + enabled = false # Sensitive + } +} +---- + For https://aws.amazon.com/cloudfront/[Amazon CloudFront] distributions: ---- @@ -54,6 +66,18 @@ resource "aws_s3_bucket" "mycompliantbucket" { # Compliant } ---- +For https://aws.amazon.com/opensearch-service/[Amazon OpenSearch] service, or Amazon Elasticsearch service: + +---- +resource "aws_elasticsearch_domain" "domain" { + log_publishing_options { + cloudwatch_log_group_arn = "arn:aws:logs:us-east-1:1234:log-group:es-audit-logs" + log_type = "AUDIT_LOGS" + enabled = true + } +} +---- + For https://aws.amazon.com/cloudfront/[Amazon CloudFront] distributions: ----