Question 1

Is domain_endpoint_options enforced for RBI IT Framework for NBFCs?

Accepted Answer

Yes, This control checks whether connections to OpenSearch domains are using HTTPS. The rule is non-compliant if the OpenSearch domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSSecurityPolicy' is not in 'tlsPolicies'.

Question 2

Is log_publishing_options enforced for RBI IT Framework for NBFCs?

Accepted Answer

Yes, This control checks whether AWS OpenSearch Service domains are configured to send logs to CloudWatch logs. The rule is non-compliant if logging is not configured.

Question 3

Is vpc_options enforced for RBI IT Framework for NBFCs?

Accepted Answer

Yes, This control checks whether AWS OpenSearch domains are in a VPC. It does not evaluate the VPC subnet routing configuration to determine public access.

AWS OpenSearch Terraform module

Terraform Module Source