Description

Detects AWS OpenSearch domains with dangerous public exposure through overly permissive access policies. A vulnerability is reported when an OpenSearch domain's policy contains an "Allow" statement that grants access to all principals ('*') without any conditional restrictions, which could enable unauthorized access to sensitive data.

Detection Strategy

• Scans each OpenSearch domain in the AWS account and region

• Analyzes the domain's access policy looking for 'Allow' statements

• Reports a vulnerability if a policy statement has Principal set to '*' or {"AWS": "*"} with Effect: "Allow" and no Condition clause