Question 1

Is domain_endpoint_options enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks whether connections to OpenSearch domains are using HTTPS. The rule is non-compliant if the OpenSearch domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSSecurityPolicy' is not in 'tlsPolicies'.

Question 2

Is encrypt_at_rest enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks whether AWS OpenSearch domains have encryption-at-rest configuration enabled. The check fails if encryption at rest is not enabled.

Question 3

Is node_to_node_encryption enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks if AWS OpenSearch Service nodes are encrypted end to end. The rule is non-compliant if the node-to-node encryption is not enabled on the domain.

Question 4

Is vpc_options enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks whether AWS OpenSearch domains are in a VPC. It does not evaluate the VPC subnet routing configuration to determine public access.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 164.312(b)	164.312(b)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled 164.308(a)(1)(ii)(B)	164.308(a)(1)(ii)(B)
OpenSearch domains should have encryption at rest enabledopensearch_domain_encryption_at_rest_enabled 164.308(a)(1)(ii)(B)	164.308(a)(1)(ii)(B)
OpenSearch domains should use HTTPSopensearch_domain_https_required 164.314(b)(2)(iv)	164.314(b)(2)(iv)
OpenSearch domains should be in a VPCopensearch_domain_in_vpc 164.312(a)(1)	164.312(a)(1)
OpenSearch domains node-to-node encryption should be enabledopensearch_domain_node_to_node_encryption_enabled 164.308(a)(4)(ii)(A)	164.308(a)(4)(ii)(A)

Controls