Is log_publishing_options enforced for SOC 2?

Yes, This control checks whether OpenSearch service domains have audit logging enabled. The rule is non-compliant if an OpenSearch service domain does not have audit logging enabled.

AWS OpenSearch Terraform module

Upstream version 2.11.1

5 controls from SOC 2 requirements

Terraform Module Source

soc2.compliance.tf/terraform-aws-modules/opensearch/aws

Compliance Inputs Outputs Resources Rules Diff (0)README

CloudWatch log groups should have retention period of at least 365 days

cloudwatch_log_group_retention_period_365C1.2

Framework requirement

Log groups should have encryption at rest enabled

log_group_encryption_at_rest_enabledCC7.3

Framework requirement

OpenSearch domains should have audit logging enabled

opensearch_domain_audit_logging_enabledA1.2

Framework requirement

OpenSearch domains should have logging to CloudWatch Logs enabled

opensearch_domain_logs_to_cloudwatchA1.2

Framework requirement

VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888

vpc_security_group_allows_ingress_to_cassandra_portsCC6.6

Framework requirement