[New Check]: OpenSearch Serverless collections use customer-managed KMS keys

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

opensearchserverless

Suggested check name

opensearchserverless_collection_encrypted_with_cmk

Context and goal

• Source control: FS-25 — OpenSearch Serverless Encryption.
• Semantic requirement: Checks OpenSearch Serverless collections used by KBs are encrypted with a customer-managed KMS key.
• Valid cloud-posture assertion: Prowler has OpenSearch Service but no OpenSearch Serverless collector. The proposed check evaluates a durable AWS control-plane property with deterministic resource-level or regional posture semantics; it does not treat optional product adoption or manual governance evidence as failure.
• Resource scope: Each Amazon OpenSearch Serverless collection.
• Initiative tracker: https://github.com/prowler-cloud/prowler/issues/12597

Expected behavior

• Resource or scope to evaluate: Each Amazon OpenSearch Serverless collection.
• PASS when: the applicable encryption policy configures AWSOwnedKey=false and a KmsARN.
• FAIL when: the collection uses an AWS-owned key or lacks a customer-managed KMS key.
• MANUAL when: Required detail or policy data is unavailable or indeterminate after collection; never emit a false PASS for unreadable in-scope data.
• No resources: Return no findings. For regional/account-level posture checks, return no finding when the audited service has no relevant resources in that region.
• Error behavior: Preserve Prowler's normal service-error reporting and do not convert AccessDenied, unsupported-region responses, or partial inventory into PASS.

References

• Immutable AWS source snapshot: https://github.com/aws-samples/sample-aiml-security-assessment/tree/0e2c5b48a6016a77e9d376bc17f41ef95cb2635d
• Source implementation for FS-25: https://github.com/aws-samples/sample-aiml-security-assessment/tree/0e2c5b48a6016a77e9d376bc17f41ef95cb2635d
• Audited Prowler snapshot: https://github.com/prowler-cloud/prowler/tree/2b81fdcc04c298bc476086b4082bd8fa4a9f1dd5
• Required AWS APIs/collector inputs: aoss:ListCollections; aoss:ListSecurityPolicies; aoss:GetSecurityPolicy.
• Full initiative and classification rationale: https://github.com/prowler-cloud/prowler/issues/12597

Suggested severity

High

Additional implementation notes

• Collector change: Implement the shared OpenSearch Serverless collector and resolve encryption policies to collections.
• Dependencies: Shared OpenSearch Serverless service collector
• Emit one finding per resource unless the scope above explicitly defines a regional/account-level posture result.
• Add metadata and implementation files following the AWS check conventions, plus collector/model updates where required.
• Acceptance tests must cover PASS, FAIL, unreadable/indeterminate MANUAL behavior, empty inventory, API error handling, and all stated edge conditions.
• Tests must prove the exact AWS response fields above and ensure unrelated resources/configurations are not reported.
• Keep this CheckID atomic; do not combine it with adjacent assertions that have different resources, APIs, or remediation.

Validation evidence required

Before this implementation can be considered ready for merge:

• The pull request must complete a CodeRabbit review, and all actionable findings must be addressed or explicitly resolved with technical justification.
• The contributor must provide execution evidence for one PASS case and one FAIL case using representative AWS resources. The evidence must include the executed Prowler command and the resulting finding output, demonstrating the expected status and status_extended message.
• All execution evidence must be censored before publication. Account IDs, resource names, ARNs, credentials, tokens, endpoints, and any other sensitive or identifying information must be visibly masked or removed from screenshots, logs, and command output.
• Unit tests are required, but they do not replace this runtime evidence.