Elasticsearch domains should have encryption at-rest enabled

How to fix it

• Can't be undone: Encryption at rest cannot be turned off once on; going back means a new domain built from a manual snapshot of this one.
• Interrupts service: Turning it on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit security configuration → Encryption

Enable encryption of data at rest

Selected; UltraWarm and cold storage must be off while you enable it

Use AWS owned key

Selected, or cleared for a customer managed symmetric key; settle it first, the key cannot change later

With the AWS CLI

aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true --region <region>

With Terraform

• Replaces the resource: Below elasticsearch_version 6.7, or with kms_key_id added, enabling encrypt_at_rest in Terraform destroys the domain and builds an empty one; upgrade first, and use the console for a customer key.

resource "aws_elasticsearch_domain" "this" {
  domain_name = var.domain_name

  encrypt_at_rest {
    enabled = true
  }
}