OpenSearch domains should encrypt data sent between nodes

How to fix it

• Can't be undone: Node-to-node encryption cannot be turned off once on; going back means a new domain built from a manual snapshot of this one.
• Interrupts service: Turning it on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit security configuration → Encryption

Node-to-node encryption

Selected

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --node-to-node-encryption-options '{"Enabled":true}' --region <region>

With Terraform

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  node_to_node_encryption {
    enabled = true
  }
}