OpenSearch domains should have encryption at rest enabled

How to fix it

• Can't be undone: Encryption at rest cannot be turned off once on; going back means a new domain built from a manual snapshot of this one.
• Interrupts service: Turning it on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit security configuration → Encryption

Enable encryption of data at rest

Selected; turn off UltraWarm and cold storage first, moving their indexes to hot storage

Use AWS owned key

Selected, or cleared for a customer managed key; settle it first, the key cannot change later

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --encryption-at-rest-options '{"Enabled":true}' --region <region>

With Terraform

• Replaces the resource: kms_key_id forces a new domain in Terraform, so adding it to this domain's block plans a replacement by an empty one; set a customer managed key in the console or CLI.

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  encrypt_at_rest {
    enabled = true
  }
}