Elasticcache should be encrypted at rest and in transit

aws es describe-elasticsearch-domain \
  --domain-name OLD_DOMAIN_NAME \
  > old-domain-config.json

aws es create-elasticsearch-domain \
  --domain-name NEW_DOMAIN_NAME \
  --elasticsearch-version 7.10 \
  --elasticsearch-cluster-config InstanceType=m5.large.elasticsearch,InstanceCount=2,ZoneAwarenessEnabled=true \
  --ebs-options EBSEnabled=true,VolumeType=gp3,VolumeSize=200 \
  --encryption-at-rest-options Enabled=true \
  --node-to-node-encryption-options Enabled=true \
  --domain-endpoint-options EnforceHTTPS=true,TLSecurityPolicy=Policy-Min-TLS-1-2-2019-07 \
  --access-policies file://access-policy.json

--encryption-at-rest-options Enabled=true,KmsKeyId=YOUR_KMS_KEY_ARN

aws es describe-elasticsearch-domain \
  --domain-name NEW_DOMAIN_NAME \
  --query "DomainStatus.Processing"

aws es describe-elasticsearch-domain \
  --domain-name NEW_DOMAIN_NAME \
  --query "DomainStatus.{AtRest:EncryptionAtRestOptions,NodeToNode:NodeToNodeEncryptionOptions,EndpointOptions:DomainEndpointOptions}"

curl -X POST "https://NEW_DOMAIN_ENDPOINT/_reindex?wait_for_completion=false" \
  -H 'Content-Type: application/json' \
  -d '{
    "source": {
      "remote": {
        "host": "https://OLD_DOMAIN_ENDPOINT"
      },
      "index": "old-index-name"
    },
    "dest": {
      "index": "new-index-name"
    }
  }'

aws es describe-elasticsearch-domain \
  --domain-name NEW_DOMAIN_NAME \
  --query "DomainStatus.Endpoints"

aws es delete-elasticsearch-domain \
  --domain-name OLD_DOMAIN_NAME

pip install boto3
aws configure  # or use env vars/instance role

import boto3

es = boto3.client("es")  # For OpenSearch service; still named "es" in boto3

domain_name = "your-domain-name"

response = es.describe_elasticsearch_domain(
    DomainName=domain_name
)

domain_status = response["DomainStatus"]

encrypt_at_rest = domain_status.get("EncryptionAtRestOptions", {}).get("Enabled")
node_to_node = domain_status.get("NodeToNodeEncryptionOptions", {}).get("Enabled")
endpoint_opts = domain_status.get("DomainEndpointOptions", {})
enforce_https = endpoint_opts.get("EnforceHTTPS")

print("Encrypt at rest:", encrypt_at_rest)
print("Node-to-node:", node_to_node)
print("Enforce HTTPS:", enforce_https)

SOURCE_DOMAIN = "your-domain-name"
TARGET_DOMAIN = "your-new-secure-domain-name"

es = boto3.client("es", region_name="us-east-1")  # choose your region

src = es.describe_elasticsearch_domain(DomainName=SOURCE_DOMAIN)["DomainStatus"]

ebs_opts = src.get("EBSOptions", {})
cluster_cfg = src.get("ElasticsearchClusterConfig", {})
vpc_options = src.get("VPCOptions", {})
access_policies = src.get("AccessPolicies", "{}")  # JSON string
snapshot_opts = src.get("SnapshotOptions", {})
engine_version = src.get("ElasticsearchVersion", "OpenSearch_1.3")  # or whatever you use

resp = es.create_elasticsearch_domain(
    DomainName=TARGET_DOMAIN,
    ElasticsearchVersion=engine_version,
    ElasticsearchClusterConfig=cluster_cfg,
    EBSOptions=ebs_opts,
    VPCOptions=vpc_options,  # omit if public domain
    SnapshotOptions=snapshot_opts,
    AccessPolicies=access_policies,
    EncryptionAtRestOptions={
        "Enabled": True,
        # Optionally specify a custom KMS key:
        # "KmsKeyId": "arn:aws:kms:region:account-id:key/key-id"
    },
    NodeToNodeEncryptionOptions={
        "Enabled": True
    },
    DomainEndpointOptions={
        "EnforceHTTPS": True,
        "TLSSecurityPolicy": "Policy-Min-TLS-1-2-2019-07"  # recommended
    }
)
print("Creating domain:", resp["DomainStatus"]["DomainName"])

import time

def wait_for_domain(domain):
    while True:
        status = es.describe_elasticsearch_domain(DomainName=domain)["DomainStatus"]
        if status["Processing"] is False:
            print("Domain ready:", domain)
            break
        print("Waiting for domain to be ready...")
        time.sleep(60)

wait_for_domain(TARGET_DOMAIN)

src_endpoint = src["Endpoints"]["vpc"] if "vpc" in src["Endpoints"] else src["Endpoint"]
tgt_status = es.describe_elasticsearch_domain(DomainName=TARGET_DOMAIN)["DomainStatus"]
tgt_endpoint = tgt_status["Endpoints"].get("vpc", tgt_status.get("Endpoint"))

from opensearchpy import OpenSearch

src_client = OpenSearch(
    hosts=[{"host": src_endpoint, "port": 443}],
    http_auth=("user", "password"),  # or IAM auth plugin, etc.
    use_ssl=True,
    verify_certs=True,
)

tgt_client = OpenSearch(
    hosts=[{"host": tgt_endpoint, "port": 443}],
    http_auth=("user", "password"),
    use_ssl=True,
    verify_certs=True,
)

# Example: reindex one index
body = {
  "source": {
    "remote": {
      "host": f"https://{src_endpoint}"
    },
    "index": "my-index"
  },
  "dest": {
    "index": "my-index"
  }
}

tgt_client.transport.perform_request("POST", "/_reindex", body=body, params={"wait_for_completion": "true"})

es.delete_elasticsearch_domain(DomainName=SOURCE_DOMAIN)

domain_name = "your-domain-name"

es.update_elasticsearch_domain_config(
    DomainName=domain_name,
    DomainEndpointOptions={
        "EnforceHTTPS": True,
        "TLSSecurityPolicy": "Policy-Min-TLS-1-2-2019-07"
    }
)
wait_for_domain(domain_name)

resource "aws_opensearch_domain" "THIS_DOMAIN" {
  domain_name = "YOUR_DOMAIN_NAME" # replace with your domain name

  engine_version = "OpenSearch_2.11" # replace with your required engine version

  cluster_config {
    instance_type = "m6g.large.search" # replace with your desired instance type
    # other cluster config as needed
  }

  # Enable encryption at rest (forces replacement if changed from false -> true)
  encrypt_at_rest {
    enabled    = true
    kms_key_id = "YOUR_KMS_KEY_ARN_OR_ID" # optional; omit to use AWS managed key
  }

  # Enable node-to-node encryption (in-transit inside the cluster; forces replacement if changed)
  node_to_node_encryption {
    enabled = true
  }

  # Enforce HTTPS for client connections (encryption in transit)
  domain_endpoint_options {
    enforce_https       = true
    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
  }

  # add/keep any other settings you already manage here (e.g., access_policies, vpc_options, etc.)
}