1. Login to your AWS console and navigate to the Elasticsearch service.
2. Select the Elasticsearch domain that needs to be remediated.
3. Click on the “Configure” button in the “Security” section.
4. In the “Encryption” section, select the “KMS” option.
5. Select the appropriate KMS CMK from the list of available keys. If you don’t have a KMS CMK, you can create one by clicking the “Create a new key” button.
6. Once you have selected the KMS CMK, click the “Save changes” button to apply the encryption.
7. Wait for the changes to take effect. This may take a few minutes.
8. Verify that the Elasticsearch domain is now encrypted with the selected KMS CMK. You can do this by checking the “Encryption” section in the Elasticsearch domain’s configuration.

​

1. Identify the Elasticsearch domain that needs to be encrypted with KMS CMKs.
2. Create a KMS Customer Master Key (CMK) if you don’t already have one.
3. Enable AWS Key Management Service (KMS) encryption for the Elasticsearch domain using the following command:

aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<your-KMS-CMK-ARN>

4. Verify that the Elasticsearch domain is encrypted with KMS CMKs by running the following command:

aws es describe-elasticsearch-domain --domain-name <your-domain-name> --query 'DomainStatus.EncryptionAtRestOptions.Status'

5. Repeat the above steps for all Elasticsearch domains that need to be encrypted with KMS CMKs.

1. First, you need to identify the Elasticsearch Domain that is not encrypted with KMS CMKs. You can use the following AWS CLI command to get the list of Elasticsearch domains:

aws es list-domain-names

2. Once you have identified the Elasticsearch Domain, you need to enable encryption using KMS CMKs. You can use the following AWS CLI command to enable encryption:

aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<kms-key-id>

3. Verify that the Elasticsearch Domain is encrypted with KMS CMKs. You can use the following AWS CLI command to get the Elasticsearch Domain configuration:

aws es describe-elasticsearch-domain --domain-name <domain-name>

4. Finally, you can confirm that the Elasticsearch Domain is encrypted with KMS CMKs by checking the AWS KMS console. The KMS CMK that you specified in step 2 should have been used to encrypt the Elasticsearch Domain.

# KMS CMK for the Elasticsearch domain
resource "aws_kms_key" "ES_DOMAIN_KMS_KEY" {
  description             = "KMS CMK for Elasticsearch domain ENCRYPTED_ES_DOMAIN_NAME"
  deletion_window_in_days = 30

  # Optional: tighten the policy further as needed. This simple policy allows the
  # account root full control and lets Elasticsearch use the key for encryption.
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "EnableRootPermissions"
        Effect   = "Allow"
        Principal = {
          AWS = "arn:aws:iam::ACCOUNT_ID:root"        # replace ACCOUNT_ID
        }
        Action   = "kms:*"
        Resource = "*"
      },
      {
        Sid      = "AllowElasticsearchUseOfTheKey"
        Effect   = "Allow"
        Principal = {
          Service = "es.amazonaws.com"
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

# Elasticsearch domain with encryption-at-rest using the CMK
resource "aws_elasticsearch_domain" "ENCRYPTED_ES_DOMAIN" {
  domain_name = "ENCRYPTED_ES_DOMAIN_NAME" # replace with your ES domain name

  # ... your existing cluster_config, ebs_options, vpc_options, etc. ...

  encryption_at_rest {
    enabled   = true
    kms_key_id = aws_kms_key.ES_DOMAIN_KMS_KEY.arn
  }
}

• an update to add encryption_at_rest.enabled = true and kms_key_id = ... (if Terraform/provider allows in-place), or
• a destroy/create cycle (replacement) of aws_elasticsearch_domain.ENCRYPTED_ES_DOMAIN with the new encryption_at_rest block configured.