OpenSearch domain has encryption at rest enabled

Check ID: opensearch_service_domains_encryption_at_rest_enabled
Provider: AWS
Service: opensearch
Severity: CRITICAL
Categories: encryption
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains are evaluated for encryption at rest using AWS KMS (AES-256) across stored data, including indexes, swap files, and automated snapshots.

Risk

Unencrypted OpenSearch data can be read or copied if an attacker gains disk-level access, steals automated snapshots, or compromises the host. This jeopardizes confidentiality and enables tampering with stored indices, affecting integrity.

Recommendation

Enable encryption at rest with AWS KMS, preferably using customer-managed keys.

Enforce least privilege key policies and restrict grants
Enable automatic key rotation and monitor KMS usage
Encrypt logs and any exported snapshots
Apply defense in depth with network and IAM controls

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --encryption-at-rest-options Enabled=true

# Terraform: Enable encryption at rest for an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  encrypt_at_rest {
    enabled = true  # Critical: turns on encryption at rest for the domain
  }
}

# CloudFormation: Enable encryption at rest for an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      EncryptionAtRestOptions:
        Enabled: true  # Critical: turns on encryption at rest for the domain

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_encryption_at_rest_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain sends slow logs to CloudWatch Logs OpenSearch domain has 3+ data nodes and Zone Awareness

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires