Ensure that encryption of data at rest is enabled on Elasticsearch domains

The encryption of data at rest is a security feature that helps prevent unauthorized access to your data. When the feature is enabled, it encrypts sensitive information on your Elasticsearch domains and their storage systems such as Indices, Elasticsearch Logs, Swap files, automated snapshots and all other data in the application directory. The ElasticSearch at-rest encryption feature uses AWS KMS service to store and manage the encryption keys.

Risk Level: High
Cloud Entity: Amazon ElasticSearch service
CloudGuard Rule ID: D9.CFT.CRY.06
Covered by Spectral: Yes
Category: Analytics


AWS_Elasticsearch_Domain should have EncryptionAtRestOptions.Enabled=true


From CFT
Set AWS::Elasticsearch::Domain EncryptionAtRestOptions property to be true


  1. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html
  2. https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html

Amazon ElasticSearch service

Amazon Elasticsearch Service is a fully managed service that makes it easy for you to deploy, secure, and run Elasticsearch cost effectively at scale. You can build, monitor, and troubleshoot your applications using the tools you love, at the scale you need. The service provides support for open source Elasticsearch APIs, managed Kibana, integration with Logstash and other AWS services, and built-in alerting and SQL querying. Amazon Elasticsearch Service lets you pay only for what you use ��� there are no upfront costs or usage requirements. With Amazon Elasticsearch Service, you get the ELK stack you need, without the operational ov

Compliance Frameworks

  • AWS CloudFormation ruleset