All checks

Medium Elasticsearch · regional

Elasticsearch domains should have encryption at-rest enabled

Verifies that Elasticsearch domains have encryption at rest enabled on persistent volumes.

service: Elasticsearch
severity: Medium
scope: evaluated in every region

How to fix it

To create a new Elasticsearch domain with encryption at-rest enabled, follow these steps:

Open the Amazon Elasticsearch Service console at https://console.aws.amazon.com/es/.
Choose 'Create a new domain'.
Configure the domain as needed for your use case.
In the 'Set the domain access policy' section, ensure that 'Encryption at rest' is set to 'Enabled'.
Configure any other settings as necessary and choose 'Create'.
After the domain is created, migrate your data from the old domain to the new domain with encryption at-rest enabled.

See which of your accounts this check is failing on.

Book a demo