# EncryptionAtRestOptions

Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service (KMS) key to use.

Can only be used to create a new domain,
not update an existing one. Requires Elasticsearch version 5.1 or later or OpenSearch version 1.0 or later.

- Source: [`aws-opensearchservice/lib/domain.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts#L255)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
const domain = new Domain(this, 'Domain', {
  version: EngineVersion.OPENSEARCH_1_0,
  enforceHttps: true,
  nodeToNodeEncryption: true,
  encryptionAtRest: {
    enabled: true,
  },
  fineGrainedAccessControl: {
    masterUserName: 'master-user',
    samlAuthenticationEnabled: true,
    samlAuthenticationOptions: {
      idpEntityId: 'entity-id',
      idpMetadataContent: 'metadata-content-with-quotes-escaped',
    },
  },
});
```

## Properties

- `enabled`: boolean — Specify true to enable encryption at rest.

  **Default:** encryption at rest is disabled.

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — Supply if using KMS key for encryption at rest.

  **Default:** uses default aws/es KMS key.