AWS CDK Reference

Appearance

v2.275.0

EncryptionAtRestOptions Struct ​

Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service (KMS) key to use.

Can only be used to create a new domain, not update an existing one. Requires Elasticsearch version 5.1 or later or OpenSearch version 1.0 or later.

Source
aws-opensearchservice/lib/domain.ts
Type last changed
v2.224.0 · 13 Nov 2025

Example ​

ts
const domain = new Domain(this, 'Domain', {
  version: EngineVersion.OPENSEARCH_1_0,
  enforceHttps: true,
  nodeToNodeEncryption: true,
  encryptionAtRest: {
    enabled: true,
  },
  fineGrainedAccessControl: {
    masterUserName: 'master-user',
    samlAuthenticationEnabled: true,
    samlAuthenticationOptions: {
      idpEntityId: 'entity-id',
      idpMetadataContent: 'metadata-content-with-quotes-escaped',
    },
  },
});

Properties ​

enabledoptionalbooleanenabledoptionalboolenabledoptionalBooleanEnabledoptionalboolEnabledoptional*bool#
Specify true to enable encryption at rest.

Default: encryption at rest is disabled.

kmsKeyoptionalIKeyRefkms_keyoptionalIKeyRefkmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRef#
Supply if using KMS key for encryption at rest.

Default: uses default aws/es KMS key.