Back to Checks
aws

Amazon OpenSearch Service domain has encryption at rest enabled

opensearch_service_domains_encryption_at_rest_enabled
Service: opensearchSeverity: critical
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains are evaluated for encryption at rest using AWS KMS (AES-256) across stored data, including indexes, swap files, and automated snapshots.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted OpenSearch data can be read or copied if an attacker gains disk-level access, steals automated snapshots, or compromises the host. This jeopardizes confidentiality and enables tampering with stored indices, affecting integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_encryption_at_rest_enabled

Recommendation

Enable encryption at rest with AWS KMS, preferably using customer-managed keys.

  • Enforce least privilege key policies and restrict grants
  • Enable automatic key rotation and monitor KMS usage
  • Encrypt logs and any exported snapshots
  • Apply defense in depth with network and IAM controls

Remediation

CLI

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --encryption-at-rest-options Enabled=true

Terraform

# Terraform: Enable encryption at rest for an OpenSearch domain
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  encrypt_at_rest {
    enabled = true  # Critical: turns on encryption at rest for the domain
  }
}

NativeIaC

# CloudFormation: Enable encryption at rest for an OpenSearch domain
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      EncryptionAtRestOptions:
        Enabled: true  # Critical: turns on encryption at rest for the domain

Other

1In the AWS Console, go to OpenSearch Service > Domains and select your domain
2Click Actions > Edit security configuration
3Under Encryption, check Enable encryption of data at rest
4Keep the default AWS owned key (or select a KMS key if required)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_encryption_at_rest_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = (
                f"Opensearch domain {domain.name} has encryption at-rest enabled."
            )
            if not domain.encryption_at_rest:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} does not have encryption at-rest enabled."

            findings.append(report)

        return findings

References