> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Es encrypted with cmks remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step by step instructions to remediate the Elasticsearch Domain Should Be Encrypted with KMS CMKs on AWS:

        1. Login to your AWS console and navigate to the Elasticsearch service.

        2. Select the Elasticsearch domain that needs to be remediated.

        3. Click on the "Configure" button in the "Security" section.

        4. In the "Encryption" section, select the "KMS" option.

        5. Select the appropriate KMS CMK from the list of available keys. If you don't have a KMS CMK, you can create one by clicking the "Create a new key" button.

        6. Once you have selected the KMS CMK, click the "Save changes" button to apply the encryption.

        7. Wait for the changes to take effect. This may take a few minutes.

        8. Verify that the Elasticsearch domain is now encrypted with the selected KMS CMK. You can do this by checking the "Encryption" section in the Elasticsearch domain's configuration.

        That's it! You have successfully remediated the Elasticsearch Domain Should Be Encrypted with KMS CMKs issue on AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Elasticsearch Domain misconfiguration in AWS using AWS CLI, you can follow these steps:

        1. Identify the Elasticsearch domain that needs to be encrypted with KMS CMKs.

        2. Create a KMS Customer Master Key (CMK) if you don't already have one.

        3. Enable AWS Key Management Service (KMS) encryption for the Elasticsearch domain using the following command:

        ```
        aws es update-elasticsearch-domain-config --domain-name <your-domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<your-KMS-CMK-ARN>
        ```

        Replace `<your-domain-name>` with the name of your Elasticsearch domain and `<your-KMS-CMK-ARN>` with the ARN of the KMS CMK you want to use for encryption.

        4. Verify that the Elasticsearch domain is encrypted with KMS CMKs by running the following command:

        ```
        aws es describe-elasticsearch-domain --domain-name <your-domain-name> --query 'DomainStatus.EncryptionAtRestOptions.Status'
        ```

        If the output is `ENABLED`, it means that the Elasticsearch domain is encrypted with KMS CMKs.

        5. Repeat the above steps for all Elasticsearch domains that need to be encrypted with KMS CMKs.

        Note: Enabling KMS encryption for an Elasticsearch domain may cause a temporary outage as the domain is reconfigured. It is recommended to perform this during a maintenance window.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Elasticsearch Domain should be encrypted with KMS CMKs misconfiguration for AWS using python, you can follow the below steps:

        1. First, you need to identify the Elasticsearch Domain that is not encrypted with KMS CMKs. You can use the following AWS CLI command to get the list of Elasticsearch domains:

        ```
        aws es list-domain-names
        ```

        2. Once you have identified the Elasticsearch Domain, you need to enable encryption using KMS CMKs. You can use the following AWS CLI command to enable encryption:

        ```
        aws es update-elasticsearch-domain-config --domain-name <domain-name> --encryption-at-rest-options Enabled=true,KmsKeyId=<kms-key-id>
        ```

        Replace `<domain-name>` with the name of your Elasticsearch Domain and `<kms-key-id>` with the ID of the KMS CMK that you want to use for encryption.

        3. Verify that the Elasticsearch Domain is encrypted with KMS CMKs. You can use the following AWS CLI command to get the Elasticsearch Domain configuration:

        ```
        aws es describe-elasticsearch-domain --domain-name <domain-name>
        ```

        This command will return the Elasticsearch Domain configuration, which should include the `EncryptionAtRestOptions` parameter with the value `Enabled=true` and `KmsKeyId=<kms-key-id>`.

        4. Finally, you can confirm that the Elasticsearch Domain is encrypted with KMS CMKs by checking the AWS KMS console. The KMS CMK that you specified in step 2 should have been used to encrypt the Elasticsearch Domain.

        Note: You can use the AWS SDK for Python (Boto3) to automate these steps.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # KMS CMK for the Elasticsearch domain
        resource "aws_kms_key" "ES_DOMAIN_KMS_KEY" {
          description             = "KMS CMK for Elasticsearch domain ENCRYPTED_ES_DOMAIN_NAME"
          deletion_window_in_days = 30

          # Optional: tighten the policy further as needed. This simple policy allows the
          # account root full control and lets Elasticsearch use the key for encryption.
          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Sid      = "EnableRootPermissions"
                Effect   = "Allow"
                Principal = {
                  AWS = "arn:aws:iam::ACCOUNT_ID:root"        # replace ACCOUNT_ID
                }
                Action   = "kms:*"
                Resource = "*"
              },
              {
                Sid      = "AllowElasticsearchUseOfTheKey"
                Effect   = "Allow"
                Principal = {
                  Service = "es.amazonaws.com"
                }
                Action = [
                  "kms:Encrypt",
                  "kms:Decrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*",
                  "kms:DescribeKey"
                ]
                Resource = "*"
              }
            ]
          })
        }

        # Elasticsearch domain with encryption-at-rest using the CMK
        resource "aws_elasticsearch_domain" "ENCRYPTED_ES_DOMAIN" {
          domain_name = "ENCRYPTED_ES_DOMAIN_NAME" # replace with your ES domain name

          # ... your existing cluster_config, ebs_options, vpc_options, etc. ...

          encryption_at_rest {
            enabled   = true
            kms_key_id = aws_kms_key.ES_DOMAIN_KMS_KEY.arn
          }
        }
        ```

        Enabling `encryption_at_rest` or changing `kms_key_id` on an existing `aws_elasticsearch_domain` forces resource replacement in Terraform; this recreates the domain and you must plan for data migration and potential downtime. AWS also makes encryption-at-rest irreversible and, if the domain is already encrypted (e.g., with an AWS-managed key), you cannot change the KMS key without creating a new domain and migrating data.

        For verification, `terraform plan` should show creation of `aws_kms_key.ES_DOMAIN_KMS_KEY` and either:

        * an update to add `encryption_at_rest.enabled = true` and `kms_key_id = ...` (if Terraform/provider allows in-place), or
        * a destroy/create cycle (replacement) of `aws_elasticsearch_domain.ENCRYPTED_ES_DOMAIN` with the new `encryption_at_rest` block configured.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>