> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Opensearch encrypted at rest remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of enabling Encryption At Rest for AWS OpenSearch Service Domains, follow these step-by-step instructions using the AWS Management Console:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/](https://aws.amazon.com/)) and log in to your account.

        2. **Navigate to Amazon OpenSearch Service**: In the AWS Management Console, search for "OpenSearch Service" in the search bar at the top of the page and click on the service.

        3. **Select the OpenSearch Domain**: From the list of OpenSearch domains, select the domain for which you want to enable Encryption At Rest.

        4. **Click on the Domain Name**: Click on the name of the selected OpenSearch domain to open the domain details page.

        5. **Navigate to Security**: In the domain details page, navigate to the "Security" section in the left-hand menu.

        6. **Enable Encryption At Rest**: In the "Encryption At Rest" section, click on the "Edit" button to modify the encryption settings.

        7. **Enable Encryption**: In the encryption settings, select the option to enable Encryption At Rest. You can choose to use the AWS managed KMS key or provide your custom KMS key for encryption.

        8. **Save Changes**: After enabling Encryption At Rest and configuring the encryption settings as per your requirements, click on the "Save changes" button to apply the changes.

        9. **Monitor Encryption Status**: Once the changes are saved, monitor the status of Encryption At Rest for the OpenSearch domain to ensure that it is successfully enabled.

        By following these steps, you can remediate the misconfiguration of enabling Encryption At Rest for AWS OpenSearch Service Domains using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable encryption at rest for an Amazon OpenSearch Service domain in AWS using the AWS CLI, follow these steps:

        1. **Identify the OpenSearch Service domain**: First, you need to identify the OpenSearch Service domain for which you want to enable encryption at rest. You can list all the domains using the following AWS CLI command:
           ```
           aws opensearchservice list-domain-names
           ```

        2. **Enable encryption at rest**: Once you have identified the domain, you can enable encryption at rest by updating the domain configuration. Use the following AWS CLI command to update the domain configuration and enable encryption at rest:
           ```
           aws opensearchservice update-domain-config --domain-name <your-domain-name> --advanced-security-options Enabled=true,InternalUserDatabaseEnabled=true --node-to-node-encryption-options Enabled=true
           ```
           Replace `<your-domain-name>` with the actual name of your OpenSearch Service domain.

        3. **Monitor the domain**: After enabling encryption at rest, monitor the domain to ensure that the configuration change is successfully applied. You can check the status of the domain using the following AWS CLI command:
           ```
           aws opensearchservice describe-elasticsearch-domain --domain-name <your-domain-name> --query "DomainStatus"
           ```
           Replace `<your-domain-name>` with the actual name of your OpenSearch Service domain.

        4. **Verify encryption at rest**: Finally, verify that encryption at rest is enabled for the OpenSearch Service domain by checking the domain configuration. You can use the following AWS CLI command to describe the domain configuration:
           ```
           aws opensearchservice describe-elasticsearch-domain-config --domain-name <your-domain-name> --query "DomainConfig.ElasticsearchClusterConfig.NodeToNodeEncryptionOptions"
           ```
           Replace `<your-domain-name>` with the actual name of your OpenSearch Service domain.

        By following these steps, you can remediate the misconfiguration and enable encryption at rest for an Amazon OpenSearch Service domain in AWS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of enabling Encryption At Rest for AWS OpenSearch Service domains using Python, you can use the AWS SDK for Python (Boto3) to update the domain configuration. Here are the step-by-step instructions to enable Encryption At Rest for an AWS OpenSearch Service domain:

        1. Install Boto3: If you haven't already installed the Boto3 library, you can do so using pip:

        ```bash theme={null}
        pip install boto3
        ```

        2. Configure AWS Credentials: Make sure you have your AWS credentials configured either by setting environment variables or using AWS CLI `aws configure`.

        3. Write Python script: Create a Python script with the following code to enable Encryption At Rest for the OpenSearch Service domain. Replace `your-domain-name` with the actual domain name of your OpenSearch Service domain:

        ```python theme={null}
        import boto3

        def enable_encryption_at_rest(domain_name):
            client = boto3.client('es')

            response = client.update_elasticsearch_domain_config(
                DomainName=domain_name,
                ElasticsearchClusterConfig={
                    'DedicatedMasterEnabled': False,
                    'InstanceCount': 1,
                    'InstanceType': 't2.small.elasticsearch',
                    'ZoneAwarenessEnabled': False
                },
                EBSOptions={
                    'EBSEnabled': True,
                    'VolumeType': 'gp2',
                    'VolumeSize': 10
                },
                EncryptionAtRestOptions={
                    'Enabled': True
                }
            )

            print("Encryption at rest has been enabled for the OpenSearch Service domain: {}".format(domain_name))

        if __name__ == "__main__":
            domain_name = 'your-domain-name'
            enable_encryption_at_rest(domain_name)
        ```

        4. Run the script: Execute the Python script to enable Encryption At Rest for the specified OpenSearch Service domain:

        ```bash theme={null}
        python enable_encryption_at_rest.py
        ```

        After running the script, Encryption At Rest should be enabled for the specified AWS OpenSearch Service domain.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_opensearch_domain" "THIS_DOMAIN" {
          domain_name = "YOUR_DOMAIN_NAME" # replace with your OpenSearch domain name

          # ...other required configuration (cluster_config, ebs_options, etc.)

          # Enable encryption at rest using the AWS-owned KMS key (matches the CLI fix)
          encryption_at_rest_options {
            enabled = true

            # OPTIONAL: to use a customer-managed KMS key instead of the AWS-owned key,
            # uncomment and set this:
            # kms_key_id = "YOUR_KMS_KEY_ARN_OR_ID"
          }
        }
        ```

        Enabling `encryption_at_rest_options.enabled = true` is irreversible on this domain and may trigger a blue/green deployment; Terraform will treat this as an in-place update, but AWS will not allow you to turn it back off later.

        For verification, `terraform plan` should show an in-place update (`~ aws_opensearch_domain.THIS_DOMAIN`) with `encryption_at_rest_options.enabled` changing from `false` (or `null`) to `true` (and optionally adding `kms_key_id` if you set it).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>