# EncryptionAtRestOptions

Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service (KMS) key to use.

Can only be used to create a new domain,
not update an existing one. Requires Elasticsearch version 5.1 or later.

- Source: [`aws-elasticsearch/lib/domain.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-elasticsearch/lib/domain.ts#L375)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
const domain = new es.Domain(this, 'Domain', {
  version: es.ElasticsearchVersion.V7_1,
  enforceHttps: true,
  nodeToNodeEncryption: true,
  encryptionAtRest: {
    enabled: true,
  },
  fineGrainedAccessControl: {
    masterUserName: 'master-user',
  },
});

const masterUserPassword = domain.masterUserPassword;
```

## Properties

- `enabled`: boolean — use opensearchservice module instead

  **Default:** encryption at rest is disabled.

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — use opensearchservice module instead

  **Default:** uses default aws/es KMS key.