AWS CDK Reference

Appearance

v2.274.0

EncryptionAtRestOptions Struct ​

Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service (KMS) key to use.

Can only be used to create a new domain, not update an existing one. Requires Elasticsearch version 5.1 or later.

Source
aws-elasticsearch/lib/domain.ts
Type last changed
v2.224.0 · 13 Nov 2025

Example ​

ts
const domain = new es.Domain(this, 'Domain', {
  version: es.ElasticsearchVersion.V7_1,
  enforceHttps: true,
  nodeToNodeEncryption: true,
  encryptionAtRest: {
    enabled: true,
  },
  fineGrainedAccessControl: {
    masterUserName: 'master-user',
  },
});

const masterUserPassword = domain.masterUserPassword;

Properties ​

enabledoptionalbooleanenabledoptionalboolenabledoptionalBooleanEnabledoptionalboolEnabledoptional*booldeprecated#
use opensearchservice module instead

Default: encryption at rest is disabled.

kmsKeyoptionalIKeyRefkms_keyoptionalIKeyRefkmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRefdeprecated#
use opensearchservice module instead

Default: uses default aws/es KMS key.