AWS cloudformation elasticsearch encryption at rest (KMS encryption)

3
votes

AWS ElasticSearch supports encryption at rest via console and API. The boto api seems to have a facility for enabling this and use a custom KMS key. I couldn't find a way to configure this using cloudformation template. Is it not supported yet or am I missing it?

ElasticSearch cloudformation documentation:- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticsearch-domain.html

https://aws.amazon.com/about-aws/whats-new/2017/12/encryption-at-rest-now-available-on-amazon-elasticsearch-service/

4
amazon-web-serviceselasticsearchamazon-cloudformation
They just added it for S3 and DynamoDB so ES might be around the corner. – kichik
I answered this here: stackoverflow.com/questions/58410014/… Templates included. Hope that helps! – DC.Skells

4 Answers

1
votes

I learnt that the feature is not supported yet in cloudformation template. The console/APIs supports it.

0
votes

Yes As of today AWS CloudFormation doesn't support option to specify "Encryption at rest". besides its available with AWS CLI and aws sdks like java or boto3.

http://boto3.readthedocs.io/en/latest/reference/services/es.html

https://docs.aws.amazon.com/cli/latest/reference/es/create-elasticsearch-domain.html

0
votes

Found that we can use terraform to deploy aws resources with all the options needed (including encryption at rest). Below is documentation.

https://www.terraform.io/docs/providers/aws/r/elasticsearch_domain.html

Hope that helps.