OpenSearch domain should have encryption at rest enabled

What it checks

OpenSearch domain: encryption at rest is not enabled.

Where it applies

Terraform: aws_opensearch_domain, aws_elasticsearch_domain

CloudFormation: AWS::OpenSearchService::Domain, AWS::Elasticsearch::Domain

How to fix it

1. Set encrypt_at_rest { enabled = true }. Note: cannot be enabled on a running domain — requires domain recreation with snapshot restore.

Frameworks

• AWS FSBP Opensearch.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules