EncryptionAtRestOptions Struct
Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service (KMS) key to use.
Can only be used to create a new domain, not update an existing one. Requires Elasticsearch version 5.1 or later or OpenSearch version 1.0 or later.
Example
ts
const domain = new Domain(this, 'Domain', {
version: EngineVersion.OPENSEARCH_1_0,
enforceHttps: true,
nodeToNodeEncryption: true,
encryptionAtRest: {
enabled: true,
},
fineGrainedAccessControl: {
masterUserName: 'master-user',
samlAuthenticationEnabled: true,
samlAuthenticationOptions: {
idpEntityId: 'entity-id',
idpMetadataContent: 'metadata-content-with-quotes-escaped',
},
},
});
python
from aws_cdk.aws_opensearchservice import EncryptionAtRestOptions, AdvancedSecurityOptions, SAMLOptionsProperty
domain = Domain(self, "Domain",
version=EngineVersion.OPENSEARCH_1_0,
enforce_https=True,
node_to_node_encryption=True,
encryption_at_rest=EncryptionAtRestOptions(
enabled=True
),
fine_grained_access_control=AdvancedSecurityOptions(
master_user_name="master-user",
saml_authentication_enabled=True,
saml_authentication_options=SAMLOptionsProperty(
idp_entity_id="entity-id",
idp_metadata_content="metadata-content-with-quotes-escaped"
)
)
)
java
Domain domain = Domain.Builder.create(this, "Domain")
.version(EngineVersion.OPENSEARCH_1_0)
.enforceHttps(true)
.nodeToNodeEncryption(true)
.encryptionAtRest(EncryptionAtRestOptions.builder()
.enabled(true)
.build())
.fineGrainedAccessControl(AdvancedSecurityOptions.builder()
.masterUserName("master-user")
.samlAuthenticationEnabled(true)
.samlAuthenticationOptions(SAMLOptionsProperty.builder()
.idpEntityId("entity-id")
.idpMetadataContent("metadata-content-with-quotes-escaped")
.build())
.build())
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
var domain = new Domain(this, "Domain", new DomainProps {
Version = EngineVersion.OPENSEARCH_1_0,
EnforceHttps = true,
NodeToNodeEncryption = true,
EncryptionAtRest = new EncryptionAtRestOptions {
Enabled = true
},
FineGrainedAccessControl = new AdvancedSecurityOptions {
MasterUserName = "master-user",
SamlAuthenticationEnabled = true,
SamlAuthenticationOptions = new SAMLOptionsProperty {
IdpEntityId = "entity-id",
IdpMetadataContent = "metadata-content-with-quotes-escaped"
}
}
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
domain := awscdk.NewDomain(this, jsii.String("Domain"), &DomainProps{
Version: awscdk.EngineVersion_OPENSEARCH_1_0(),
EnforceHttps: jsii.Boolean(true),
NodeToNodeEncryption: jsii.Boolean(true),
EncryptionAtRest: &EncryptionAtRestOptions{
Enabled: jsii.Boolean(true),
},
FineGrainedAccessControl: &AdvancedSecurityOptions{
MasterUserName: jsii.String("master-user"),
SamlAuthenticationEnabled: jsii.Boolean(true),
SamlAuthenticationOptions: &SAMLOptionsProperty{
IdpEntityId: jsii.String("entity-id"),
IdpMetadataContent: jsii.String("metadata-content-with-quotes-escaped"),
},
},
})
Properties
enabledoptionalbooleanenabledoptionalboolenabledoptionalBooleanEnabledoptionalboolEnabledoptional*bool#Specify true to enable encryption at rest.
Default: encryption at rest is disabled.