Encryption at Rest

[safiuddinr]

Elasticsearch cloud enterprise encryption at rest.
Elastic cloud enterprise does not implement encryption at rest out of the box. To ensure encryption at rest for all data managed by elastic cloud enterprise, the hosts running elastic cloud enterprise must be configured with a disk-level encryption, such as dm-crypt.
Note, configuring dm-crypt or similar technology is out of scope of the elastic cloud enterprise documentation and disk-related encryption.

Users can choose to use a second option for Elasticsearch cloud enterprise at rest. That second option is X-pack security.

X-pack security is a commercial offering by Elastic, it provides enterprise grade security features for Elasticsearch. X-pack enables data encryption at rest.

https://www.elastic.co/guide/en/x-pack/current/xpack-introduction.html

https://opster.com/guides/elasticsearch/security/x-pack/#Security-with-X-Pack-Elasticsearch

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/configuring-stack-security.html

[ddiabe]

Next steps: I recommend documenting this finding about elastic cloud enterprise not supporting encryption at rest out of the box and using X-pack security as another option for encryption at rest for users.