include::../opensearch_description.adoc[]

include::../ask-yourself.adoc[]

include::../opensearch_recommended.adoc[]

== Sensitive Code Example

For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.Domain.html[aws-cdk-lib.aws_opensearchservice.Domain]:

[source,javascript]
----
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';

const exampleDomain = new opensearchservice.Domain(this, 'ExampleDomain', {
  version: EngineVersion.OPENSEARCH_1_3,
}); // Sensitive, encryption must be explicitly enabled
----

For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.CfnDomain.html[aws-cdk-lib.aws_opensearchservice.CfnDomain]:

[source,javascript]
----
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';

const exampleCfnDomain = new opensearchservice.CfnDomain(this, 'ExampleCfnDomain', {
  engineVersion: 'OpenSearch_1.3',
}); // Sensitive, encryption must be explicitly enabled
----

== Compliant Solution

For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.Domain.html[aws-cdk-lib.aws_opensearchservice.Domain]:

[source,javascript]
----
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';

const exampleDomain = new opensearchservice.Domain(this, 'ExampleDomain', {
  version: EngineVersion.OPENSEARCH_1_3,
  encryptionAtRest: {
    enabled: true,
  },
});
----

For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.CfnDomain.html[aws-cdk-lib.aws_opensearchservice.CfnDomain]:

[source,javascript]
----
import { aws_opensearchservice as opensearchservice } from 'aws-cdk-lib';

const exampleCfnDomain = new opensearchservice.CfnDomain(this, 'ExampleCfnDomain', {
  engineVersion: 'OpenSearch_1.3',
  encryptionAtRestOptions: {
    enabled: true,
  },
});
----


include::../opensearch_see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

For CfnDomain:

* If `encryptionAtRestOptions.enabled` is explicitly set to `false`: Make sure that using unencrypted {OpenSearch|Elasticsearch} domains is safe here.
* In any other case: Omitting `encryptionAtRestOptions` causes encryption of data at rest to be disabled for this {OpenSearch|Elasticsearch} domain. Make sure it is safe here.

For Domain:

* If `encryptionAtRest.enabled` is explicitly set to `false`: Make sure that using unencrypted {OpenSearch|Elasticsearch} domains is safe here.
* In any other case: Omitting `encryptionAtRest` causes encryption of data at rest to be disabled for this {OpenSearch|Elasticsearch} domain. Make sure it is safe here.

=== Highlighting

For CfnDomain:
* Highlight the initializer function if it does not contain the third argument `props`.
* Highlight the `props` object if it does not contain the property `encryptionAtRestOptions`.
* Highlight the `encryptionAtRestOptions` property if it does not contain the property `enabled`.
* Highlight the `encryptionAtRestOptions.enabled` property if it is not set to `true`.

For Domain:
* Highlight the `props` object if it does not contain `encryptionAtRest`.
* Highlight the `encryptionAtRest` property if it does not contain the property `enabled`.
* Highlight the `encryptionAtRest.enabled` property if it is not set to `true`.

endif::env-github,rspecator-view[]