JA EN
shiichan

Amazon OpenSearch Service Adds Index-Level Encryption with Per-Tenant KMS Keys

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shii-chan!

AWS What's New aws.amazon.com

Here's great news if you want to protect multi-tenant data!

What was announced?

AWS What's New announced that Amazon OpenSearch Service now supports index-level encryption. You can encrypt each index at rest with its own AWS Key Management Service (AWS KMS) customer managed key.

The story so far

This builds on the existing encryption at rest capability. What's new is that, on the same domain, data with different ownership or sensitivity can sit under separate keys.

What changes

In a multi-tenant application, for example, you can encrypt each tenant's data with its own key. Keys can follow data owners even inside one domain!

Dive Deep

Here's how to get started:

  • When you create a new domain in the AWS Management Console or AWS CLI, set the encryption mode to Native and specify a customer managed key
  • Register additional keys with the domain
  • Use those keys to encrypt individual indexes

Availability and cost:

  • Domains must run OpenSearch version 3.3 or later
  • No additional charge (standard AWS KMS and OpenSearch Service charges apply)
  • Available in 14 AWS Regions

The Regions are:

  • US East (N. Virginia, Ohio)
  • US West (Oregon)
  • Canada (Central)
  • Asia Pacific (Mumbai, Seoul, Singapore, Sydney, Tokyo)
  • Europe (Frankfurt, Ireland, London, Paris)
  • South America (São Paulo)

See Index-level encryption in the Amazon OpenSearch Service Developer Guide for more.

Wrap-up

  • Each index can be encrypted with its own KMS customer managed key
  • Enable it by setting the encryption mode to Native when creating a new domain
  • Needs OpenSearch 3.3 or later, in 14 Regions
  • No additional charge (standard KMS and OpenSearch charges still apply)

If you run a multi-tenant search platform and want per-tenant keys, this one's for you!

Related posts