What Happened
On October 12, 2026, Amazon OpenSearch Service announced index-level encryption at rest. On domains running OpenSearch 3.3 or later, individual indexes can use separate AWS KMS customer managed keys—for example, one key per tenant. The feature is available in 14 AWS Regions across the Americas, Asia Pacific, and Europe. There is no additional feature charge, but standard OpenSearch Service and AWS KMS charges apply. [1]
Why It Matters to Businesses
Teams running multiple tenants on one domain can now assign different encryption keys to their indexes instead of relying on a single domain-wide key. That gives businesses a more granular way to manage keys for tenant data. It does not replace index permissions, tenant-aware application controls or decisions about whether tenants should share infrastructure. [1]
Kimbodo Engineering Perspective
Per-index keys are useful when tenant-level key ownership is a real requirement, but they add operational work: keys must be mapped to indexes, access must be maintained, and key changes must be tested. We would use them alongside authorization controls, not present encryption at rest as complete tenant isolation.
How We Would Implement It
- Confirm the target Region and that the domain will run OpenSearch 3.3 or later. [1]
- For a new domain, select Native encryption mode and specify a customer managed KMS key through the AWS Management Console or CLI. Register additional keys for indexes that require separate encryption keys. [1]
- Maintain an explicit tenant-to-index-to-key mapping, provision the required key access, and test index creation and reads before onboarding tenants.
Risks, Costs and Security
More keys mean more key policies, lifecycle decisions and failure scenarios to manage. Validate how key access changes affect production operations before using them as a tenant offboarding control. Budget for standard AWS KMS and OpenSearch Service charges; the index-level encryption feature itself has no additional charge. [1]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
