Bring Your Own Key (BYOK) for Encryption at Rest

Elastic Cloud now supports Bring Your Own Key (BYOK) for encryption at rest with AWS KMS, Azure Key Vault, and Google Cloud KMS for existing deployments. This allows users to add a customer-managed encryption key to a running deployment in place, without recreating it. The process involves replacing each instance with an encrypted one, moving data with native Elasticsearch shard allocation. Snapshots taken before the transition are not available through the new repository, but a fresh snapshot is taken automatically. Key rotations are picked up automatically, and revoking the key locks the deployment's data. Considerations include running on highly available deployments, understanding snapshot history changes, testing on smaller deployments, and potential data transfer costs.