BYOK for existing Elastic Cloud deployments is now GA

Elastic Cloud Hosted now generally supports bringing a customer-managed encryption key to existing running deployments without recreating them, using the console or a dedicated API endpoint and maintaining accessibility during the transition. Elastic replaces instances one at a time with encrypted versions while Elasticsearch relocates shards, supporting AWS KMS, Azure Key Vault, and Google Cloud KMS for Enterprise subscription customers whose keys match the deployment’s cloud provider and regions. Key rotations are automatically recognized, while revoking key access locks data within 30 minutes and can effectively crypto-shred it if access is not restored. The migration creates a new encrypted snapshot bucket, so prior snapshots are no longer available through the default repository and organizations should address retention needs first. Elastic recommends high-availability deployments with replicas, testing on smaller clusters, allowing the process to finish uninterrupted, and planning for potentially lengthy migrations and cloud transfer costs on large deployments. Once enabled, the customer-managed key cannot currently be changed or removed, although key rotation within the provider’s KMS remains supported.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.