feat: ElasticSearch server-side encryption

packages/amplify-graphql-api-construct/src/internal/default-parameters.ts

@@ -17,6 +17,7 @@ export const defaultTranslationBehavior: TranslationBehavior = {
   enableAutoIndexQueryNames: true,
   respectPrimaryKeyAttributesOnConnectionField: true,
   enableSearchNodeToNodeEncryption: false,
+  enableSearchEncryptionAtRest: false,
   enableTransformerCfnOutputs: false,
   allowDestructiveGraphqlSchemaUpdates: false,
   replaceTableUponGsiUpdate: false,

packages/amplify-graphql-api-construct/src/types.ts

@@ -550,6 +550,8 @@ export interface TranslationBehavior {
 
   readonly enableSearchNodeToNodeEncryption: boolean;
 
+  readonly enableSearchEncryptionAtRest: boolean;
+
   /**
    * When enabled, internal cfn outputs which existed in Amplify-generated apps will continue to be emitted.
    * @default false

packages/amplify-graphql-searchable-transformer/src/cdk/create-searchable-domain.ts

@@ -12,6 +12,7 @@ export const createSearchableDomain = (
   parameterMap: Map<string, CfnParameter>,
   apiId: string,
   nodeToNodeEncryption: boolean,
+  encryptionAtRest: boolean,
 ): Domain => {
   const { OpenSearchEBSVolumeGB, OpenSearchInstanceType, OpenSearchInstanceCount } = ResourceConstants.PARAMETERS;
   const { OpenSearchDomainLogicalID } = ResourceConstants.RESOURCES;
@@ -26,6 +27,9 @@ export const createSearchableDomain = (
       volumeSize: parameterMap.get(OpenSearchEBSVolumeGB)?.valueAsNumber,
     },
     nodeToNodeEncryption,
+    encryptionAtRest: {
+      enabled: encryptionAtRest,
+    },
     zoneAwareness: {
       enabled: false,
     },

packages/amplify-graphql-searchable-transformer/src/cdk/create-streaming-lambda.ts

@@ -30,7 +30,7 @@ export const createLambda = (
     `functions/${OpenSearchStreamingLambdaFunctionLogicalID}.zip`,
     parameterMap.get(OpenSearchStreamingLambdaHandlerName)!.valueAsString,
     path.resolve(__dirname, '..', '..', 'lib', 'streaming-lambda.zip'),
-    Runtime.PYTHON_3_8,
+    Runtime.PYTHON_3_13,
     [
       LayerVersion.fromLayerVersionArn(
         scope,

packages/amplify-graphql-searchable-transformer/src/graphql-searchable-transformer.ts

@@ -314,6 +314,7 @@ export class SearchableModelTransformer extends TransformerPluginBase {
       parameterMap,
       context.api.apiId,
       context.transformParameters.enableSearchNodeToNodeEncryption,
+      context.transformParameters.enableSearchEncryptionAtRest,
     );
 
     const openSearchRole = createSearchableDomainRole(context, stack, parameterMap);

packages/amplify-graphql-transformer-core/src/transformer-context/transform-parameters.ts

@@ -27,4 +27,5 @@ export const defaultTransformParameters: TransformParameters = {
 
   // Search Params
   enableSearchNodeToNodeEncryption: false,
+  enableSearchEncryptionAtRest: false,
 };

packages/amplify-graphql-transformer-interfaces/src/transformer-context/transform-parameters.ts

@@ -31,4 +31,5 @@ export type TransformParameters = {
 
   // Search Params
   enableSearchNodeToNodeEncryption: boolean;
+  enableSearchEncryptionAtRest: boolean;
 };