Bring your own key to existing Elastic Cloud deployments

Add a customer-managed encryption key to a running deployment, in place, without recreating it. Bring your own key (BYOK) for existing deployments is now generally available on Elastic Cloud Hosted. You can add a customer-managed encryption key to a deployment that is already running, from the Elastic Cloud console or the API, with the deployment staying accessible throughout. Until now, the key could only be set when the deployment was created, which meant a key management requirement arriving later turned into a deployment migration. Earlier in this series, we covered the foundational concepts of encryption at rest and walked through how to bring your own key to Elastic Cloud Hosted deployments with AWS KMS, Azure Key Vault, and Google Cloud KMS. The scope was limited to new deployments. We have now expanded the scope to improve usability by including existing ones. This blog covers what changed, how the in-place transition works, and what to weigh before you encrypt a production deployment. Customer-managed keys matter most to organizations with large, established footprints and with compliance obligations that specify who holds the key and how quickly it can be revoked. Financial services and the public sector are the clearest examples. Those are…