--- title: BYOK for existing Elastic Cloud deployments is now GA description: Bring your own key (BYOK) support for Elastic Cloud Hosted is now generally available for existing deployments, not just new ones. Administrators can add a... canonical: https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BYOK for existing Elastic Cloud deployments is now GA | daily.dev og:description: Bring your own key (BYOK) support for Elastic Cloud Hosted is now generally available for existing deployments, not just new ones. Administrators can add a... og:url: https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk og:image: https://api.daily.dev/og/posts/sUAhFmZTk.png og:image:alt: BYOK for existing Elastic Cloud deployments is now GA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BYOK for existing Elastic Cloud deployments is now GA **[elastic](https://daily.dev/sources/elastic)** · 9 min read · 0 upvotes · 0 comments ## Summary Bring your own key (BYOK) support for Elastic Cloud Hosted is now generally available for existing deployments, not just new ones. Administrators can add a customer-managed encryption key to a running deployment via the console or API, and Elastic Cloud applies a plan change that re-encrypts each instance in place using native shard allocation, keeping the deployment accessible throughout. Supported KMS providers remain AWS KMS, Azure Key Vault, and Google Cloud KMS. Key considerations include needing an Enterprise subscription, high-availability configuration recommended, pre-migration snapshots not carrying over to the new encrypted bucket, inability to later change or remove the key, and potential multi-hour migrations for large deployments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can I enable BYOK encryption on an Elastic Cloud deployment that's already running, without recreating it? Yes, Elastic Cloud Hosted now supports adding a customer-managed encryption key to a running deployment in place. Elastic Cloud applies a plan change that replaces each instance with an encrypted one, moving data via native Elasticsearch shard allocation, keeping the deployment accessible throughout. This requires an Enterprise subscription and was previously only possible by creating a new deployment. _daily.dev surfaces updates like this for teams planning encryption rollouts across their Elastic Cloud fleet._ ### What happens to my existing snapshots when I enable BYOK on an Elastic Cloud deployment? Existing snapshots are not transferred to the new encrypted bucket and become unavailable through the found-snapshots repository after the transition. The migration automatically takes one fresh snapshot onto the new encrypted bucket as its final step, but any retention or compliance obligations tied to pre-migration snapshots must be addressed beforehand since this step cannot be undone. _Developers weighing compliance tradeoffs before a migration often track such caveats via daily.dev._ ### Which key management services work with BYOK on Elastic Cloud Hosted deployments? AWS KMS, Azure Key Vault, and Google Cloud KMS are all supported, matching the cloud provider the deployment runs on. The key must be available in every region the deployment uses, and for Google Cloud specifically it must be on a single-region key ring since multi-region key rings are rejected. _daily.dev helps engineers comparing KMS options stay current on provider-specific constraints._ ## Similar posts on daily.dev - [Bring Your Own Key \(BYOK\): AWS IAM Identity Center Adopts CMKs to Meet Enterprise Compliance Needs](https://daily.dev/posts/bring-your-own-key-byok-aws-iam-identity-center-adopts-cmks-to-meet-enterprise-compliance-needs-xbvookuzs) · InfoQ · 0 upvotes · 0 comments - [Take control of your encryption keys with Bring Your Own Key on AWS](https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q) · Dynatrace · 0 upvotes · 0 comments - [What is Bring Your Own Encryption \(BYOE\)?](https://daily.dev/posts/what-is-bring-your-own-encryption-byoe--yh4fqrkpx) · Security Boulevard · 0 upvotes · 0 comments - [How to set up BYOK in Kilo Gateway for DeepSeek, AWS Bedrock, MiniMax, Z.ai, and 15\+ more providers](https://daily.dev/posts/how-to-set-up-byok-in-kilo-gateway-for-deepseek-aws-bedrock-minimax-z-ai-and-15-more-providers-jujf8mt5d) · Kilo Blog · 0 upvotes · 0 comments - [GitHub Copilot bring your own key \(BYOK\) enhancements](https://daily.dev/posts/github-copilot-bring-your-own-key-byok-enhancements-ykxsomuaw) · GitHub Changelog · 1 upvotes · 0 comments --- Tags: [#elk](https://daily.dev/tags/elk) [View this post on daily.dev](https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BYOK for existing Elastic Cloud deployments is now GA","url":"https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk"},"datePublished":"2026-10-01T18:01:41.979Z","dateModified":"2026-10-01T18:15:00.319Z","description":"Bring your own key (BYOK) support for Elastic Cloud Hosted is now generally available for existing deployments, not just new ones. Administrators can add a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a15a1e485666d16ac308f5f05cf0c80d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a15a1e485666d16ac308f5f05cf0c80d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"elastic","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"elastic","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b9f4b44c864c42f68aa7f164715da8b4","url":"https://daily.dev/sources/elastic"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"elk","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"elastic","item":"https://daily.dev/sources/elastic"},{"@type":"ListItem","position":3,"name":"BYOK for existing Elastic Cloud deployments is now GA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk#faq","mainEntity":[{"@type":"Question","name":"Can I enable BYOK encryption on an Elastic Cloud deployment that's already running, without recreating it?","acceptedAnswer":{"@type":"Answer","text":"Yes, Elastic Cloud Hosted now supports adding a customer-managed encryption key to a running deployment in place. Elastic Cloud applies a plan change that replaces each instance with an encrypted one, moving data via native Elasticsearch shard allocation, keeping the deployment accessible throughout. This requires an Enterprise subscription and was previously only possible by creating a new deployment. daily.dev surfaces updates like this for teams planning encryption rollouts across their Elastic Cloud fleet."}},{"@type":"Question","name":"What happens to my existing snapshots when I enable BYOK on an Elastic Cloud deployment?","acceptedAnswer":{"@type":"Answer","text":"Existing snapshots are not transferred to the new encrypted bucket and become unavailable through the found-snapshots repository after the transition. The migration automatically takes one fresh snapshot onto the new encrypted bucket as its final step, but any retention or compliance obligations tied to pre-migration snapshots must be addressed beforehand since this step cannot be undone. Developers weighing compliance tradeoffs before a migration often track such caveats via daily.dev."}},{"@type":"Question","name":"Which key management services work with BYOK on Elastic Cloud Hosted deployments?","acceptedAnswer":{"@type":"Answer","text":"AWS KMS, Azure Key Vault, and Google Cloud KMS are all supported, matching the cloud provider the deployment runs on. The key must be available in every region the deployment uses, and for Google Cloud specifically it must be on a single-region key ring since multi-region key rings are rejected. daily.dev helps engineers comparing KMS options stay current on provider-specific constraints."}}]} ```