diff --git a/.changelog/3421.txt b/.changelog/3421.txt
new file mode 100644
index 0000000000..208b7318bb
--- /dev/null
+++ b/.changelog/3421.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/tencentcloud_elasticsearch_instance: support protocol
+```
diff --git a/tencentcloud/services/es/resource_tc_elasticsearch_instance.go b/tencentcloud/services/es/resource_tc_elasticsearch_instance.go
index 1005f3ae4b..8797424cd9 100644
--- a/tencentcloud/services/es/resource_tc_elasticsearch_instance.go
+++ b/tencentcloud/services/es/resource_tc_elasticsearch_instance.go
@@ -303,6 +303,12 @@ func ResourceTencentCloudElasticsearchInstance() *schema.Resource {
 					},
 				},
 			},
+			"protocol": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: "Create an https cluster, default is http.",
+			},
 			// computed
 			"elasticsearch_domain": {
 				Type:        schema.TypeString,
@@ -445,6 +451,9 @@ func resourceTencentCloudElasticsearchInstanceCreate(d *schema.ResourceData, met
 			request.NodeInfoList = append(request.NodeInfoList, &info)
 		}
 	}
+	if v, ok := d.GetOk("protocol"); ok {
+		request.Protocol = helper.String(v.(string))
+	}
 	//internal version: replace reqTag begin, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
 	//internal version: replace reqTag end, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
 	instanceId := ""
@@ -709,6 +718,7 @@ func resourceTencentCloudElasticsearchInstanceRead(d *schema.ResourceData, meta
 	_ = d.Set("create_time", instance.CreateTime)
 	_ = d.Set("kibana_public_access", instance.KibanaPublicAccess)
 	_ = d.Set("kibana_private_access", instance.KibanaPrivateAccess)
+	_ = d.Set("protocol", instance.Protocol)
 
 	multiZoneInfos := make([]map[string]interface{}, 0, len(instance.MultiZoneInfo))
 	for _, item := range instance.MultiZoneInfo {
@@ -807,6 +817,14 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
 		client: meta.(tccommon.ProviderMeta).GetAPIV3Conn(),
 	}
 
+	immutableArgs := []string{"protocol"}
+
+	for _, v := range immutableArgs {
+		if d.HasChange(v) {
+			return fmt.Errorf("argument `%s` cannot be changed", v)
+		}
+	}
+
 	d.Partial(true)
 
 	if d.HasChange("instance_name") {
diff --git a/tencentcloud/services/es/resource_tc_elasticsearch_instance_test.go b/tencentcloud/services/es/resource_tc_elasticsearch_instance_test.go
index b5a6428589..9564088eb4 100644
--- a/tencentcloud/services/es/resource_tc_elasticsearch_instance_test.go
+++ b/tencentcloud/services/es/resource_tc_elasticsearch_instance_test.go
@@ -233,6 +233,23 @@ func TestAccTencentCloudElasticsearchInstanceResource_publicAccess(t *testing.T)
 	})
 }
 
+func TestAccTencentCloudElasticsearchInstanceResource_https(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { tcacctest.AccPreCheck(t) },
+		Providers:    tcacctest.AccProviders,
+		CheckDestroy: testAccCheckElasticsearchInstanceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccElasticsearchInstanceKibanaPublicAccessHttps,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckElasticsearchInstanceExists("tencentcloud_elasticsearch_instance.es_kibana"),
+					resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.es_kibana", "protocol", "https"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckElasticsearchInstanceDestroy(s *terraform.State) error {
 	logId := tccommon.GetLogId(tccommon.ContextNil)
 	ctx := context.WithValue(context.TODO(), tccommon.LogIdKey, logId)
@@ -526,3 +543,33 @@ resource "tencentcloud_elasticsearch_instance" "es_kibana" {
 	}
   }
 `
+
+const testAccElasticsearchInstanceKibanaPublicAccessHttps = tcacctest.DefaultEsVariables + `
+resource "tencentcloud_elasticsearch_instance" "es_kibana" {
+	instance_name        = "tf-ci-test-kibana"
+	availability_zone    = var.availability_zone
+	version              = "7.10.1"
+	vpc_id               = var.vpc_id
+	subnet_id            = var.subnet_id
+	password             = "Test1234"
+	license_type         = "basic"
+	basic_security_type  = 2
+	public_access = "OPEN"
+	protocol = "https"
+	es_acl {
+	  white_list = [
+		"127.0.0.2"
+	  ]
+	}
+	es_public_acl {
+	  white_ip_list = [
+		"127.0.0.2"
+	  ]
+	}
+  
+	node_info_list {
+	  node_num  = 2
+	  node_type = "ES.S1.MEDIUM4"
+	}
+  }
+`
diff --git a/website/docs/r/elasticsearch_instance.html.markdown b/website/docs/r/elasticsearch_instance.html.markdown
index d37af4938f..69ae7862e1 100644
--- a/website/docs/r/elasticsearch_instance.html.markdown
+++ b/website/docs/r/elasticsearch_instance.html.markdown
@@ -177,6 +177,7 @@ The following arguments are supported:
 * `kibana_public_access` - (Optional, String) Kibana public network access status. Valid values are `OPEN` and `CLOSE`.
 * `license_type` - (Optional, String) License type. Valid values are `oss`, `basic` and `platinum`. The default value is `platinum`.
 * `multi_zone_infos` - (Optional, List, ForceNew) Details of AZs in multi-AZ deployment mode (which is required when deploy_mode is `1`).
+* `protocol` - (Optional, String) Create an https cluster, default is http.
 * `public_access` - (Optional, String) ES cluster public network access status. Valid values are `OPEN` and `CLOSE`. Cannot be changed at the same time as `es_acl`.
 * `renew_flag` - (Optional, String, ForceNew) When enabled, the instance will be renew automatically when it reach the end of the prepaid tenancy. Valid values are `RENEW_FLAG_AUTO` and `RENEW_FLAG_MANUAL`. NOTE: it only works when charge_type is set to `PREPAID`.
 * `subnet_id` - (Optional, String, ForceNew) The ID of a VPC subnetwork. When create multi-az es, this parameter must be omitted or `-`.