Elasticsearch domains should have at least three data nodes
Checks that the Elasticsearch domain has at least three data nodes and zone awareness turned on, so cluster operations continue when a node or an Availability Zone fails. A domain with three nodes in a single Availability Zone fails this check.
- service
- Elasticsearch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: Spreading the domain across more Availability Zones runs a blue/green deployment, so latency and rejected requests can rise while data copies; adding nodes alone does not.
In the console
OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration
- Number of nodes
- 3 or more, a multiple of the Availability Zone count so each zone holds the same number
- Availability Zones
- 3-AZ where the Region has three; a VPC domain needs a subnet in each zone
With the AWS CLI
aws es update-elasticsearch-domain-config --domain-name <domain-name> --elasticsearch-cluster-config '{"InstanceCount":3,"ZoneAwarenessEnabled":true,"ZoneAwarenessConfig":{"AvailabilityZoneCount":3}}' --region <region>With Terraform
resource "aws_elasticsearch_domain" "this" {
domain_name = var.domain_name
cluster_config {
instance_type = var.instance_type
instance_count = 3
zone_awareness_enabled = true
zone_awareness_config {
availability_zone_count = 3
}
}
}
See which of your accounts this check is failing on.
Book a live scan