All checks
Medium Elasticsearch · regional

Elasticsearch domains should have at least three data nodes

Checks that the Elasticsearch domain has at least three data nodes and zone awareness turned on, so cluster operations continue when a node or an Availability Zone fails. A domain with three nodes in a single Availability Zone fails this check.

service
Elasticsearch
severity
Medium
scope
evaluated in every region

How to fix it

  • Interrupts service: Spreading the domain across more Availability Zones runs a blue/green deployment, so latency and rejected requests can rise while data copies; adding nodes alone does not.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration

Number of nodes
3 or more, a multiple of the Availability Zone count so each zone holds the same number
Availability Zones
3-AZ where the Region has three; a VPC domain needs a subnet in each zone

With the AWS CLI

aws es update-elasticsearch-domain-config --domain-name <domain-name> --elasticsearch-cluster-config '{"InstanceCount":3,"ZoneAwarenessEnabled":true,"ZoneAwarenessConfig":{"AvailabilityZoneCount":3}}' --region <region>

With Terraform

resource "aws_elasticsearch_domain" "this" {
  domain_name = var.domain_name

  cluster_config {
    instance_type          = var.instance_type
    instance_count         = 3
    zone_awareness_enabled = true

    zone_awareness_config {
      availability_zone_count = 3
    }
  }
}

See which of your accounts this check is failing on.

Book a live scan