All checks
Medium Elasticsearch · regional

Elasticsearch domains should be configured with at least three dedicated master nodes

Checks that the Elasticsearch domain uses at least three dedicated master nodes. They take cluster management off the data nodes, keep the quorum needed to elect a new master when one fails, and absorb the extra load of a blue/green deployment; with two, a single failure stops reads and writes.

service
Elasticsearch
severity
Medium
scope
evaluated in every region

How to fix it

  • Interrupts service: Turning dedicated master nodes on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration

Enable dedicated master nodes
Selected
Instance type
Sized for the cluster's node and shard count, per AWS's dedicated master sizing table
Number of master nodes
3; never an even number, and 5 only for extra failover

With the AWS CLI

aws es update-elasticsearch-domain-config --domain-name <domain-name> --elasticsearch-cluster-config DedicatedMasterEnabled=true,DedicatedMasterCount=3,DedicatedMasterType=<instance-type> --region <region>

With Terraform

resource "aws_elasticsearch_domain" "this" {
  domain_name = var.domain_name

  cluster_config {
    instance_type            = var.instance_type
    instance_count           = var.instance_count
    dedicated_master_enabled = true
    dedicated_master_count   = 3
    dedicated_master_type    = var.dedicated_master_type
  }
}

See which of your accounts this check is failing on.

Book a live scan