Elasticsearch domains should be configured with at least three dedicated master nodes
Checks that the Elasticsearch domain uses at least three dedicated master nodes. They take cluster management off the data nodes, keep the quorum needed to elect a new master when one fails, and absorb the extra load of a blue/green deployment; with two, a single failure stops reads and writes.
- service
- Elasticsearch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: Turning dedicated master nodes on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.
In the console
OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration
- Enable dedicated master nodes
- Selected
- Instance type
- Sized for the cluster's node and shard count, per AWS's dedicated master sizing table
- Number of master nodes
- 3; never an even number, and 5 only for extra failover
With the AWS CLI
aws es update-elasticsearch-domain-config --domain-name <domain-name> --elasticsearch-cluster-config DedicatedMasterEnabled=true,DedicatedMasterCount=3,DedicatedMasterType=<instance-type> --region <region>With Terraform
resource "aws_elasticsearch_domain" "this" {
domain_name = var.domain_name
cluster_config {
instance_type = var.instance_type
instance_count = var.instance_count
dedicated_master_enabled = true
dedicated_master_count = 3
dedicated_master_type = var.dedicated_master_type
}
}
See which of your accounts this check is failing on.
Book a live scan