All checks
Medium
OpenSearch domains should have the latest software update installed
Checks that the OpenSearch domain, on either engine, has no service software update waiting, so it runs the latest platform fixes, including security fixes. It fails while an update is available, scheduled or still installing.
- service
- Opensearch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: The update runs as a blue/green deployment, so latency and rejected requests can rise while data copies, and on a busy cluster it can take hours.
In the console
OpenSearch Service → Domains → the domain → Actions → Update
- Apply update now
- Selected at low traffic, or Schedule it in off-peak window to run in the domain's quiet hours
With the AWS CLI
aws opensearch start-service-software-update --domain-name <domain-name> --schedule-at NOW --region <region>See which of your accounts this check is failing on.
Book a live scan