All checks
Low Opensearch · regional

OpenSearch domains should have at least three dedicated primary nodes

Checks that the OpenSearch domain has at least three dedicated master (primary) nodes. They manage the cluster without holding data, and three keep the quorum needed to elect a new one if one fails, which two cannot. Multi-AZ with standby includes three.

service
Opensearch
severity
Low
scope
evaluated in every region

How to fix it

  • Interrupts service: Turning dedicated master nodes on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.

In the console

OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration

Enable dedicated master nodes
Selected
Instance type
Sized for the cluster's node and shard count, per AWS's dedicated master sizing table
Number of master nodes
3; never an even number, and 5 only for extra failover

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --cluster-config '{"DedicatedMasterEnabled":true,"DedicatedMasterType":"<instance-type>","DedicatedMasterCount":3}' --region <region>

With Terraform

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  cluster_config {
    instance_type            = var.instance_type
    instance_count           = var.instance_count
    dedicated_master_enabled = true
    dedicated_master_type    = var.dedicated_master_type
    dedicated_master_count   = 3
  }
}

See which of your accounts this check is failing on.

Book a live scan