OpenSearch domains should have at least three dedicated primary nodes
Checks that the OpenSearch domain has at least three dedicated master (primary) nodes. They manage the cluster without holding data, and three keep the quorum needed to elect a new one if one fails, which two cannot. Multi-AZ with standby includes three.
- service
- Opensearch
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Interrupts service: Turning dedicated master nodes on runs a blue/green deployment, so latency and rejected requests can rise while data copies; apply it at low traffic.
In the console
OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration
- Enable dedicated master nodes
- Selected
- Instance type
- Sized for the cluster's node and shard count, per AWS's dedicated master sizing table
- Number of master nodes
- 3; never an even number, and 5 only for extra failover
With the AWS CLI
aws opensearch update-domain-config --domain-name <domain-name> --cluster-config '{"DedicatedMasterEnabled":true,"DedicatedMasterType":"<instance-type>","DedicatedMasterCount":3}' --region <region>With Terraform
resource "aws_opensearch_domain" "this" {
domain_name = var.domain_name
cluster_config {
instance_type = var.instance_type
instance_count = var.instance_count
dedicated_master_enabled = true
dedicated_master_type = var.dedicated_master_type
dedicated_master_count = 3
}
}
See which of your accounts this check is failing on.
Book a live scan