OpenSearch domains should not be publicly accessible

How to fix it

• Replaces the resource: A public domain cannot move into a VPC: create a VPC domain, restore a snapshot of this one into it, repoint clients, then delete this one.

In the console

OpenSearch Service → Domains → Create domain → Network

Network

VPC access

With Terraform

• Can't be undone: Adding vpc_options to this domain in Terraform destroys it and builds an empty one, so take the snapshot before you apply.

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  vpc_options {
    subnet_ids         = var.subnet_ids
    security_group_ids = var.security_group_ids
  }
}