OpenSearch domains should have at least three data nodes
Checks that the OpenSearch domain has at least three data nodes and zone awareness turned on, so the cluster keeps serving if a node or an Availability Zone fails. A domain with three nodes in a single Availability Zone fails this check.
- service
- Opensearch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: Spreading the domain across more Availability Zones runs a blue/green deployment, so latency and rejected requests can rise while data copies; adding nodes alone does not.
In the console
OpenSearch Service → Domains → the domain → Actions → Edit cluster configuration
- Number of nodes
- 3 or more, a multiple of the Availability Zone count so each zone holds the same number
- Availability Zones
- 3-AZ where the Region has three; a VPC domain needs a subnet in each zone
With the AWS CLI
aws opensearch update-domain-config --domain-name <domain-name> --cluster-config '{"InstanceCount":3,"ZoneAwarenessEnabled":true,"ZoneAwarenessConfig":{"AvailabilityZoneCount":3}}' --region <region>With Terraform
resource "aws_opensearch_domain" "this" {
domain_name = var.domain_name
cluster_config {
instance_type = var.instance_type
instance_count = 3
zone_awareness_enabled = true
zone_awareness_config {
availability_zone_count = 3
}
}
}
See which of your accounts this check is failing on.
Book a live scan