OpenSearch domain sends slow logs to CloudWatch Logs

Check ID: opensearch_service_domains_cloudwatch_logging_enabled
Provider: AWS
Service: opensearch
Severity: LOW
Categories: logging
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch Service domains have slow log publishing enabled for both search and indexing operations to CloudWatch Logs (SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS).

Risk

Without these logs, visibility into expensive searches and slow indexing is lost, masking hotspots and abuse.

Availability: timeouts, throttling, node pressure
Integrity: missed or delayed indexing
Operations: slower incident response and capacity planning

Recommendation

Enable both SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS for all domains and publish to CloudWatch. Set meaningful thresholds and retention, separate log groups, and alert on anomalies. Apply least privilege to log access and use defense in depth with complementary error and audit logs.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --log-publishing-options "SEARCH_SLOW_LOGS={CloudWatchLogsLogGroupArn=<LOG_GROUP_ARN>,Enabled=true},INDEX_SLOW_LOGS={CloudWatchLogsLogGroupArn=<LOG_GROUP_ARN>,Enabled=true}"

# Enable OpenSearch search and index slow logs to CloudWatch
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  # Critical: enables SEARCH_SLOW_LOGS publishing
  log_publishing_options {
    log_type                 = "SEARCH_SLOW_LOGS"
    cloudwatch_log_group_arn = "<LOG_GROUP_ARN>"
    enabled                  = true
  }

  # Critical: enables INDEX_SLOW_LOGS publishing
  log_publishing_options {
    log_type                 = "INDEX_SLOW_LOGS"
    cloudwatch_log_group_arn = "<LOG_GROUP_ARN>"
    enabled                  = true
  }
}

# CloudFormation: enable OpenSearch search and index slow logs to CloudWatch
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      LogPublishingOptions:
        SEARCH_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: <LOG_GROUP_ARN>
          Enabled: true  # Critical: enables SEARCH_SLOW_LOGS publishing
        INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: <LOG_GROUP_ARN>
          Enabled: true  # Critical: enables INDEX_SLOW_LOGS publishing

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_cloudwatch_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon OpenSearch Service domain has audit logging enabled OpenSearch domain has encryption at rest enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires