OpenSearch domain has 3+ data nodes and Zone Awareness

Check ID: opensearch_service_domains_fault_tolerant_data_nodes
Provider: AWS
Service: opensearch
Severity: MEDIUM
Categories: resilience
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch domains are assessed for fault tolerance: >= 3 data nodes (instance_count >= 3) and Zone Awareness (zone_awareness_enabled = true) to distribute data across Availability Zones.

Risk

Insufficient data nodes or disabled Zone Awareness reduces availability and durability. A node or AZ failure can trigger shard unavailability, write failures, or cluster outage, increasing risk of data inconsistency during rebalancing and blocking reads/writes until recovery.

Recommendation

Configure OpenSearch with >= 3 data nodes and enable Zone Awareness to spread nodes across AZs.

Prefer Multi-AZ with Standby for resilient failover
Use node counts in multiples of three and set index replicas (>= 1)
Practice capacity planning and failure testing as defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <example_resource_name> --cluster-config InstanceCount=3,ZoneAwarenessEnabled=true

# Terraform: Ensure at least 3 data nodes and enable Zone Awareness
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  cluster_config {
    instance_type          = "m5.large.search"
    instance_count         = 3     # Critical: sets at least 3 data nodes for fault tolerance
    zone_awareness_enabled = true  # Critical: enables cross-AZ (Zone Awareness)
  }
}

# CloudFormation: Ensure at least 3 data nodes and enable Zone Awareness
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      ClusterConfig:
        InstanceType: m5.large.search
        InstanceCount: 3            # Critical: sets at least 3 data nodes for fault tolerance
        ZoneAwarenessEnabled: true  # Critical: enables cross-AZ (Zone Awareness)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_fault_tolerant_data_nodes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has encryption at rest enabled OpenSearch domain has at least 3 dedicated master nodes

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires