OpenSearch domain has at least 3 dedicated master nodes

Check ID: opensearch_service_domains_fault_tolerant_master_nodes
Provider: AWS
Service: opensearch
Severity: MEDIUM
Categories: resilience
Resource type: AwsOpenSearchServiceDomain

What this check verifies

Amazon OpenSearch domains have dedicated master nodes enabled with a master node count of at least 3 to support stable cluster coordination and elections

Risk

With fewer than 3 or disabled dedicated master nodes, the cluster can lose quorum, blocking leader election. Effects include stalled cluster state updates, failed reads/writes, shard allocation issues, and possible split-brain, reducing availability and integrity.

Recommendation

Enable dedicated master nodes and set the count to at least 3 (use an odd number) to maintain quorum. Use Multi-AZ with standby to distribute masters across zones. Right-size master instances and monitor cluster health to uphold high availability and resilience.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws opensearch update-domain-config --domain-name <name> --cluster-config "DedicatedMasterEnabled=true,DedicatedMasterType=<instance_type>,DedicatedMasterCount=3"

# Terraform: set at least 3 dedicated master nodes
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  cluster_config {
    dedicated_master_enabled = true  # Critical: enable dedicated masters
    dedicated_master_count   = 3     # Critical: ensure minimum of 3 masters
    dedicated_master_type    = "<instance_type>"  # Critical: required when enabling masters
  }
}

# CloudFormation: set at least 3 dedicated master nodes
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      ClusterConfig:
        DedicatedMasterEnabled: true  # Critical: enable dedicated master nodes
        DedicatedMasterCount: 3       # Critical: ensure minimum of 3 masters
        DedicatedMasterType: "<instance_type>"  # Critical: required when enabling masters

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_fault_tolerant_master_nodes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

OpenSearch domain has 3+ data nodes and Zone Awareness OpenSearch domain has HTTPS enforcement enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires