Check ID: opensearch_service_domains_updated_to_the_latest_service_software_version
Provider: AWS
Service: opensearch
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsOpenSearchServiceDomain

​
What this check verifies

OpenSearch Service domains are assessed for pending service software updates. This focuses on internal platform updates, distinct from engine version upgrades.

​
Risk

Missing service software updates can leave known flaws unpatched, threatening data confidentiality and index integrity. Required updates missed may lead to AWS isolating the domain, causing outages and, if prolonged, permanent deletion.

​
Recommendation

Apply the latest service software updates promptly. Schedule updates during the domain’s off-peak window or enable automatic updates. Monitor console or EventBridge notifications, and test changes in staging to support defense in depth while minimizing downtime.

​
Remediation

aws opensearch start-service-software-update —domain-name <DOMAIN_NAME>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = opensearch_service_domains_updated_to_the_latest_service_software_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks