Skip to main content

🛡️ AWS OpenSearch Domain Dedicated Master Count is fewer than three🟢

  • Contextual name: 🛡️ Domain Dedicated Master Count is fewer than three🟢
  • ID: /ce/ca/aws/opensearch/domain-dedicated-master-count
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS OpenSearch Domains that are configured with fewer than three dedicated master nodes or do not have dedicated master nodes enabled.

Rationale​

Dedicated master nodes are responsible for critical cluster management functions, including maintaining cluster state, monitoring node health, coordinating shard allocation, and processing configuration changes.

  1. Stability: Separating cluster management responsibilities from data nodes reduces resource contention. Even under heavy indexing or query workloads, dedicated master nodes help maintain cluster stability.
  2. Quorum and High Availability: OpenSearch uses a quorum-based election process to prevent split-brain scenarios, where multiple nodes incorrectly assume leadership. A minimum of three dedicated master nodes ensures that the cluster can still elect a master if one node becomes unavailable.
  3. Best Practices: For production workloads, AWS recommends using an odd number of dedicated master nodes, typically three or five, to maximize fault tolerance and maintain quorum during failures.

... see more

Remediation​

Open File

Remediation​

Enable Dedicated Master Nodes for OpenSearch Domain​

To improve cluster stability and ensure quorum-based master elections, configure the OpenSearch Service domain with dedicated master nodes and set the master node count to a minimum of three.

From Command Line​

Use the update-domain-config command to enable dedicated master nodes and configure the recommended master node count:

aws opensearch update-domain-config \
    --domain-name {{domain-name}} \
    --cluster-config '{
        "DedicatedMasterEnabled": true,
        "DedicatedMasterCount": 3
        "DedicatedMasterType": "{{m5.large.search}}" 
    }'
Additional Considerations​
  • Use an odd number of dedicated master nodes (for example, 3 or 5) to maintain quorum during failures.
  • Dedicated master nodes should not be used for data or ingest workloads.
  • Enabling dedicated master nodes triggers a blue/green update of the domain, which may cause a brief period of reduced availability or increased latency. Plan the change accordingly.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.7] Elasticsearch domains should be configured with at least three dedicated master nodes1no data
💼 Cloudaware Framework → 💼 System Configuration54no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)14no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)214no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)14no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)114no data
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations17no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process14no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed14no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed14no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives14no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution614no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy13no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-36 Distributed Processing and Storage28no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability13no data