🛡️ AWS OpenSearch Domain engine is outside standard support🟢

• Contextual name: 🛡️ Domain engine is outside standard support🟢
• ID: /ce/ca/aws/opensearch/domain-engine-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS OpenSearch Domain
  • 🔌 AWS OpenSearch Domain - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies Amazon OpenSearch Service domains whose OpenSearch or legacy Elasticsearch engine is outside AWS standard support. It evaluates the domain's current engine family and minor version, not whether the engine is the latest release. Engine lifecycle is independent of service software updates and the OpenSearch Dashboards version. Serverless collections and self-managed clusters are outside this resource type.

Rationale

Standard support provides AWS bug fixes and security updates. Extended support provides a narrower security-fix commitment and incurs additional charges. Planning engine upgrades before standard support ends reduces support costs and migration pressure.

Impact

An engine upgrade can introduce incompatible API, index, plugin, and client behavior. Assess compatibility and recovery before changing a production domain. A finding during extended support does not mean all AWS support has ended.

Audit

This policy marks an AWS OpenSearch Domain as INCOMPLIANT if its Created field is true, its Deleted field is false, and its Engine Version belongs to a release group whose AWS standard-support cutoff in the table below is before today.

... see more

Remediation

Open File

Remediation

Plan the upgrade

1. Confirm the domain's current engine family and version, then check the AWS engine support schedule. Choose a target version within standard support that is available in the domain's AWS Region.

2. List the domain's eligible in-place upgrade targets using the following read-only command. Replace REGION and DOMAIN_NAME with the domain's values:

   aws opensearch get-compatible-versions \
     --region REGION \
     --domain-name DOMAIN_NAME

   An eligible target may itself be outside standard support. Check its lifecycle dates before selecting it.

3. Review the AWS upgrade paths and prerequisites, including breaking changes, clients, ingestion integrations, plugins, index compatibility, cross-cluster connections, and cluster health. Complete any configuration change or engine upgrade already in progress before starting another operation.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data