🛡️ AWS OpenSearch Domain Instance Count is fewer than three🟢

• Contextual name: 🛡️ Domain Instance Count is fewer than three🟢
• ID: /ce/ca/aws/opensearch/domain-instance-count
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS OpenSearch Domain
  • 🔌 AWS OpenSearch Domain - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• AWS Security Hub: [Opensearch.6] OpenSearch domains should have at least three data nodes
• AWS Security Hub: [ES.6] Elasticsearch domains should have at least three data nodes

Description

Open File

Description

This policy identifies AWS OpenSearch Domains that do not adhere to high-availability best practices, specifically the requirement for a minimum of three data nodes and the use of Zone Awareness.

Rationale

High availability in AWS OpenSearch Service is achieved through redundancy and fault isolation across Availability Zones:

1. Zone Awareness: When enabled, OpenSearch distributes nodes and their associated shards across two or three Availability Zones (AZs). This design ensures that the failure of a single AZ does not result in data loss or a complete service outage.
2. Instance Count: A minimum of three data nodes is recommended for production environments. This configuration supports quorum-based master elections and ensures that the cluster remains operational with adequate capacity if a node or an Availability Zone becomes unavailable.

Impact

If Zone Awareness is disabled or the instance count is insufficient, the OpenSearch domain becomes a single point of failure. Hardware issues, node failures, or Availability Zone disruptions may cause the cluster to enter a Red state, resulting in partial or complete loss of data availability.

... see more

Remediation

Open File

Remediation

Enable High Availability for OpenSearch Domain

To meet high-availability best practices, configure the OpenSearch Service domain with a minimum of three data nodes and enable Zone Awareness.

From Command Line

Use the update-domain-config command to enable Zone Awareness and set the instance count to three data nodes. This configuration distributes nodes across three Availability Zones.

aws opensearch update-domain-config \
    --domain-name {{domain-name}} \
    --cluster-config '{
        "InstanceCount": 3,
        "ZoneAwarenessEnabled": true,
        "ZoneAwarenessConfig": {
            "AvailabilityZoneCount": 3
        }
    }'

Additional Considerations

• The AvailabilityZoneCount value must match the number of Availability Zones supported in the selected AWS Region.
• For smaller regions that support only two Availability Zones, set AvailabilityZoneCount to 2 while maintaining a minimum of three data nodes.
• Changes to cluster configuration may trigger a rolling update and can temporarily impact cluster performance.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.6] Elasticsearch domains should have at least three data nodes			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.6] OpenSearch domains should have at least three data nodes			1		no data
💼 Cloudaware Framework → 💼 System Configuration			54		no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)			14		no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)	2		14		no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)			14		no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)	1		14		no data
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations			17		no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process			14		no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed			14		no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed			14		no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives			14		no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution	6		14		no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy			13		no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-36 Distributed Processing and Storage	2		8		no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability			13		no data