Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · ES

ES.6: ES domains should have >= 3 data nodes

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ES.6 check?

ES.6 checks that each legacy Elasticsearch domain runs with at least three data nodes and passes only when InstanceCount is three or greater. A domain with one or two data nodes fails.

Why does ES.6 matter?

A single-node domain has no redundancy — any node failure or AZ event is a full outage. Two nodes is worse: the cluster can't hold a reliable quorum, so a network partition can split-brain, with both sides accepting writes independently and one side's writes discarded when the partition heals. Three nodes across zones is the floor for both availability and data integrity.

How do I fix ES.6?

  1. Increase the domain's data-node count to three or more, ideally spread across three AZs.
  2. Enable zone awareness so shards and replicas distribute across the zones.
  3. Confirm shard and replica counts make use of the added nodes.
  4. Standardise on a minimum of three data nodes for production domains.

Remediation script · bash

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3

Full walkthrough (console steps, edge cases and verification) in the lesson Deploy across multiple Availability Zones.

Full lesson Deploy across multiple Availability Zones Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ES controls ↗ Check your own account for ES.6 →
Part of the learning path Tighten your databases

More ES controls

  • ES.1 ES domains should encrypt at rest
  • ES.2 A legacy Elasticsearch domain is publicly accessible
  • ES.3 ES should encrypt node-to-node traffic
  • ES.4 ES error logging to CW should be enabled
  • ES.5 ES domains should have audit logging
  • ES.7 ES domains should have >= 3 dedicated master nodes
  • ES.8 ES should use latest TLS policy