Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · ES

ES.7: ES domains should have >= 3 dedicated master nodes

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ES.7 check?

ES.7 fails when a legacy Elasticsearch domain does not have at least three dedicated master nodes. Dedicated masters handle cluster-state coordination — which indices exist, where shards live, which node is healthy — separately from data nodes.

Why does ES.7 matter?

Master election is a quorum vote that needs an odd number greater than one to break ties. With no dedicated masters or only one, a single node loss can leave the cluster leaderless and stalled. Two master-eligible nodes is the dangerous case: a partition can leave each believing it is master, both accepting writes, producing two divergent cluster states that must be reconciled with data loss.

How do I fix ES.7?

  1. Configure three dedicated master nodes on the domain.
  2. Place the masters across three Availability Zones for partition tolerance.
  3. Size the master instance type appropriately for the cluster's shard count.
  4. Apply three dedicated masters as a baseline for production domains.

Remediation script · bash

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3

Full walkthrough (console steps, edge cases and verification) in the lesson Deploy across multiple Availability Zones.

Full lesson Deploy across multiple Availability Zones Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ES controls ↗ Check your own account for ES.7 →
Part of the learning path Tighten your databases

More ES controls

  • ES.1 ES domains should encrypt at rest
  • ES.2 A legacy Elasticsearch domain is publicly accessible
  • ES.3 ES should encrypt node-to-node traffic
  • ES.4 ES error logging to CW should be enabled
  • ES.5 ES domains should have audit logging
  • ES.6 ES domains should have >= 3 data nodes
  • ES.8 ES should use latest TLS policy