Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · Opensearch

Opensearch.6: OpenSearch domains should have >= 3 data nodes

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub Opensearch.6 check?

Opensearch.6 reads the domain's ClusterConfig and fails on either of two conditions: the data-node instanceCount is less than 3, or zoneAwarenessEnabled is false. So a domain with three or more data nodes still fails this control if zone awareness is turned off: the check wants at least three data nodes AND zone awareness spreading them across Availability Zones.

Why does Opensearch.6 matter?

A one- or two-node domain has no safe failure mode. Losing a single node can take the cluster offline or leave it without enough capacity to keep replicas healthy. At least three data nodes ensures the cluster can keep operating if a node fails, and zone awareness places those nodes across multiple Availability Zones so a single-AZ outage doesn't take the domain down with it.

How do I fix Opensearch.6?

  1. Audit each domain's ClusterConfig to find those running one or two data nodes.
  2. Decide per domain whether it is worth funding for resilience or should simply be retired.
  3. Raise the data-node count to at least three with zone awareness enabled, expecting a blue/green deployment.
  4. Consider dedicated primary nodes for larger clusters to keep coordination stable.

Remediation script · bash

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3

Full walkthrough (console steps, edge cases and verification) in the lesson Deploy across multiple Availability Zones.

Is Opensearch.6 a false positive?

It reads as a cost control, but it is a resilience decision first: bumping to three nodes is the only way to clear it, so the real question is whether the domain matters enough to keep at all.

Full lesson Deploy across multiple Availability Zones Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for Opensearch controls ↗ Check your own account for Opensearch.6 →
Part of the learning path Tighten your databases

More Opensearch controls