Back to Checks
aws

Amazon OpenSearch Service domain publishes search and index slow logs to CloudWatch Logs

opensearch_service_domains_cloudwatch_logging_enabled
Service: opensearchSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch Service domains have slow log publishing enabled for both search and indexing operations to CloudWatch Logs (SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS).

Prowler logoProwlerprowler-provider-aws

Risk

Without these logs, visibility into expensive searches and slow indexing is lost, masking hotspots and abuse.

  • Availability: timeouts, throttling, node pressure
  • Integrity: missed or delayed indexing
  • Operations: slower incident response and capacity planning

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_cloudwatch_logging_enabled

Recommendation

Enable both SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS for all domains and publish to CloudWatch. Set meaningful thresholds and retention, separate log groups, and alert on anomalies. Apply least privilege to log access and use defense in depth with complementary error and audit logs.

Remediation

CLI

aws opensearch update-domain-config --domain-name <DOMAIN_NAME> --log-publishing-options "SEARCH_SLOW_LOGS={CloudWatchLogsLogGroupArn=<LOG_GROUP_ARN>,Enabled=true},INDEX_SLOW_LOGS={CloudWatchLogsLogGroupArn=<LOG_GROUP_ARN>,Enabled=true}"

Terraform

# Enable OpenSearch search and index slow logs to CloudWatch
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  # Critical: enables SEARCH_SLOW_LOGS publishing
  log_publishing_options {
    log_type                 = "SEARCH_SLOW_LOGS"
    cloudwatch_log_group_arn = "<LOG_GROUP_ARN>"
    enabled                  = true
  }

  # Critical: enables INDEX_SLOW_LOGS publishing
  log_publishing_options {
    log_type                 = "INDEX_SLOW_LOGS"
    cloudwatch_log_group_arn = "<LOG_GROUP_ARN>"
    enabled                  = true
  }
}

NativeIaC

# CloudFormation: enable OpenSearch search and index slow logs to CloudWatch
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: <example_resource_name>
      LogPublishingOptions:
        SEARCH_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: <LOG_GROUP_ARN>
          Enabled: true  # Critical: enables SEARCH_SLOW_LOGS publishing
        INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: <LOG_GROUP_ARN>
          Enabled: true  # Critical: enables INDEX_SLOW_LOGS publishing

Other

1In the AWS Console, open Amazon OpenSearch Service and select your domain
2Go to the Logs tab
3For Search slow logs, click Enable, choose or create a CloudWatch log group, accept/attach the suggested resource policy, then Save
4For Index slow logs, click Enable, choose or create a CloudWatch log group, accept/attach the suggested resource policy, then Save
5Wait for domain status to return to Active

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_cloudwatch_logging_enabled(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "FAIL"
            report.status_extended = f"Opensearch domain {domain.name} SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS disabled."
            has_SEARCH_SLOW_LOGS = False
            has_INDEX_SLOW_LOGS = False
            for logging_item in domain.logging:
                if logging_item.name == "SEARCH_SLOW_LOGS" and logging_item.enabled:
                    has_SEARCH_SLOW_LOGS = True
                if logging_item.name == "INDEX_SLOW_LOGS" and logging_item.enabled:
                    has_INDEX_SLOW_LOGS = True

            if has_SEARCH_SLOW_LOGS and has_INDEX_SLOW_LOGS:
                report.status = "PASS"
                report.status_extended = f"Opensearch domain {domain.name} SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS enabled."
            elif not has_SEARCH_SLOW_LOGS and has_INDEX_SLOW_LOGS:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} INDEX_SLOW_LOGS enabled but SEARCH_SLOW_LOGS disabled."
            elif not has_INDEX_SLOW_LOGS and has_SEARCH_SLOW_LOGS:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} SEARCH_SLOW_LOGS enabled but INDEX_SLOW_LOGS disabled."

            findings.append(report)

        return findings

References