Back to Checks
aws

OpenSearch domain has at least 3 dedicated master nodes

opensearch_service_domains_fault_tolerant_master_nodes
Service: opensearchSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsOpenSearchServiceDomain

Amazon OpenSearch domains have dedicated master nodes enabled with a master node count of at least 3 to support stable cluster coordination and elections

Prowler logoProwlerprowler-provider-aws

Risk

With fewer than 3 or disabled dedicated master nodes, the cluster can lose quorum, blocking leader election.

Effects include stalled cluster state updates, failed reads/writes, shard allocation issues, and possible split-brain, reducing availability and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_fault_tolerant_master_nodes

Recommendation

Enable dedicated master nodes and set the count to at least 3 (use an odd number) to maintain quorum. Use Multi-AZ with standby to distribute masters across zones. Right-size master instances and monitor cluster health to uphold high availability and resilience.

Remediation

CLI

aws opensearch update-domain-config --domain-name <name> --cluster-config "DedicatedMasterEnabled=true,DedicatedMasterType=<instance_type>,DedicatedMasterCount=3"

Terraform

# Terraform: set at least 3 dedicated master nodes
resource "aws_opensearch_domain" "<example_resource_name>" {
  domain_name = "<example_resource_name>"

  cluster_config {
    dedicated_master_enabled = true  # Critical: enable dedicated masters
    dedicated_master_count   = 3     # Critical: ensure minimum of 3 masters
    dedicated_master_type    = "<instance_type>"  # Critical: required when enabling masters
  }
}

NativeIaC

# CloudFormation: set at least 3 dedicated master nodes
Resources:
  <example_resource_name>:
    Type: AWS::OpenSearchService::Domain
    Properties:
      ClusterConfig:
        DedicatedMasterEnabled: true  # Critical: enable dedicated master nodes
        DedicatedMasterCount: 3       # Critical: ensure minimum of 3 masters
        DedicatedMasterType: "<instance_type>"  # Critical: required when enabling masters

Other

1Sign in to the AWS Console and open Amazon OpenSearch Service
2Select your domain and choose Edit
3In Cluster configuration:
4- Enable Dedicated master nodes
5- Set Dedicated master node count to 3
6- Select a Dedicated master instance type
7Choose Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_fault_tolerant_master_nodes(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = f"Opensearch domain {domain.name} has {domain.dedicated_master_count} dedicated master nodes, which guarantees fault tolerance on the master nodes."

            if not getattr(domain, "dedicated_master_enabled", False):
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} has dedicated master nodes disabled."
            elif domain.dedicated_master_count < 3:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} does not have at least 3 dedicated master nodes."

            findings.append(report)

        return findings

References