Back to Checks
aws

Amazon OpenSearch Service domain is updated to the latest service software version

opensearch_service_domains_updated_to_the_latest_service_software_version
Service: opensearchSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsOpenSearchServiceDomain

OpenSearch Service domains are assessed for pending service software updates. This focuses on internal platform updates, distinct from engine version upgrades.

Prowler logoProwlerprowler-provider-aws

Risk

Missing service software updates can leave known flaws unpatched, threatening data confidentiality and index integrity.

Required updates missed may lead to AWS isolating the domain, causing outages and, if prolonged, permanent deletion.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks opensearch_service_domains_updated_to_the_latest_service_software_version

Recommendation

Apply the latest service software updates promptly. Schedule updates during the domain's off-peak window or enable automatic updates. Monitor console or EventBridge notifications, and test changes in staging to support defense in depth while minimizing downtime.

Remediation

CLI

aws opensearch start-service-software-update --domain-name <DOMAIN_NAME>

Other

1Sign in to the AWS Console and open Amazon OpenSearch Service
2Select the target domain
3Click Actions > Update
4Choose Apply update now
5Click Confirm to start the service software update

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.opensearch.opensearch_client import (
    opensearch_client,
)


class opensearch_service_domains_updated_to_the_latest_service_software_version(Check):
    def execute(self):
        findings = []
        for domain in opensearch_client.opensearch_domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            report.status = "PASS"
            report.status_extended = f"Opensearch domain {domain.name} with version {domain.version} does not have internal updates available."
            if domain.update_available:
                report.status = "FAIL"
                report.status_extended = f"Opensearch domain {domain.name} with version {domain.version} has internal updates available."

            findings.append(report)

        return findings

References