VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

This control verifies whether Elasticsearch domains are configured with at least three dedicated primary nodes and ensures that dedicated master is enabled.

Note: Using more than three primary nodes may be excessive for mitigating availability risks and can lead to higher costs. For high availability and fault tolerance, an Elasticsearch domain should have at least three dedicated primary nodes. These nodes can become heavily utilized during data node blue/green deployments due to the additional management required. Ensuring an Elasticsearch domain has at least three dedicated primary nodes provides adequate primary node resources and maintains cluster operations in the event of a node failure.

Remediation

To modify the number of data nodes in an Elasticsearch domain:

1. Log in to the Amazon OpenSearch Service console.
2. Under Domains, choose the name of the domain you want to edit.
3. Click Edit domain.
4. Under Dedicated master nodes, set Instance type to the desired instance type.
5. Set Number of master nodes equal to three or greater.
6. Click Submit.