> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Es latest service software remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to update an Amazon Elasticsearch / OpenSearch domain to the latest service software using the AWS Management Console:

        1. **Sign in to AWS Console**
           * Go to: [https://console.aws.amazon.com](https://console.aws.amazon.com)
           * Choose the correct **Region** (top right) where your Elasticsearch/OpenSearch domain exists.

        2. **Open the OpenSearch Service console**
           * In the search bar at the top, type **“OpenSearch”** (older accounts may still say **“Elasticsearch Service”**).
           * Click **Amazon OpenSearch Service**.

        3. **Go to your domain**
           * In the left navigation pane, click **Domains**.
           * Find and click the name of the Elasticsearch/OpenSearch domain you want to update.

        4. **Check service software status**
           * On the domain details page, in the **Overview** (or **General information**) section, look for:
             * **Service software version**
             * **Service software status** (e.g., `Available`, `Update available`, `Update scheduled`, etc.)
           * If an update is available, you’ll see a message like **“A new service software update is available”** and a button or link such as **“Update”** or **“Service software updates”**.

        5. **Start the service software update**
           * Click **Service software updates** (or **Update** depending on UI).
           * Review the details of the update (release notes / impact).
           * Choose between options (UI text may vary slightly by region/version):
             * **Start update now** – initiates update as soon as possible.
             * In some UIs, you may have options to:
               * **Allow blue/green deployment** (preferred if available, to reduce downtime).
               * **Schedule or control maintenance window** (if configured).
           * Confirm by clicking **Update** / **Start update**.

        6. **Monitor the update progress**
           * Back on the domain details page, monitor:
             * **Service software status**: should move from `Update available` → `Updating` → `Updated`.
             * **Cluster health** and **Node status** for any issues.
           * You can also look at **CloudWatch metrics** and **Events** on the domain page for any warnings or errors.

        7. **Verify after completion**
           * Once **Service software status** shows `Updated` (or similar) and domain status is `Active`/`Available`, confirm:
             * **Service software version** now shows the latest version.
             * Applications can connect and queries/indexing work as expected.

        8. **Repeat for other domains**
           * If you have multiple domains, repeat steps 3–7 for each domain that shows a pending service software update.

        That’s all that’s required via the console to ensure your Elasticsearch/OpenSearch domains are using the latest service software.
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, step‑by‑step AWS CLI instructions to ensure an Amazon Elasticsearch (or OpenSearch) domain is using the latest **service software**.

        ***

        ### 1. Prerequisites

        * AWS CLI v2 installed and configured with credentials.
        * Permissions on the identity you’re using:
          * `es:DescribeElasticsearchDomain`
          * `es:StartElasticsearchServiceSoftwareUpdate`
          * `es:DescribeElasticsearchServiceSoftwareUpdate` (optional, for checking status)

        Replace `my-domain-name` with your actual domain name below.

        ***

        ### 2. Check current service software status

        ```bash theme={null}
        aws es describe-elasticsearch-domain \
          --domain-name my-domain-name \
          --query "DomainStatus.ServiceSoftwareOptions" \
          --output table
        ```

        Look at these fields in the output:

        * `UpdateAvailable`: `true` means a newer service software is available.
        * `CurrentVersion`: currently running service software version.
        * `NewVersion`: version you will be upgraded to.
        * `UpdateStatus`: e.g. `PENDING_UPDATE`, `IN_PROGRESS`, `COMPLETED`, etc.

        If `UpdateAvailable` is `false`, the domain is already on the latest service software.

        ***

        ### 3. Start the service software update

        If `UpdateAvailable` is `true`, start the update:

        ```bash theme={null}
        aws es start-elasticsearch-service-software-update \
          --domain-name my-domain-name
        ```

        The response includes an `ServiceSoftwareOptions` block; note the `UpdateId`:

        ```json theme={null}
        {
          "ServiceSoftwareOptions": {
            "UpdateId": "12345678-90ab-cdef-1234-567890abcdef",
            ...
          }
        }
        ```

        Copy the `UpdateId`.

        ***

        ### 4. (Optional) Monitor the update progress

        Use `DescribeElasticsearchServiceSoftwareUpdate` to track status:

        ```bash theme={null}
        aws es describe-elasticsearch-service-software-update \
          --domain-name my-domain-name \
          --update-id 12345678-90ab-cdef-1234-567890abcdef \
          --output table
        ```

        Key fields:

        * `Status`: `IN_PROGRESS` → `COMPLETED` (or `FAILED`).
        * `Description`: additional info if there’s an issue.

        You can loop or periodically run that command until `Status` is `COMPLETED`.

        ***

        ### 5. Verify the domain is now on the latest service software

        After completion:

        ```bash theme={null}
        aws es describe-elasticsearch-domain \
          --domain-name my-domain-name \
          --query "DomainStatus.ServiceSoftwareOptions" \
          --output table
        ```

        Confirm:

        * `UpdateAvailable` is `false`.
        * `CurrentVersion` equals `NewVersion`.
        * `UpdateStatus` is `COMPLETED` (or `NOT_REQUIRED` / no pending update).

        At this point, the Elasticsearch/OpenSearch domain is using the latest service software.
      </Accordion>

      <Accordion title="Using Python">
        Below is a practical, step‑by‑step way to remediate “ElasticSearch Domains Should Use The Latest Service Software” in AWS using Python (boto3).

        ***

        ## 1. Prerequisites

        1. **Install boto3** (if not already):
           ```bash theme={null}
           pip install boto3
           ```

        2. **Configure AWS credentials** (with permissions for Elasticsearch/OpenSearch):

           * IAM policy must allow:
             * `es:ListDomainNames`
             * `es:DescribeElasticsearchDomain`
             * `es:StartElasticsearchServiceSoftwareUpdate`

           Example minimal IAM permissions:

           ```json theme={null}
           {
             "Version": "2012-10-17",
             "Statement": [
               {
                 "Effect": "Allow",
                 "Action": [
                   "es:ListDomainNames",
                   "es:DescribeElasticsearchDomain",
                   "es:StartElasticsearchServiceSoftwareUpdate"
                 ],
                 "Resource": "*"
               }
             ]
           }
           ```

        3. **Know your region** (or loop through regions where you have domains).

        ***

        ## 2. Logic to Remediate

        For each Elasticsearch domain:

        1. Describe domain.
        2. Check `ServiceSoftwareOptions`:
           * If `UpdateStatus` is `ELIGIBLE` or `PENDING_UPDATE`, start the update.
           * If `UpdateStatus` is `IN_PROGRESS`, just log it.
           * If `ServiceSoftwareOptions` is not present (older domains/SDKs), skip or just log.

        ***

        ## 3. Python Script (boto3)

        This script:

        * Lists all Elasticsearch domains in a region.
        * Checks which need software updates.
        * Starts the update where applicable.

        ```python theme={null}
        import boto3
        from botocore.exceptions import ClientError

        REGION = "us-east-1"  # change as needed

        def get_es_client(region=REGION):
            return boto3.client("es", region_name=region)

        def list_domains(es_client):
            response = es_client.list_domain_names()
            # response format: {'DomainNames': [{'DomainName': 'name1'}, ...]}
            return [d["DomainName"] for d in response.get("DomainNames", [])]

        def describe_domain(es_client, domain_name):
            return es_client.describe_elasticsearch_domain(DomainName=domain_name)["DomainStatus"]

        def start_software_update(es_client, domain_name):
            try:
                resp = es_client.start_elasticsearch_service_software_update(
                    DomainName=domain_name
                )
                return resp
            except ClientError as e:
                print(f"[ERROR] Could not start software update for {domain_name}: {e}")
                return None

        def remediate_all_domains(region=REGION):
            es_client = get_es_client(region)
            domains = list_domains(es_client)

            if not domains:
                print(f"No Elasticsearch domains found in region {region}.")
                return

            for domain_name in domains:
                print(f"Checking domain: {domain_name}")
                status = describe_domain(es_client, domain_name)

                sso = status.get("ServiceSoftwareOptions", {})
                update_status = sso.get("UpdateStatus")               # e.g. ELIGIBLE, IN_PROGRESS, PENDING_UPDATE, COMPLETED
                description   = sso.get("Description")
                current_ver   = sso.get("CurrentVersion")
                new_ver       = sso.get("NewVersion")

                print(f"  CurrentVersion: {current_ver}, NewVersion: {new_ver}, UpdateStatus: {update_status}, Description: {description}")

                # If update is available and not already in progress, start it
                if update_status in ("ELIGIBLE", "PENDING_UPDATE"):
                    print(f"  Starting service software update for {domain_name}...")
                    resp = start_software_update(es_client, domain_name)
                    if resp:
                        print(f"  Update started: {resp.get('ServiceSoftwareOptions', {})}")
                elif update_status == "IN_PROGRESS":
                    print(f"  Update already in progress for {domain_name}, skipping.")
                else:
                    print(f"  No update action required for {domain_name}.")

        if __name__ == "__main__":
            remediate_all_domains()
        ```

        ***

        ## 4. Optional: Target a Single Domain

        If you only want to update one specific domain:

        ```python theme={null}
        def remediate_single_domain(domain_name, region=REGION):
            es_client = boto3.client("es", region_name=region)
            status = describe_domain(es_client, domain_name)
            sso = status.get("ServiceSoftwareOptions", {})
            update_status = sso.get("UpdateStatus")

            if update_status in ("ELIGIBLE", "PENDING_UPDATE"):
                print(f"Starting service software update for {domain_name}...")
                start_software_update(es_client, domain_name)
            else:
                print(f"No update required or already in progress for {domain_name} (status: {update_status}).")
        ```

        ***

        Run the script, monitor updates in:

        * AWS Console → Amazon OpenSearch Service / Elasticsearch → your domain → “Service software”,
          or
        * Use `describe_elasticsearch_domain` periodically to check `UpdateStatus` until it becomes `COMPLETED`.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Enable automatic service software updates for the domain
        resource "aws_opensearch_domain" "this" {
          domain_name = "YOUR_DOMAIN_NAME" # e.g. "prod-search"

          # ... other required configuration (cluster_config, ebs_options, etc.) ...

          software_update_options {
            auto_software_update_enabled = true
          }
        }
        ```

        Substitute:

        * `YOUR_DOMAIN_NAME` with your actual OpenSearch/Elasticsearch domain name.

        This change is in-place and does not force replacement of the domain, but may cause AWS-managed maintenance windows when service software is applied.

        Note: Terraform cannot directly trigger an immediate service software update (the AWS API call is `StartElasticsearchServiceSoftwareUpdate` / `StartOpensearchServiceSoftwareUpdate` and is a runtime action). To remediate “use latest service software” **now**, you must start the update via AWS Console or CLI, then use Terraform as above to ensure future updates are applied automatically.

        Verification: `terraform plan` should show `software_update_options.auto_software_update_enabled` changing from `false` (or unset) to `true` on the `aws_opensearch_domain` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>