Opensearch Data Node Should Have Fault Tolerance

More Info:

This rule checks if Amazon OpenSearch Service domains are configured with at least three data nodes and zoneAwarenessEnabled is true. The rule is NON_COMPLIANT for an OpenSearch domain if ‘instanceCount’ is less than 3 or ‘zoneAwarenessEnabled’ is set to ‘false’.

Risk Level

Medium

Address

Configuration

Compliance Standards

CBP

Triage and Remediation

Remediation

Using Console

Using CLI

To enable fault tolerance for OpenSearch data nodes in AWS, you can follow these steps using the AWS CLI:

Identify the OpenSearch domain: Run the following AWS CLI command to list all the OpenSearch domains in your AWS account:
```
aws opensearchservice list-domain-names
```
Get the configuration of the OpenSearch domain: Run the following AWS CLI command to get the configuration of the specific OpenSearch domain:
```
aws opensearchservice describe-elasticsearch-domain --domain-name YOUR_DOMAIN_NAME
```
Update the domain configuration to enable fault tolerance: Run the following AWS CLI command to update the domain configuration and enable fault tolerance for data nodes:
```
aws opensearchservice update-elasticsearch-domain-config --domain-name YOUR_DOMAIN_NAME --elasticsearch-cluster-config '{"InstanceType": "m5.large.search", "InstanceCount": 2, "DedicatedMasterEnabled": false, "ZoneAwarenessEnabled": true}'
```
In this command:
- Replace YOUR_DOMAIN_NAME with the name of your OpenSearch domain.
- Adjust the InstanceType and InstanceCount values as per your requirements.
- Set ZoneAwarenessEnabled to true to enable fault tolerance across Availability Zones.
Monitor the domain status: Run the following AWS CLI command to monitor the status of the OpenSearch domain until it is active:
```
aws opensearchservice describe-elasticsearch-domain --domain-name YOUR_DOMAIN_NAME
```

By following these steps and using the AWS CLI commands provided, you can enable fault tolerance for OpenSearch data nodes in AWS.

Using Python

To remediate the misconfiguration of Opensearch Data Node not having fault tolerance in AWS OpenSearch using Python, follow these steps:

Define the AWS OpenSearch domain configuration using the AWS SDK for Python (Boto3). Ensure that the domain has multiple data nodes for fault tolerance.

import boto3

client = boto3.client('es')

domain_name = 'your-opensearch-domain-name'

# Update the domain configuration to have multiple data nodes for fault tolerance
response = client.update_elasticsearch_domain_config(
    DomainName=domain_name,
    ElasticsearchClusterConfig={
        'InstanceType': 'm5.large.elasticsearch',
        'InstanceCount': 2,  # Set the number of data nodes for fault tolerance
        'DedicatedMasterEnabled': False,
        'ZoneAwarenessEnabled': True,
    }
)

print(response)

Run the Python script to update the AWS OpenSearch domain configuration with fault tolerance enabled for data nodes.
Verify the domain configuration in the AWS Management Console or by using the describe_elasticsearch_domain_config API to ensure that the fault tolerance settings have been applied successfully.

By following these steps, you can remediate the misconfiguration of Opensearch Data Node not having fault tolerance in AWS OpenSearch using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Opensearch Data Node Should Have Fault Tolerance

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation