Best practices for Amazon Elasticsearch Service

Apply a restrictive resource-based access policy to the domain (or enable fine-grained access control), and follow the principle of least privilege when granting access to the configuration API and the Elasticsearch APIs.

Configure at least one replica, the Elasticsearch default, for each index.

Use three dedicated master nodes.

Deploy the domain across three Availability Zones. This configuration lets Amazon ES distribute replica shards to different Availability Zones than their corresponding primary shards.

Upgrade to the latest Elasticsearch versions as they become available on Amazon Elasticsearch Service.

Update to the latest service software as it becomes available.

Size the domain appropriately for your workload. For storage volume, shard size, and data node recommendations, see Sizing Amazon Elasticsearch Service domains and Petabyte scale for Amazon Elasticsearch Service. For dedicated master node recommendations, see Dedicated master nodes in Amazon Elasticsearch Service.

Have no more than 1,000 shards on any data node. This limit is the default in Elasticsearch 7.x and later. For a more nuanced guideline, see Choosing the number of shards.

Use the latest-generation instances available on the service. For example, use I3 instances rather than I2 instances.

Don't use T2 or t3.small instances for production domains; they can become unstable under sustained heavy load. t3.medium instances are an option for small production workloads (both as data nodes and dedicated master nodes).

If appropriate for your network configuration, create the domain within a VPC.

If your domain stores sensitive data, enable encryption of data at rest and node-to-node encryption.