This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# Amazon OpenSearch Service
<a name="AWS_OpenSearchService"></a>

**Resource types**
+ [AWS::OpenSearchService::Application](aws-resource-opensearchservice-application.md)
+ [AWS::OpenSearchService::Domain](aws-resource-opensearchservice-domain.md)

# AWS::OpenSearchService::Application
<a name="aws-resource-opensearchservice-application"></a>

Creates an OpenSearch UI application. For more information, see [Using the OpenSearch user interface in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html).

## Syntax
<a name="aws-resource-opensearchservice-application-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-opensearchservice-application-syntax.json"></a>

```
{
  "Type" : "AWS::OpenSearchService::Application",
  "Properties" : {
      "[AppConfigs](#cfn-opensearchservice-application-appconfigs)" : [ AppConfig, ... ],
      "[DataSources](#cfn-opensearchservice-application-datasources)" : [ DataSource, ... ],
      "[Endpoint](#cfn-opensearchservice-application-endpoint)" : String,
      "[IamIdentityCenterOptions](#cfn-opensearchservice-application-iamidentitycenteroptions)" : IamIdentityCenterOptions,
      "[Name](#cfn-opensearchservice-application-name)" : String,
      "[Tags](#cfn-opensearchservice-application-tags)" : [ Tag, ... ]
    }
}
```

### YAML
<a name="aws-resource-opensearchservice-application-syntax.yaml"></a>

```
Type: AWS::OpenSearchService::Application
Properties:
  [AppConfigs](#cfn-opensearchservice-application-appconfigs): 
    - AppConfig
  [DataSources](#cfn-opensearchservice-application-datasources): 
    - DataSource
  [Endpoint](#cfn-opensearchservice-application-endpoint): String
  [IamIdentityCenterOptions](#cfn-opensearchservice-application-iamidentitycenteroptions): 
    IamIdentityCenterOptions
  [Name](#cfn-opensearchservice-application-name): String
  [Tags](#cfn-opensearchservice-application-tags): 
    - Tag
```

## Properties
<a name="aws-resource-opensearchservice-application-properties"></a>

`AppConfigs`  <a name="cfn-opensearchservice-application-appconfigs"></a>
Property description not available.  
*Required*: No  
*Type*: Array of [AppConfig](aws-properties-opensearchservice-application-appconfig.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DataSources`  <a name="cfn-opensearchservice-application-datasources"></a>
Property description not available.  
*Required*: No  
*Type*: Array of [DataSource](aws-properties-opensearchservice-application-datasource.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Endpoint`  <a name="cfn-opensearchservice-application-endpoint"></a>
The endpoint URL of an OpenSearch application.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IamIdentityCenterOptions`  <a name="cfn-opensearchservice-application-iamidentitycenteroptions"></a>
Settings container for integrating IAM Identity Center with OpenSearch UI applications, which enables enabling secure user authentication and access control across multiple data sources. This setup supports single sign-on (SSO) through IAM Identity Center, allowing centralized user management.  
*Required*: No  
*Type*: [IamIdentityCenterOptions](aws-properties-opensearchservice-application-iamidentitycenteroptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Name`  <a name="cfn-opensearchservice-application-name"></a>
The name of an OpenSearch application.  
*Required*: Yes  
*Type*: String  
*Pattern*: `[a-z][a-z0-9\-]+`  
*Minimum*: `3`  
*Maximum*: `40`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Tags`  <a name="cfn-opensearchservice-application-tags"></a>
Property description not available.  
*Required*: No  
*Type*: Array of [Tag](aws-properties-opensearchservice-application-tag.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-opensearchservice-application-return-values"></a>

### Ref
<a name="aws-resource-opensearchservice-application-return-values-ref"></a>

### Fn::GetAtt
<a name="aws-resource-opensearchservice-application-return-values-fn--getatt"></a>

#### 
<a name="aws-resource-opensearchservice-application-return-values-fn--getatt-fn--getatt"></a>

`Arn`  <a name="Arn-fn::getatt"></a>
The Amazon Resource Name (ARN) of the domain. See [Identifiers for IAM Entities ](https://docs.aws.amazon.com/IAM/latest/UserGuide/index.html) in *Using AWS Identity and Access Management* for more information. 

`Id`  <a name="Id-fn::getatt"></a>
The unique identifier of an OpenSearch application.

# AWS::OpenSearchService::Application AppConfig
<a name="aws-properties-opensearchservice-application-appconfig"></a>

Configuration settings for an OpenSearch application. For more information, see [Using the OpenSearch user interface in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html).

## Syntax
<a name="aws-properties-opensearchservice-application-appconfig-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-application-appconfig-syntax.json"></a>

```
{
  "[Key](#cfn-opensearchservice-application-appconfig-key)" : String,
  "[Value](#cfn-opensearchservice-application-appconfig-value)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-application-appconfig-syntax.yaml"></a>

```
  [Key](#cfn-opensearchservice-application-appconfig-key): String
  [Value](#cfn-opensearchservice-application-appconfig-value): String
```

## Properties
<a name="aws-properties-opensearchservice-application-appconfig-properties"></a>

`Key`  <a name="cfn-opensearchservice-application-appconfig-key"></a>
The configuration item to set, such as the admin role for the OpenSearch application.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `opensearchDashboards.dashboardAdmin.users | opensearchDashboards.dashboardAdmin.groups`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-opensearchservice-application-appconfig-value"></a>
The value assigned to the configuration key, such as an IAM user ARN.  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Application DataSource
<a name="aws-properties-opensearchservice-application-datasource"></a>

Data sources that are associated with an OpenSearch application. 

## Syntax
<a name="aws-properties-opensearchservice-application-datasource-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-application-datasource-syntax.json"></a>

```
{
  "[DataSourceArn](#cfn-opensearchservice-application-datasource-datasourcearn)" : String,
  "[DataSourceDescription](#cfn-opensearchservice-application-datasource-datasourcedescription)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-application-datasource-syntax.yaml"></a>

```
  [DataSourceArn](#cfn-opensearchservice-application-datasource-datasourcearn): String
  [DataSourceDescription](#cfn-opensearchservice-application-datasource-datasourcedescription): String
```

## Properties
<a name="aws-properties-opensearchservice-application-datasource-properties"></a>

`DataSourceArn`  <a name="cfn-opensearchservice-application-datasource-datasourcearn"></a>
Property description not available.  
*Required*: Yes  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DataSourceDescription`  <a name="cfn-opensearchservice-application-datasource-datasourcedescription"></a>
Detailed description of a data source.  
*Required*: No  
*Type*: String  
*Pattern*: `^([a-zA-Z0-9_])*[\\a-zA-Z0-9_@#%*+=:?./!\s-]*$`  
*Maximum*: `1000`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Application IamIdentityCenterOptions
<a name="aws-properties-opensearchservice-application-iamidentitycenteroptions"></a>

Configuration settings for IAM Identity Center in an OpenSearch application.

## Syntax
<a name="aws-properties-opensearchservice-application-iamidentitycenteroptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-application-iamidentitycenteroptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-application-iamidentitycenteroptions-enabled)" : Boolean,
  "[IamIdentityCenterInstanceArn](#cfn-opensearchservice-application-iamidentitycenteroptions-iamidentitycenterinstancearn)" : String,
  "[IamRoleForIdentityCenterApplicationArn](#cfn-opensearchservice-application-iamidentitycenteroptions-iamroleforidentitycenterapplicationarn)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-application-iamidentitycenteroptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-application-iamidentitycenteroptions-enabled): Boolean
  [IamIdentityCenterInstanceArn](#cfn-opensearchservice-application-iamidentitycenteroptions-iamidentitycenterinstancearn): String
  [IamRoleForIdentityCenterApplicationArn](#cfn-opensearchservice-application-iamidentitycenteroptions-iamroleforidentitycenterapplicationarn): String
```

## Properties
<a name="aws-properties-opensearchservice-application-iamidentitycenteroptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-application-iamidentitycenteroptions-enabled"></a>
Indicates whether IAM Identity Center is enabled for the OpenSearch application.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IamIdentityCenterInstanceArn`  <a name="cfn-opensearchservice-application-iamidentitycenteroptions-iamidentitycenterinstancearn"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IamRoleForIdentityCenterApplicationArn`  <a name="cfn-opensearchservice-application-iamidentitycenteroptions-iamroleforidentitycenterapplicationarn"></a>
The Amazon Resource Name (ARN) of the IAM role assigned to the IAM Identity Center application for the OpenSearch application.  
*Required*: No  
*Type*: String  
*Pattern*: `arn:(aws|aws\-cn|aws\-us\-gov|aws\-iso|aws\-iso\-b):iam::[0-9]+:role\/.*`  
*Minimum*: `20`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Application Tag
<a name="aws-properties-opensearchservice-application-tag"></a>

A tag (key-value pair) for an Amazon OpenSearch Service resource.

## Syntax
<a name="aws-properties-opensearchservice-application-tag-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-application-tag-syntax.json"></a>

```
{
  "[Key](#cfn-opensearchservice-application-tag-key)" : String,
  "[Value](#cfn-opensearchservice-application-tag-value)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-application-tag-syntax.yaml"></a>

```
  [Key](#cfn-opensearchservice-application-tag-key): String
  [Value](#cfn-opensearchservice-application-tag-value): String
```

## Properties
<a name="aws-properties-opensearchservice-application-tag-properties"></a>

`Key`  <a name="cfn-opensearchservice-application-tag-key"></a>
The tag key. Tag keys must be unique for the domain to which they are attached.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-opensearchservice-application-tag-value"></a>
The value assigned to the corresponding tag key. Tag values can be null and don't have to be unique in a tag set. For example, you can have a key value pair in a tag set of `project : Trinity` and `cost-center : Trinity`  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain
<a name="aws-resource-opensearchservice-domain"></a>

The AWS::OpenSearchService::Domain resource creates an Amazon OpenSearch Service domain.

## Syntax
<a name="aws-resource-opensearchservice-domain-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-opensearchservice-domain-syntax.json"></a>

```
{
  "Type" : "AWS::OpenSearchService::Domain",
  "Properties" : {
      "[AccessPolicies](#cfn-opensearchservice-domain-accesspolicies)" : Json,
      "[AdvancedOptions](#cfn-opensearchservice-domain-advancedoptions)" : {Key: Value, ...},
      "[AdvancedSecurityOptions](#cfn-opensearchservice-domain-advancedsecurityoptions)" : AdvancedSecurityOptionsInput,
      "[AIMLOptions](#cfn-opensearchservice-domain-aimloptions)" : AIMLOptions,
      "[ClusterConfig](#cfn-opensearchservice-domain-clusterconfig)" : ClusterConfig,
      "[CognitoOptions](#cfn-opensearchservice-domain-cognitooptions)" : CognitoOptions,
      "[DeploymentStrategyOptions](#cfn-opensearchservice-domain-deploymentstrategyoptions)" : DeploymentStrategyOptions,
      "[DomainEndpointOptions](#cfn-opensearchservice-domain-domainendpointoptions)" : DomainEndpointOptions,
      "[DomainName](#cfn-opensearchservice-domain-domainname)" : String,
      "[EBSOptions](#cfn-opensearchservice-domain-ebsoptions)" : EBSOptions,
      "[EncryptionAtRestOptions](#cfn-opensearchservice-domain-encryptionatrestoptions)" : EncryptionAtRestOptions,
      "[EngineVersion](#cfn-opensearchservice-domain-engineversion)" : String,
      "[IdentityCenterOptions](#cfn-opensearchservice-domain-identitycenteroptions)" : IdentityCenterOptions,
      "[IPAddressType](#cfn-opensearchservice-domain-ipaddresstype)" : String,
      "[LogPublishingOptions](#cfn-opensearchservice-domain-logpublishingoptions)" : {Key: Value, ...},
      "[NodeToNodeEncryptionOptions](#cfn-opensearchservice-domain-nodetonodeencryptionoptions)" : NodeToNodeEncryptionOptions,
      "[OffPeakWindowOptions](#cfn-opensearchservice-domain-offpeakwindowoptions)" : OffPeakWindowOptions,
      "[SkipShardMigrationWait](#cfn-opensearchservice-domain-skipshardmigrationwait)" : Boolean,
      "[SnapshotOptions](#cfn-opensearchservice-domain-snapshotoptions)" : SnapshotOptions,
      "[SoftwareUpdateOptions](#cfn-opensearchservice-domain-softwareupdateoptions)" : SoftwareUpdateOptions,
      "[Tags](#cfn-opensearchservice-domain-tags)" : [ Tag, ... ],
      "[VPCOptions](#cfn-opensearchservice-domain-vpcoptions)" : VPCOptions
    }
}
```

### YAML
<a name="aws-resource-opensearchservice-domain-syntax.yaml"></a>

```
Type: AWS::OpenSearchService::Domain
Properties:
  [AccessPolicies](#cfn-opensearchservice-domain-accesspolicies): Json
  [AdvancedOptions](#cfn-opensearchservice-domain-advancedoptions): 
    Key: Value
  [AdvancedSecurityOptions](#cfn-opensearchservice-domain-advancedsecurityoptions): 
    AdvancedSecurityOptionsInput
  [AIMLOptions](#cfn-opensearchservice-domain-aimloptions): 
    AIMLOptions
  [ClusterConfig](#cfn-opensearchservice-domain-clusterconfig): 
    ClusterConfig
  [CognitoOptions](#cfn-opensearchservice-domain-cognitooptions): 
    CognitoOptions
  [DeploymentStrategyOptions](#cfn-opensearchservice-domain-deploymentstrategyoptions): 
    DeploymentStrategyOptions
  [DomainEndpointOptions](#cfn-opensearchservice-domain-domainendpointoptions): 
    DomainEndpointOptions
  [DomainName](#cfn-opensearchservice-domain-domainname): String
  [EBSOptions](#cfn-opensearchservice-domain-ebsoptions): 
    EBSOptions
  [EncryptionAtRestOptions](#cfn-opensearchservice-domain-encryptionatrestoptions): 
    EncryptionAtRestOptions
  [EngineVersion](#cfn-opensearchservice-domain-engineversion): String
  [IdentityCenterOptions](#cfn-opensearchservice-domain-identitycenteroptions): 
    IdentityCenterOptions
  [IPAddressType](#cfn-opensearchservice-domain-ipaddresstype): String
  [LogPublishingOptions](#cfn-opensearchservice-domain-logpublishingoptions): 
    Key: Value
  [NodeToNodeEncryptionOptions](#cfn-opensearchservice-domain-nodetonodeencryptionoptions): 
    NodeToNodeEncryptionOptions
  [OffPeakWindowOptions](#cfn-opensearchservice-domain-offpeakwindowoptions): 
    OffPeakWindowOptions
  [SkipShardMigrationWait](#cfn-opensearchservice-domain-skipshardmigrationwait): Boolean
  [SnapshotOptions](#cfn-opensearchservice-domain-snapshotoptions): 
    SnapshotOptions
  [SoftwareUpdateOptions](#cfn-opensearchservice-domain-softwareupdateoptions): 
    SoftwareUpdateOptions
  [Tags](#cfn-opensearchservice-domain-tags): 
    - Tag
  [VPCOptions](#cfn-opensearchservice-domain-vpcoptions): 
    VPCOptions
```

## Properties
<a name="aws-resource-opensearchservice-domain-properties"></a>

`AccessPolicies`  <a name="cfn-opensearchservice-domain-accesspolicies"></a>
An AWS Identity and Access Management (IAM) policy document that specifies who can access the OpenSearch Service domain and their permissions. For more information, see [Configuring access policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-creating) in the *Amazon OpenSearch Service Developer Guide*.  
*Required*: No  
*Type*: Json  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`AdvancedOptions`  <a name="cfn-opensearchservice-domain-advancedoptions"></a>
Additional options to specify for the OpenSearch Service domain. For more information, see [AdvancedOptions](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateDomain.html#API_CreateDomain_RequestBody) in the OpenSearch Service API reference.  
*Required*: No  
*Type*: Object of String  
*Pattern*: `[a-zA-Z0-9]+`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`AdvancedSecurityOptions`  <a name="cfn-opensearchservice-domain-advancedsecurityoptions"></a>
Specifies options for fine-grained access control and SAML authentication.  
If you specify advanced security options, you must also enable node-to-node encryption ([NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html)) and encryption at rest ([EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html)). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html), which requires HTTPS for all traffic to the domain.  
*Required*: No  
*Type*: [AdvancedSecurityOptionsInput](aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`AIMLOptions`  <a name="cfn-opensearchservice-domain-aimloptions"></a>
Container for parameters required to enable all machine learning features.  
*Required*: No  
*Type*: [AIMLOptions](aws-properties-opensearchservice-domain-aimloptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ClusterConfig`  <a name="cfn-opensearchservice-domain-clusterconfig"></a>
Container for the cluster configuration of a domain.  
*Required*: No  
*Type*: [ClusterConfig](aws-properties-opensearchservice-domain-clusterconfig.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CognitoOptions`  <a name="cfn-opensearchservice-domain-cognitooptions"></a>
Configures OpenSearch Service to use Amazon Cognito authentication for OpenSearch Dashboards.  
*Required*: No  
*Type*: [CognitoOptions](aws-properties-opensearchservice-domain-cognitooptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DeploymentStrategyOptions`  <a name="cfn-opensearchservice-domain-deploymentstrategyoptions"></a>
The current status of the domain's deployment strategy options.  
*Required*: No  
*Type*: [DeploymentStrategyOptions](aws-properties-opensearchservice-domain-deploymentstrategyoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DomainEndpointOptions`  <a name="cfn-opensearchservice-domain-domainendpointoptions"></a>
Specifies additional options for the domain endpoint, such as whether to require HTTPS for all traffic or whether to use a custom endpoint rather than the default endpoint.  
*Required*: No  
*Type*: [DomainEndpointOptions](aws-properties-opensearchservice-domain-domainendpointoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DomainName`  <a name="cfn-opensearchservice-domain-domainname"></a>
A name for the OpenSearch Service domain. The name must have a minimum length of 3 and a maximum length of 28. If you don't specify a name, CloudFormation generates a unique physical ID and uses that ID for the domain name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html).  
Required when creating a new domain.  
If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
*Required*: Conditional  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`EBSOptions`  <a name="cfn-opensearchservice-domain-ebsoptions"></a>
The configurations of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to data nodes in the OpenSearch Service domain. For more information, see [EBS volume size limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html#ebsresource) in the *Amazon OpenSearch Service Developer Guide*.  
*Required*: No  
*Type*: [EBSOptions](aws-properties-opensearchservice-domain-ebsoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`EncryptionAtRestOptions`  <a name="cfn-opensearchservice-domain-encryptionatrestoptions"></a>
Whether the domain should encrypt data at rest, and if so, the AWS KMS key to use. See [Encryption of data at rest for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html).  
If no encryption at rest options were initially specified in the template, updating this property by adding it causes no interruption. However, if you change this property after it's already been set within a template, the domain is deleted and recreated in order to modify the property.  
*Required*: No  
*Type*: [EncryptionAtRestOptions](aws-properties-opensearchservice-domain-encryptionatrestoptions.md)  
*Update requires*: [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)

`EngineVersion`  <a name="cfn-opensearchservice-domain-engineversion"></a>
The version of OpenSearch to use. The value must be in the format `OpenSearch_X.Y` or `Elasticsearch_X.Y`. If not specified, the latest version of OpenSearch is used. For information about the versions that OpenSearch Service supports, see [Supported versions of OpenSearch and Elasticsearch](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html#choosing-version) in the *Amazon OpenSearch Service Developer Guide*.  
If you set the [EnableVersionUpgrade](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-upgradeopensearchdomain) update policy to `true`, you can update `EngineVersion` without interruption. When `EnableVersionUpgrade` is set to `false`, or is not specified, updating `EngineVersion` results in [replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement).  
*Required*: Conditional  
*Type*: String  
*Pattern*: `^Elasticsearch_[0-9]{1}\.[0-9]{1,2}$|^OpenSearch_[0-9]{1,2}\.[0-9]{1,2}$`  
*Minimum*: `14`  
*Maximum*: `18`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IdentityCenterOptions`  <a name="cfn-opensearchservice-domain-identitycenteroptions"></a>
Configuration options for controlling IAM Identity Center integration within a domain.  
*Required*: No  
*Type*: [IdentityCenterOptions](aws-properties-opensearchservice-domain-identitycenteroptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IPAddressType`  <a name="cfn-opensearchservice-domain-ipaddresstype"></a>
Choose either dual stack or IPv4 as your IP address type. Dual stack allows you to share domain resources across IPv4 and IPv6 address types, and is the recommended option. If you set your IP address type to dual stack, you can't change your address type later.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`LogPublishingOptions`  <a name="cfn-opensearchservice-domain-logpublishingoptions"></a>
An object with one or more of the following keys: `SEARCH_SLOW_LOGS`, `ES_APPLICATION_LOGS`, `INDEX_SLOW_LOGS`, `AUDIT_LOGS`, depending on the types of logs you want to publish. Each key needs a valid `LogPublishingOption` value. For the full syntax, see the [examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-opensearchservice-domain.html#aws-resource-opensearchservice-domain--examples).  
*Required*: No  
*Type*: Object of [LogPublishingOption](aws-properties-opensearchservice-domain-logpublishingoption.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NodeToNodeEncryptionOptions`  <a name="cfn-opensearchservice-domain-nodetonodeencryptionoptions"></a>
Specifies whether node-to-node encryption is enabled. See [Node-to-node encryption for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ntn.html).  
*Required*: No  
*Type*: [NodeToNodeEncryptionOptions](aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OffPeakWindowOptions`  <a name="cfn-opensearchservice-domain-offpeakwindowoptions"></a>
Options for a domain's off-peak window, during which OpenSearch Service can perform mandatory configuration changes on the domain.  
*Required*: No  
*Type*: [OffPeakWindowOptions](aws-properties-opensearchservice-domain-offpeakwindowoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SkipShardMigrationWait`  <a name="cfn-opensearchservice-domain-skipshardmigrationwait"></a>
Property description not available.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SnapshotOptions`  <a name="cfn-opensearchservice-domain-snapshotoptions"></a>
**DEPRECATED**. The automated snapshot configuration for the OpenSearch Service domain indexes.  
*Required*: No  
*Type*: [SnapshotOptions](aws-properties-opensearchservice-domain-snapshotoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SoftwareUpdateOptions`  <a name="cfn-opensearchservice-domain-softwareupdateoptions"></a>
Service software update options for the domain.  
*Required*: No  
*Type*: [SoftwareUpdateOptions](aws-properties-opensearchservice-domain-softwareupdateoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Tags`  <a name="cfn-opensearchservice-domain-tags"></a>
An arbitrary set of tags (key–value pairs) to associate with the OpenSearch Service domain.  
*Required*: No  
*Type*: Array of [Tag](aws-properties-opensearchservice-domain-tag.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`VPCOptions`  <a name="cfn-opensearchservice-domain-vpcoptions"></a>
The virtual private cloud (VPC) configuration for the OpenSearch Service domain. For more information, see [Launching your Amazon OpenSearch Service domains within a VPC](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html) in the *Amazon OpenSearch Service Developer Guide*.  
If you remove this entity altogether, along with its associated properties, it causes a replacement. You might encounter this scenario if you're updating your security configuration from a VPC to a public endpoint.  
*Required*: No  
*Type*: [VPCOptions](aws-properties-opensearchservice-domain-vpcoptions.md)  
*Update requires*: [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)

## Return values
<a name="aws-resource-opensearchservice-domain-return-values"></a>

### Ref
<a name="aws-resource-opensearchservice-domain-return-values-ref"></a>

When the logical ID of this resource is provided to the Ref intrinsic function, Ref returns the resource name, such as `mystack-abc1d2efg3h4.` For more information about using the Ref function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-opensearchservice-domain-return-values-fn--getatt"></a>

GetAtt returns a value for a specified attribute of this type. For more information, see [Fn::GetAtt](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html). The following are the available attributes and sample return values.

#### 
<a name="aws-resource-opensearchservice-domain-return-values-fn--getatt-fn--getatt"></a>

`AdvancedSecurityOptions.AnonymousAuthDisableDate`  <a name="AdvancedSecurityOptions.AnonymousAuthDisableDate-fn::getatt"></a>
Date and time when the migration period will be disabled. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing).

`Arn`  <a name="Arn-fn::getatt"></a>
The Amazon Resource Name (ARN) of the CloudFormation stack.

`DomainArn`  <a name="DomainArn-fn::getatt"></a>
The Amazon Resource Name (ARN) of the domain. See [Identifiers for IAM Entities ](https://docs.aws.amazon.com/IAM/latest/UserGuide/index.html) in *Using AWS Identity and Access Management* for more information. 

`DomainEndpoint`  <a name="DomainEndpoint-fn::getatt"></a>
The domain-specific endpoint used for requests to the OpenSearch APIs, such as `search-mystack-1ab2cdefghij-ab1c2deckoyb3hofw7wpqa3cm.us-west-1.es.amazonaws.com`.

`DomainEndpointV2`  <a name="DomainEndpointV2-fn::getatt"></a>
If `IPAddressType` to set to `dualstack`, a version 2 domain endpoint is provisioned. This endpoint functions like a normal endpoint, except that it works with both IPv4 and IPv6 IP addresses. Normal endpoints work only with IPv4 IP addresses. 

`Id`  <a name="Id-fn::getatt"></a>
The resource ID. For example, `123456789012/my-domain`.

`IdentityCenterOptions.IdentityCenterApplicationARN`  <a name="IdentityCenterOptions.IdentityCenterApplicationARN-fn::getatt"></a>
The Amazon Resource Name (ARN) of the domain. See [Identifiers for IAM Entities ](https://docs.aws.amazon.com/IAM/latest/UserGuide/index.html) in *Using AWS Identity and Access Management* for more information. 

`IdentityCenterOptions.IdentityStoreId`  <a name="IdentityCenterOptions.IdentityStoreId-fn::getatt"></a>
Property description not available.

## Remarks
<a name="aws-resource-opensearchservice-domain--remarks"></a>

 *Migrating stacks from Elasticsearch to OpenSearch* 

**Important**  
You can't directly update CloudFormation templates to use the `AWS::OpenSearchService::Domain` resource in place of `AWS::Elasticsearch::Domain`, otherwise the corresponding domain will be deleted along with all of its data.

Perform the following steps to migrate an Elasticsearch domain to an OpenSearch domain if the domain is defined within CloudFormation.

 **Step 1: Prepare your existing stack for deprecation** 

Make a copy of your original CloudFormation template, which contains the Elasticsearch domain resource, for use in step 3. Then add the following attributes to the Elasticsearch domain resource at the same level as `Type` and `Properties`. 

 `DeletionPolicy: Retain` 

 `UpdateReplacePolicy: Retain` 

These settings ensure that CloudFormation doesn't delete or modify the corresponding domain when you delete this resource from your stack. If you have other custom resources defined in the stack that aren't critically important during the short migration period, you can delete them from the template and they'll be recreated when you create the new stack.

 **Step 2: Upgrade your domain to OpenSearch** 

After you add the two policy attributes to your template, upgrade your domain to an OpenSearch version using the normal upgrade process. For instructions, see [Starting an upgrade](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/version-migration.html#starting-upgrades). Make sure to take a snapshot of your domain before upgrading it to prevent accidental loss of data.

 **Step 3: Create a new CloudFormation template** 

While you wait for the upgrade to complete, prepare your new OpenSearch template. Using the copy of your original template that you made in step 1, make the following changes:
+ Change the domain resource type from `AWS::Elasticsearch::Domain` to `AWS::OpenSearchService::Domain`.
+ Add the `DeletionPolicy` and `UpdateReplacePolicy` attributes to the resource, as you did in step 1.
+ Change `ElasticsearchVersion` to `EngineVersion` and set its value to `OpenSearch_1.0` (or whichever version of OpenSearch you want to upgrade to).
+ If your resource contains `ElasticsearchClusterConfig`, change it to `ClusterConfig`.
+ Change the suffixes of all instance types from `.elasticsearch` to `.search`.
+ If there are any `Fn::GetAtt` or `!GetAtt` references to your domain ARN, change them to `!GetAtt MyDomain.Arn`.
+ Comment out any resources not currently within the stack (most likely everything except `AWS::OpenSearchService::Domain`).

See the next section for examples that demonstrate the new format.

 **Step 4: Import the OpenSearch stack** 

Once your domain upgrade finishes, you can import the new stack. Within CloudFormation, choose **Create stack** and **With existing resources (import resources)**, then upload the template you created in the previous step.

CloudFormation prompts you for the name (identifier value) of the existing domain. Copy the domain name directly from the OpenSearch console. Give the stack a name that's different from the current one, then choose **Import resources**.

After the stack is created, uncomment any related resources from the stack and update it to ensure they're recreated. You can remove the `DeletionPolicy` and `UpdateReplacePolicy` attributes if you want, but they can help prevent accidental deletions in the future.

 **Step 5: Delete the Elasticsearch stack** 

Now that your new stack is created, delete the old stack which contains the legacy Elasticsearch resource.

**Important**  
Before deleting the old stack, make absolutely sure that the template contains the `DeletionPolicy: Retain` attribute.

\$1The above steps were partially derived from this [blog post](https://onecloudplease.com/blog/migrating-to-opensearch-with-cloudformation).

## Examples
<a name="aws-resource-opensearchservice-domain--examples"></a>



**Topics**
+ [Create an OpenSearch Service domain that contains two data nodes and three master nodes](#aws-resource-opensearchservice-domain--examples--Create_an_OpenSearch_Service_domain_that_contains_two_data_nodes_and_three_master_nodes)
+ [Create a domain with VPC options](#aws-resource-opensearchservice-domain--examples--Create_a_domain_with_VPC_options)
+ [Create a domain with fine-grained access control](#aws-resource-opensearchservice-domain--examples--Create_a_domain_with_fine-grained_access_control)

### Create an OpenSearch Service domain that contains two data nodes and three master nodes
<a name="aws-resource-opensearchservice-domain--examples--Create_an_OpenSearch_Service_domain_that_contains_two_data_nodes_and_three_master_nodes"></a>

The following example creates an OpenSearch Service domain running OpenSearch 1.0 that contains two data nodes and three dedicated master nodes. The domain has 40 GiB of storage and enables log publishing for application logs, search slow logs, and index slow logs. The access policy permits the root user for the AWS account to make all HTTP requests to the domain, such as indexing documents or searching indexes.

#### JSON
<a name="aws-resource-opensearchservice-domain--examples--Create_an_OpenSearch_Service_domain_that_contains_two_data_nodes_and_three_master_nodes--json"></a>

```
"OpenSearchServiceDomain": {
   "Type":"AWS::OpenSearchService::Domain",
   "Properties": {
      "DomainName": "test",
      "EngineVersion": "OpenSearch_1.0",
      "ClusterConfig": {
         "DedicatedMasterEnabled": true,
         "InstanceCount": "2",
         "ZoneAwarenessEnabled": true,
         "InstanceType": "m3.medium.search",
         "DedicatedMasterType": "m3.medium.search",
         "DedicatedMasterCount": "3"
      },
      "EBSOptions":{
         "EBSEnabled": true,
         "Iops": "0",
         "VolumeSize": "20",
         "VolumeType": "gp2"
      },
      "AccessPolicies": {
         "Version":"2012-10-17",		 	 	 
         "Statement":[
            {
               "Effect": "Allow",
               "Principal": {
                  "AWS": "arn:aws:iam::123456789012:user/opensearch-user"
               },
               "Action":"es:*",
               "Resource": "arn:aws:es:us-east-1:123456789012:domain/test/*"
            }
         ]
      },
      "LogPublishingOptions": {
         "ES_APPLICATION_LOGS": {
           "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-application-logs",
           "Enabled": true
         },
         "SEARCH_SLOW_LOGS": {
           "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-slow-logs",
           "Enabled": true
         },
         "INDEX_SLOW_LOGS": {
           "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-index-slow-logs",
           "Enabled": true
         }
      },
      "AdvancedOptions": {
         "rest.action.multi.allow_explicit_index": "true",
         "override_main_response_version": "true"
      }
   }
}
```

#### YAML
<a name="aws-resource-opensearchservice-domain--examples--Create_an_OpenSearch_Service_domain_that_contains_two_data_nodes_and_three_master_nodes--yaml"></a>

```
OpenSearchServiceDomain:
  Type: AWS::OpenSearchService::Domain
  Properties:
    DomainName: 'test'
    EngineVersion: 'OpenSearch_1.0'
    ClusterConfig:
      DedicatedMasterEnabled: true
      InstanceCount: '2'
      ZoneAwarenessEnabled: true
      InstanceType: 'm3.medium.search'
      DedicatedMasterType: 'm3.medium.search'
      DedicatedMasterCount: '3'
    EBSOptions:
      EBSEnabled: true
      Iops: '0'
      VolumeSize: '20'
      VolumeType: 'gp2'
    AccessPolicies:
      Version: '2012-10-17		 	 	 '
      Statement:
        -
          Effect: 'Allow'
          Principal:
            AWS: 'arn:aws:iam::123456789012:user/opensearch-user'
          Action: 'es:*'
          Resource: 'arn:aws:es:us-east-1:846973539254:domain/test/*'
    LogPublishingOptions:
      ES_APPLICATION_LOGS:
          CloudWatchLogsLogGroupArn: 'arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-application-logs'
          Enabled: true
      SEARCH_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: 'arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-slow-logs'
          Enabled: true
      INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: 'arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-index-slow-logs'
          Enabled: true
    AdvancedOptions:
      rest.action.multi.allow_explicit_index: 'true'
      override_main_response_version: 'true'
```

### Create a domain with VPC options
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_VPC_options"></a>

The following example creates a domain with VPC options.

#### JSON
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_VPC_options--json"></a>

```
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "OpenSearchServiceDomain resource",
  "Parameters": {
    "DomainName": {
      "Description": "User-defined OpenSearch domain name",
      "Type": "String"
    },
    "EngineVersion": {
      "Description": "User-defined OpenSearch version",
      "Type": "String"
    },
    "InstanceType": {
      "Type": "String"
    },
    "AvailabilityZone": {
      "Type": "String"
    },
    "CidrBlock": {
      "Type": "String"
    },
    "GroupDescription": {
      "Type": "String"
    },
    "SGName": {
      "Type": "String"
    }
  },
  "Resources": {
    "OpenSearchServiceDomain": {
      "Type": "AWS::OpenSearchService::Domain",
      "Properties": {
        "DomainName": {
          "Ref": "DomainName"
        },
        "EngineVersion": {
          "Ref": "EngineVersion"
        },
        "ClusterConfig": {
          "InstanceCount": "1",
          "InstanceType": {
            "Ref": "InstanceType"
          }
        },
        "EBSOptions": {
          "EBSEnabled": true,
          "Iops": "0",
          "VolumeSize": "10",
          "VolumeType": "standard"
        },
        "AccessPolicies": {
          "Version": "2012-10-17",		 	 	 
          "Statement": [
            {
              "Effect": "Deny",
              "Principal": {
                "AWS": "*"
              },
              "Action": "es:*",
              "Resource": "*"
            }
          ]
        },
        "AdvancedOptions": {
          "rest.action.multi.allow_explicit_index": "true",
          "override_main_response_version": "true"
        },
        "Tags": [
          {
            "Key": "foo",
            "Value": "bar"
          }
        ],
        "VPCOptions": {
          "SubnetIds": [
            {
              "Ref": "subnet"
            }
          ],
          "SecurityGroupIds": [
            {
              "Ref": "mySecurityGroup"
            }
          ]
        }
      }
    },
    "vpc": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.0.0.0/16"
      }
    },
    "subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "vpc"
        },
        "CidrBlock": {
          "Ref": "CidrBlock"
        },
        "AvailabilityZone": {
          "Ref": "AvailabilityZone"
        }
      }
    },
    "mySecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": {
          "Ref": "GroupDescription"
        },
        "VpcId": {
          "Ref": "vpc"
        },
        "GroupName": {
          "Ref": "SGName"
        },
        "SecurityGroupIngress": [
          {
            "FromPort": 443,
            "IpProtocol": "tcp",
            "ToPort": 443,
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    }
  },
  "Outputs": {
    "Arn": {
      "Value": {
        "Fn::GetAtt": [
          "OpenSearchServiceDomain",
          "Arn"
        ]
      }
    },
    "DomainEndpoint": {
      "Value": {
        "Fn::GetAtt": [
          "OpenSearchServiceDomain",
          "DomainEndpoint"
        ]
      }
    },
    "SecurityGroupId": {
      "Value": {
        "Ref": "mySecurityGroup"
      }
    },
    "SubnetId": {
      "Value": {
        "Ref": "subnet"
      }
    }
  }
}
```

#### YAML
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_VPC_options--yaml"></a>

```
AWSTemplateFormatVersion: '2010-09-09'
Description: OpenSearchServiceDomain resource
Parameters:
  DomainName:
    Description: User-defined OpenSearch domain name
    Type: String
  EngineVersion:
    Description: User-defined OpenSearch version
    Type: String
  InstanceType:
    Type: String
  AvailabilityZone:
    Type: String
  CidrBlock:
    Type: String
  GroupDescription:
    Type: String
  SGName:
    Type: String
Resources:
  OpenSearchServiceDomain:
    Type: 'AWS::OpenSearchService::Domain'
    Properties:
      DomainName:
        Ref: DomainName
      EngineVersion:
        Ref: EngineVersion
      ClusterConfig:
        InstanceCount: '1'
        InstanceType:
          Ref: InstanceType
      EBSOptions:
        EBSEnabled: true
        Iops: '0'
        VolumeSize: '10'
        VolumeType: 'standard'
      AccessPolicies:
        Version: '2012-10-17		 	 	 '
        Statement:
          - Effect: Deny
            Principal:
              AWS: '*'
            Action: 'es:*'
            Resource: '*'
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: 'true'
        override_main_response_version: 'true'
      Tags:
        - Key: foo
          Value: bar
      VPCOptions:
        SubnetIds:
          - Ref: subnet
        SecurityGroupIds:
          - Ref: mySecurityGroup
  vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: 10.0.0.0/16
  subnet:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId:
        Ref: vpc
      CidrBlock:
        Ref: CidrBlock
      AvailabilityZone:
        Ref: AvailabilityZone
  mySecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription:
        Ref: GroupDescription
      VpcId:
        Ref: vpc
      GroupName:
        Ref: SGName
      SecurityGroupIngress:
        - FromPort: 443
          IpProtocol: tcp
          ToPort: 443
          CidrIp: 0.0.0.0/0
Outputs:
  Arn:
    Value:
      'Fn::GetAtt':
        - OpenSearchServiceDomain
        - Arn
  DomainEndpoint:
    Value:
      'Fn::GetAtt':
        - OpenSearchServiceDomain
        - DomainEndpoint
  SecurityGroupId:
    Value:
      Ref: mySecurityGroup
  SubnetId:
    Value:
      Ref: subnet
```

### Create a domain with fine-grained access control
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_fine-grained_access_control"></a>

The following example creates a domain with fine-grained access control.

#### JSON
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_fine-grained_access_control--json"></a>

```
{
  "OpenSearchServiceDomain": {
    "Type": "AWS::OpenSearchService::Domain",
    "Properties": {
      "DomainName": "my-domain-logs",
      "EngineVersion": "OpenSearch_1.0",
      "ClusterConfig": {
        "InstanceCount": 2,
        "InstanceType": "r6g.xlarge.search",
        "DedicatedMasterEnabled": true,
        "DedicatedMasterCount": 3,
        "DedicatedMasterType": "r6g.xlarge.search"
      },
      "EBSOptions": {
        "EBSEnabled": true,
        "VolumeSize": 10,
        "VolumeType": "gp2"
      },
      "AccessPolicies": {
        "Version": "2012-10-17",		 	 	 
        "Statement": {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::478253424788:role/Admin"
          },
          "Action": "es:*",
          "Resource": "arn:aws:es:us-east-1:478253424788:domain/my-domain-logs/*"
        }
      }
    },
    "AdvancedSecurityOptions": {
      "Enabled": true,
      "InternalUserDatabaseEnabled": true,
      "MasterUserOptions": {
        "MasterUserName": "<username>",
        "MasterUserPassword": "<password>"
      }
    }
  }
}
```

#### YAML
<a name="aws-resource-opensearchservice-domain--examples--Create_a_domain_with_fine-grained_access_control--yaml"></a>

```
OpenSearchServiceDomain:
  Type: 'AWS::OpenSearchService::Domain'
  Properties:
    DomainName: my-domain-logs
    EngineVersion: OpenSearch_1.0
    ClusterConfig:
      InstanceCount: 2
      InstanceType: r6g.xlarge.search
      DedicatedMasterEnabled: true
      DedicatedMasterCount: 3
      DedicatedMasterType: r6g.xlarge.search
    EBSOptions:
      EBSEnabled: true
      VolumeSize: 10
      VolumeType: gp2
    AccessPolicies:
      Version: '2012-10-17		 	 	 '
      Statement:
        Effect: Allow
        Principal:
          AWS: 'arn:aws:iam::478253424788:role/Admin'
        Action: 'es:*'
        Resource: 'arn:aws:es:us-east-1:478253424788:domain/my-domain-logs/*'
  AdvancedSecurityOptions:
    Enabled: true
    InternalUserDatabaseEnabled: true
    MasterUserOptions:
      MasterUserName: <username>
      MasterUserPassword: <password>
```

# AWS::OpenSearchService::Domain AdvancedSecurityOptionsInput
<a name="aws-properties-opensearchservice-domain-advancedsecurityoptionsinput"></a>

Specifies options for fine-grained access control.

If you specify advanced security options, you must also enable node-to-node encryption ([NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html)) and encryption at rest ([EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html)). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html), which requires HTTPS for all traffic to the domain.

## Syntax
<a name="aws-properties-opensearchservice-domain-advancedsecurityoptionsinput-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-advancedsecurityoptionsinput-syntax.json"></a>

```
{
  "[AnonymousAuthDisableDate](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthdisabledate)" : String,
  "[AnonymousAuthEnabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthenabled)" : Boolean,
  "[Enabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-enabled)" : Boolean,
  "[IAMFederationOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-iamfederationoptions)" : IAMFederationOptions,
  "[InternalUserDatabaseEnabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-internaluserdatabaseenabled)" : Boolean,
  "[JWTOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-jwtoptions)" : JWTOptions,
  "[MasterUserOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-masteruseroptions)" : MasterUserOptions,
  "[SAMLOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-samloptions)" : SAMLOptions
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-advancedsecurityoptionsinput-syntax.yaml"></a>

```
  [AnonymousAuthDisableDate](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthdisabledate): String
  [AnonymousAuthEnabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthenabled): Boolean
  [Enabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-enabled): Boolean
  [IAMFederationOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-iamfederationoptions): 
    IAMFederationOptions
  [InternalUserDatabaseEnabled](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-internaluserdatabaseenabled): Boolean
  [JWTOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-jwtoptions): 
    JWTOptions
  [MasterUserOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-masteruseroptions): 
    MasterUserOptions
  [SAMLOptions](#cfn-opensearchservice-domain-advancedsecurityoptionsinput-samloptions): 
    SAMLOptions
```

## Properties
<a name="aws-properties-opensearchservice-domain-advancedsecurityoptionsinput-properties"></a>

`AnonymousAuthDisableDate`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthdisabledate"></a>
Date and time when the migration period will be disabled. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing).  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`AnonymousAuthEnabled`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-anonymousauthenabled"></a>
True to enable a 30-day migration period during which administrators can create role mappings. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Enabled`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-enabled"></a>
True to enable fine-grained access control. You must also enable encryption of data at rest and node-to-node encryption. See [Fine-grained access control in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IAMFederationOptions`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-iamfederationoptions"></a>
Input configuration for IAM identity federation within advanced security options.  
*Required*: No  
*Type*: [IAMFederationOptions](aws-properties-opensearchservice-domain-iamfederationoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`InternalUserDatabaseEnabled`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-internaluserdatabaseenabled"></a>
True to enable the internal user database.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`JWTOptions`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-jwtoptions"></a>
Container for information about the JWT configuration of the Amazon OpenSearch Service.   
*Required*: No  
*Type*: [JWTOptions](aws-properties-opensearchservice-domain-jwtoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MasterUserOptions`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-masteruseroptions"></a>
Specifies information about the master user.  
*Required*: No  
*Type*: [MasterUserOptions](aws-properties-opensearchservice-domain-masteruseroptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SAMLOptions`  <a name="cfn-opensearchservice-domain-advancedsecurityoptionsinput-samloptions"></a>
Container for information about the SAML configuration for OpenSearch Dashboards.  
*Required*: No  
*Type*: [SAMLOptions](aws-properties-opensearchservice-domain-samloptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain AIMLOptions
<a name="aws-properties-opensearchservice-domain-aimloptions"></a>

<a name="aws-properties-opensearchservice-domain-aimloptions-description"></a>The `AIMLOptions` property type specifies Property description not available. for an [AWS::OpenSearchService::Domain](aws-resource-opensearchservice-domain.md).

## Syntax
<a name="aws-properties-opensearchservice-domain-aimloptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-aimloptions-syntax.json"></a>

```
{
  "[S3VectorsEngine](#cfn-opensearchservice-domain-aimloptions-s3vectorsengine)" : S3VectorsEngine,
  "[ServerlessVectorAcceleration](#cfn-opensearchservice-domain-aimloptions-serverlessvectoracceleration)" : ServerlessVectorAcceleration
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-aimloptions-syntax.yaml"></a>

```
  [S3VectorsEngine](#cfn-opensearchservice-domain-aimloptions-s3vectorsengine): 
    S3VectorsEngine
  [ServerlessVectorAcceleration](#cfn-opensearchservice-domain-aimloptions-serverlessvectoracceleration): 
    ServerlessVectorAcceleration
```

## Properties
<a name="aws-properties-opensearchservice-domain-aimloptions-properties"></a>

`S3VectorsEngine`  <a name="cfn-opensearchservice-domain-aimloptions-s3vectorsengine"></a>
Property description not available.  
*Required*: No  
*Type*: [S3VectorsEngine](aws-properties-opensearchservice-domain-s3vectorsengine.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ServerlessVectorAcceleration`  <a name="cfn-opensearchservice-domain-aimloptions-serverlessvectoracceleration"></a>
Property description not available.  
*Required*: No  
*Type*: [ServerlessVectorAcceleration](aws-properties-opensearchservice-domain-serverlessvectoracceleration.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain ClusterConfig
<a name="aws-properties-opensearchservice-domain-clusterconfig"></a>

The cluster configuration for the OpenSearch Service domain. You can specify options such as the instance type and the number of instances. For more information, see [Creating and managing Amazon OpenSearch Service domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html) in the *Amazon OpenSearch Service Developer Guide*.

## Syntax
<a name="aws-properties-opensearchservice-domain-clusterconfig-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-clusterconfig-syntax.json"></a>

```
{
  "[ColdStorageOptions](#cfn-opensearchservice-domain-clusterconfig-coldstorageoptions)" : ColdStorageOptions,
  "[DedicatedMasterCount](#cfn-opensearchservice-domain-clusterconfig-dedicatedmastercount)" : Integer,
  "[DedicatedMasterEnabled](#cfn-opensearchservice-domain-clusterconfig-dedicatedmasterenabled)" : Boolean,
  "[DedicatedMasterType](#cfn-opensearchservice-domain-clusterconfig-dedicatedmastertype)" : String,
  "[InstanceCount](#cfn-opensearchservice-domain-clusterconfig-instancecount)" : Integer,
  "[InstanceType](#cfn-opensearchservice-domain-clusterconfig-instancetype)" : String,
  "[MultiAZWithStandbyEnabled](#cfn-opensearchservice-domain-clusterconfig-multiazwithstandbyenabled)" : Boolean,
  "[NodeOptions](#cfn-opensearchservice-domain-clusterconfig-nodeoptions)" : [ NodeOption, ... ],
  "[WarmCount](#cfn-opensearchservice-domain-clusterconfig-warmcount)" : Integer,
  "[WarmEnabled](#cfn-opensearchservice-domain-clusterconfig-warmenabled)" : Boolean,
  "[WarmType](#cfn-opensearchservice-domain-clusterconfig-warmtype)" : String,
  "[ZoneAwarenessConfig](#cfn-opensearchservice-domain-clusterconfig-zoneawarenessconfig)" : ZoneAwarenessConfig,
  "[ZoneAwarenessEnabled](#cfn-opensearchservice-domain-clusterconfig-zoneawarenessenabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-clusterconfig-syntax.yaml"></a>

```
  [ColdStorageOptions](#cfn-opensearchservice-domain-clusterconfig-coldstorageoptions): 
    ColdStorageOptions
  [DedicatedMasterCount](#cfn-opensearchservice-domain-clusterconfig-dedicatedmastercount): Integer
  [DedicatedMasterEnabled](#cfn-opensearchservice-domain-clusterconfig-dedicatedmasterenabled): Boolean
  [DedicatedMasterType](#cfn-opensearchservice-domain-clusterconfig-dedicatedmastertype): String
  [InstanceCount](#cfn-opensearchservice-domain-clusterconfig-instancecount): Integer
  [InstanceType](#cfn-opensearchservice-domain-clusterconfig-instancetype): String
  [MultiAZWithStandbyEnabled](#cfn-opensearchservice-domain-clusterconfig-multiazwithstandbyenabled): Boolean
  [NodeOptions](#cfn-opensearchservice-domain-clusterconfig-nodeoptions): 
    - NodeOption
  [WarmCount](#cfn-opensearchservice-domain-clusterconfig-warmcount): Integer
  [WarmEnabled](#cfn-opensearchservice-domain-clusterconfig-warmenabled): Boolean
  [WarmType](#cfn-opensearchservice-domain-clusterconfig-warmtype): String
  [ZoneAwarenessConfig](#cfn-opensearchservice-domain-clusterconfig-zoneawarenessconfig): 
    ZoneAwarenessConfig
  [ZoneAwarenessEnabled](#cfn-opensearchservice-domain-clusterconfig-zoneawarenessenabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-clusterconfig-properties"></a>

`ColdStorageOptions`  <a name="cfn-opensearchservice-domain-clusterconfig-coldstorageoptions"></a>
Container for cold storage configuration options.  
*Required*: No  
*Type*: [ColdStorageOptions](aws-properties-opensearchservice-domain-coldstorageoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DedicatedMasterCount`  <a name="cfn-opensearchservice-domain-clusterconfig-dedicatedmastercount"></a>
The number of instances to use for the master node. If you specify this property, you must specify `true` for the `DedicatedMasterEnabled` property.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DedicatedMasterEnabled`  <a name="cfn-opensearchservice-domain-clusterconfig-dedicatedmasterenabled"></a>
Indicates whether to use a dedicated master node for the OpenSearch Service domain. A dedicated master node is a cluster node that performs cluster management tasks, but doesn't hold data or respond to data upload requests. Dedicated master nodes offload cluster management tasks to increase the stability of your search clusters. See [Dedicated master nodes in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DedicatedMasterType`  <a name="cfn-opensearchservice-domain-clusterconfig-dedicatedmastertype"></a>
The hardware configuration of the computer that hosts the dedicated master node, such as `m3.medium.search`. If you specify this property, you must specify `true` for the `DedicatedMasterEnabled` property. For valid values, see [Supported instance types in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html).  
*Required*: No  
*Type*: String  
*Allowed values*: `m3.medium.search | m3.large.search | m3.xlarge.search | m3.2xlarge.search | m4.large.search | m4.xlarge.search | m4.2xlarge.search | m4.4xlarge.search | m4.10xlarge.search | m5.large.search | m5.xlarge.search | m5.2xlarge.search | m5.4xlarge.search | m5.12xlarge.search | m5.24xlarge.search | r5.large.search | r5.xlarge.search | r5.2xlarge.search | r5.4xlarge.search | r5.12xlarge.search | r5.24xlarge.search | c5.large.search | c5.xlarge.search | c5.2xlarge.search | c5.4xlarge.search | c5.9xlarge.search | c5.18xlarge.search | t3.nano.search | t3.micro.search | t3.small.search | t3.medium.search | t3.large.search | t3.xlarge.search | t3.2xlarge.search | or1.medium.search | or1.large.search | or1.xlarge.search | or1.2xlarge.search | or1.4xlarge.search | or1.8xlarge.search | or1.12xlarge.search | or1.16xlarge.search | ultrawarm1.medium.search | ultrawarm1.large.search | ultrawarm1.xlarge.search | t2.micro.search | t2.small.search | t2.medium.search | r3.large.search | r3.xlarge.search | r3.2xlarge.search | r3.4xlarge.search | r3.8xlarge.search | i2.xlarge.search | i2.2xlarge.search | d2.xlarge.search | d2.2xlarge.search | d2.4xlarge.search | d2.8xlarge.search | c4.large.search | c4.xlarge.search | c4.2xlarge.search | c4.4xlarge.search | c4.8xlarge.search | r4.large.search | r4.xlarge.search | r4.2xlarge.search | r4.4xlarge.search | r4.8xlarge.search | r4.16xlarge.search | i3.large.search | i3.xlarge.search | i3.2xlarge.search | i3.4xlarge.search | i3.8xlarge.search | i3.16xlarge.search | r6g.large.search | r6g.xlarge.search | r6g.2xlarge.search | r6g.4xlarge.search | r6g.8xlarge.search | r6g.12xlarge.search | m6g.large.search | m6g.xlarge.search | m6g.2xlarge.search | m6g.4xlarge.search | m6g.8xlarge.search | m6g.12xlarge.search | c6g.large.search | c6g.xlarge.search | c6g.2xlarge.search | c6g.4xlarge.search | c6g.8xlarge.search | c6g.12xlarge.search | r6gd.large.search | r6gd.xlarge.search | r6gd.2xlarge.search | r6gd.4xlarge.search | r6gd.8xlarge.search | r6gd.12xlarge.search | r6gd.16xlarge.search | t4g.small.search | t4g.medium.search`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`InstanceCount`  <a name="cfn-opensearchservice-domain-clusterconfig-instancecount"></a>
The number of data nodes (instances) to use in the OpenSearch Service domain.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`InstanceType`  <a name="cfn-opensearchservice-domain-clusterconfig-instancetype"></a>
The instance type for your data nodes, such as `m3.medium.search`. For valid values, see [Supported instance types in Amazon OpenSearch Service ](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html).  
*Required*: No  
*Type*: String  
*Allowed values*: `m3.medium.search | m3.large.search | m3.xlarge.search | m3.2xlarge.search | m4.large.search | m4.xlarge.search | m4.2xlarge.search | m4.4xlarge.search | m4.10xlarge.search | m5.large.search | m5.xlarge.search | m5.2xlarge.search | m5.4xlarge.search | m5.12xlarge.search | m5.24xlarge.search | r5.large.search | r5.xlarge.search | r5.2xlarge.search | r5.4xlarge.search | r5.12xlarge.search | r5.24xlarge.search | c5.large.search | c5.xlarge.search | c5.2xlarge.search | c5.4xlarge.search | c5.9xlarge.search | c5.18xlarge.search | t3.nano.search | t3.micro.search | t3.small.search | t3.medium.search | t3.large.search | t3.xlarge.search | t3.2xlarge.search | or1.medium.search | or1.large.search | or1.xlarge.search | or1.2xlarge.search | or1.4xlarge.search | or1.8xlarge.search | or1.12xlarge.search | or1.16xlarge.search | ultrawarm1.medium.search | ultrawarm1.large.search | ultrawarm1.xlarge.search | t2.micro.search | t2.small.search | t2.medium.search | r3.large.search | r3.xlarge.search | r3.2xlarge.search | r3.4xlarge.search | r3.8xlarge.search | i2.xlarge.search | i2.2xlarge.search | d2.xlarge.search | d2.2xlarge.search | d2.4xlarge.search | d2.8xlarge.search | c4.large.search | c4.xlarge.search | c4.2xlarge.search | c4.4xlarge.search | c4.8xlarge.search | r4.large.search | r4.xlarge.search | r4.2xlarge.search | r4.4xlarge.search | r4.8xlarge.search | r4.16xlarge.search | i3.large.search | i3.xlarge.search | i3.2xlarge.search | i3.4xlarge.search | i3.8xlarge.search | i3.16xlarge.search | r6g.large.search | r6g.xlarge.search | r6g.2xlarge.search | r6g.4xlarge.search | r6g.8xlarge.search | r6g.12xlarge.search | m6g.large.search | m6g.xlarge.search | m6g.2xlarge.search | m6g.4xlarge.search | m6g.8xlarge.search | m6g.12xlarge.search | c6g.large.search | c6g.xlarge.search | c6g.2xlarge.search | c6g.4xlarge.search | c6g.8xlarge.search | c6g.12xlarge.search | r6gd.large.search | r6gd.xlarge.search | r6gd.2xlarge.search | r6gd.4xlarge.search | r6gd.8xlarge.search | r6gd.12xlarge.search | r6gd.16xlarge.search | t4g.small.search | t4g.medium.search`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MultiAZWithStandbyEnabled`  <a name="cfn-opensearchservice-domain-clusterconfig-multiazwithstandbyenabled"></a>
Indicates whether Multi-AZ with Standby deployment option is enabled. For more information, see [Multi-AZ with Standby](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-multiaz.html#managedomains-za-standby).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NodeOptions`  <a name="cfn-opensearchservice-domain-clusterconfig-nodeoptions"></a>
List of node options for the domain.  
*Required*: No  
*Type*: Array of [NodeOption](aws-properties-opensearchservice-domain-nodeoption.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`WarmCount`  <a name="cfn-opensearchservice-domain-clusterconfig-warmcount"></a>
The number of warm nodes in the cluster.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`WarmEnabled`  <a name="cfn-opensearchservice-domain-clusterconfig-warmenabled"></a>
Whether to enable UltraWarm storage for the cluster. See [UltraWarm storage for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ultrawarm.html).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`WarmType`  <a name="cfn-opensearchservice-domain-clusterconfig-warmtype"></a>
The instance type for the cluster's warm nodes.  
*Required*: No  
*Type*: String  
*Allowed values*: `ultrawarm1.medium.search | ultrawarm1.large.search | ultrawarm1.xlarge.search`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ZoneAwarenessConfig`  <a name="cfn-opensearchservice-domain-clusterconfig-zoneawarenessconfig"></a>
Specifies zone awareness configuration options. Only use if `ZoneAwarenessEnabled` is `true`.  
*Required*: No  
*Type*: [ZoneAwarenessConfig](aws-properties-opensearchservice-domain-zoneawarenessconfig.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ZoneAwarenessEnabled`  <a name="cfn-opensearchservice-domain-clusterconfig-zoneawarenessenabled"></a>
Indicates whether to enable zone awareness for the OpenSearch Service domain. When you enable zone awareness, OpenSearch Service allocates the nodes and replica index shards that belong to a cluster across two Availability Zones (AZs) in the same region to prevent data loss and minimize downtime in the event of node or data center failure. Don't enable zone awareness if your cluster has no replica index shards or is a single-node cluster. For more information, see [Configuring a multi-AZ domain in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-multiaz.html).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain CognitoOptions
<a name="aws-properties-opensearchservice-domain-cognitooptions"></a>

Configures OpenSearch Service to use Amazon Cognito authentication for OpenSearch Dashboards.

## Syntax
<a name="aws-properties-opensearchservice-domain-cognitooptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-cognitooptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-cognitooptions-enabled)" : Boolean,
  "[IdentityPoolId](#cfn-opensearchservice-domain-cognitooptions-identitypoolid)" : String,
  "[RoleArn](#cfn-opensearchservice-domain-cognitooptions-rolearn)" : String,
  "[UserPoolId](#cfn-opensearchservice-domain-cognitooptions-userpoolid)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-cognitooptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-cognitooptions-enabled): Boolean
  [IdentityPoolId](#cfn-opensearchservice-domain-cognitooptions-identitypoolid): String
  [RoleArn](#cfn-opensearchservice-domain-cognitooptions-rolearn): String
  [UserPoolId](#cfn-opensearchservice-domain-cognitooptions-userpoolid): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-cognitooptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-cognitooptions-enabled"></a>
Whether to enable or disable Amazon Cognito authentication for OpenSearch Dashboards. See [Amazon Cognito authentication for OpenSearch Dashboards](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html).  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IdentityPoolId`  <a name="cfn-opensearchservice-domain-cognitooptions-identitypoolid"></a>
The Amazon Cognito identity pool ID that you want OpenSearch Service to use for OpenSearch Dashboards authentication.  
Required if you enabled Cognito Authentication for OpenSearch Dashboards.  
*Required*: Conditional  
*Type*: String  
*Pattern*: `[\w-]+:[0-9a-f-]+`  
*Minimum*: `1`  
*Maximum*: `55`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RoleArn`  <a name="cfn-opensearchservice-domain-cognitooptions-rolearn"></a>
The `AmazonOpenSearchServiceCognitoAccess` role that allows OpenSearch Service to configure your user pool and identity pool.  
Required if you enabled Cognito Authentication for OpenSearch Dashboards.  
*Required*: Conditional  
*Type*: String  
*Pattern*: `arn:(aws|aws\-cn|aws\-us\-gov|aws\-iso|aws\-iso\-b):iam::[0-9]+:role\/.*`  
*Minimum*: `20`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UserPoolId`  <a name="cfn-opensearchservice-domain-cognitooptions-userpoolid"></a>
The Amazon Cognito user pool ID that you want OpenSearch Service to use for OpenSearch Dashboards authentication.  
Required if you enabled Cognito Authentication for OpenSearch Dashboards.  
*Required*: Conditional  
*Type*: String  
*Pattern*: `[\w-]+_[0-9a-zA-Z]+`  
*Minimum*: `1`  
*Maximum*: `55`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain ColdStorageOptions
<a name="aws-properties-opensearchservice-domain-coldstorageoptions"></a>

Container for the parameters required to enable cold storage for an OpenSearch Service domain. For more information, see [Cold storage for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cold-storage.html).

## Syntax
<a name="aws-properties-opensearchservice-domain-coldstorageoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-coldstorageoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-coldstorageoptions-enabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-coldstorageoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-coldstorageoptions-enabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-coldstorageoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-coldstorageoptions-enabled"></a>
Whether to enable or disable cold storage on the domain. You must enable UltraWarm storage to enable cold storage.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain DeploymentStrategyOptions
<a name="aws-properties-opensearchservice-domain-deploymentstrategyoptions"></a>

Specifies the deployment strategy options for the domain.

## Syntax
<a name="aws-properties-opensearchservice-domain-deploymentstrategyoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-deploymentstrategyoptions-syntax.json"></a>

```
{
  "[DeploymentStrategy](#cfn-opensearchservice-domain-deploymentstrategyoptions-deploymentstrategy)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-deploymentstrategyoptions-syntax.yaml"></a>

```
  [DeploymentStrategy](#cfn-opensearchservice-domain-deploymentstrategyoptions-deploymentstrategy): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-deploymentstrategyoptions-properties"></a>

`DeploymentStrategy`  <a name="cfn-opensearchservice-domain-deploymentstrategyoptions-deploymentstrategy"></a>
Specifies the deployment strategy for the domain. Valid values are `Default` and `CapacityOptimized`.  
*Required*: No  
*Type*: String  
*Allowed values*: `Default | CapacityOptimized`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain DomainEndpointOptions
<a name="aws-properties-opensearchservice-domain-domainendpointoptions"></a>

Specifies additional options for the domain endpoint, such as whether to require HTTPS for all traffic or whether to use a custom endpoint rather than the default endpoint.

## Syntax
<a name="aws-properties-opensearchservice-domain-domainendpointoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-domainendpointoptions-syntax.json"></a>

```
{
  "[CustomEndpoint](#cfn-opensearchservice-domain-domainendpointoptions-customendpoint)" : String,
  "[CustomEndpointCertificateArn](#cfn-opensearchservice-domain-domainendpointoptions-customendpointcertificatearn)" : String,
  "[CustomEndpointEnabled](#cfn-opensearchservice-domain-domainendpointoptions-customendpointenabled)" : Boolean,
  "[EnforceHTTPS](#cfn-opensearchservice-domain-domainendpointoptions-enforcehttps)" : Boolean,
  "[TLSSecurityPolicy](#cfn-opensearchservice-domain-domainendpointoptions-tlssecuritypolicy)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-domainendpointoptions-syntax.yaml"></a>

```
  [CustomEndpoint](#cfn-opensearchservice-domain-domainendpointoptions-customendpoint): String
  [CustomEndpointCertificateArn](#cfn-opensearchservice-domain-domainendpointoptions-customendpointcertificatearn): String
  [CustomEndpointEnabled](#cfn-opensearchservice-domain-domainendpointoptions-customendpointenabled): Boolean
  [EnforceHTTPS](#cfn-opensearchservice-domain-domainendpointoptions-enforcehttps): Boolean
  [TLSSecurityPolicy](#cfn-opensearchservice-domain-domainendpointoptions-tlssecuritypolicy): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-domainendpointoptions-properties"></a>

`CustomEndpoint`  <a name="cfn-opensearchservice-domain-domainendpointoptions-customendpoint"></a>
The fully qualified URL for your custom endpoint. Required if you enabled a custom endpoint for the domain.  
*Required*: Conditional  
*Type*: String  
*Pattern*: `^(((?!-)[A-Za-z0-9-]{0,62}[A-Za-z0-9])\.)+((?!-)[A-Za-z0-9-]{1,62}[A-Za-z0-9])$`  
*Minimum*: `1`  
*Maximum*: `255`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CustomEndpointCertificateArn`  <a name="cfn-opensearchservice-domain-domainendpointoptions-customendpointcertificatearn"></a>
The AWS Certificate Manager ARN for your domain's SSL/TLS certificate. Required if you enabled a custom endpoint for the domain.  
*Required*: Conditional  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CustomEndpointEnabled`  <a name="cfn-opensearchservice-domain-domainendpointoptions-customendpointenabled"></a>
True to enable a custom endpoint for the domain. If enabled, you must also provide values for `CustomEndpoint` and `CustomEndpointCertificateArn`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`EnforceHTTPS`  <a name="cfn-opensearchservice-domain-domainendpointoptions-enforcehttps"></a>
True to require that all traffic to the domain arrive over HTTPS. Required if you enable fine-grained access control in [AdvancedSecurityOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
*Required*: Conditional  
*Type*: Boolean  
*Update requires*: [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)

`TLSSecurityPolicy`  <a name="cfn-opensearchservice-domain-domainendpointoptions-tlssecuritypolicy"></a>
The minimum TLS version required for traffic to the domain. The policy can be one of the following values:  
+ **Policy-Min-TLS-1-0-2019-07:** TLS security policy that supports TLS version 1.0 to TLS version 1.2
+ **Policy-Min-TLS-1-2-2019-07:** TLS security policy that supports only TLS version 1.2
+ **Policy-Min-TLS-1-2-PFS-2023-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with perfect forward secrecy cipher suites
*Required*: No  
*Type*: String  
*Allowed values*: `Policy-Min-TLS-1-0-2019-07 | Policy-Min-TLS-1-2-2019-07 | Policy-Min-TLS-1-2-PFS-2023-10 | Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain EBSOptions
<a name="aws-properties-opensearchservice-domain-ebsoptions"></a>

The configurations of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to data nodes in the OpenSearch Service domain. For more information, see [EBS volume size limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html#ebsresource) in the *Amazon OpenSearch Service Developer Guide*.

## Syntax
<a name="aws-properties-opensearchservice-domain-ebsoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-ebsoptions-syntax.json"></a>

```
{
  "[EBSEnabled](#cfn-opensearchservice-domain-ebsoptions-ebsenabled)" : Boolean,
  "[Iops](#cfn-opensearchservice-domain-ebsoptions-iops)" : Integer,
  "[Throughput](#cfn-opensearchservice-domain-ebsoptions-throughput)" : Integer,
  "[VolumeSize](#cfn-opensearchservice-domain-ebsoptions-volumesize)" : Integer,
  "[VolumeType](#cfn-opensearchservice-domain-ebsoptions-volumetype)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-ebsoptions-syntax.yaml"></a>

```
  [EBSEnabled](#cfn-opensearchservice-domain-ebsoptions-ebsenabled): Boolean
  [Iops](#cfn-opensearchservice-domain-ebsoptions-iops): Integer
  [Throughput](#cfn-opensearchservice-domain-ebsoptions-throughput): Integer
  [VolumeSize](#cfn-opensearchservice-domain-ebsoptions-volumesize): Integer
  [VolumeType](#cfn-opensearchservice-domain-ebsoptions-volumetype): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-ebsoptions-properties"></a>

`EBSEnabled`  <a name="cfn-opensearchservice-domain-ebsoptions-ebsenabled"></a>
Specifies whether Amazon EBS volumes are attached to data nodes in the OpenSearch Service domain.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Iops`  <a name="cfn-opensearchservice-domain-ebsoptions-iops"></a>
The number of I/O operations per second (IOPS) that the volume supports. This property applies only to the `gp3` and provisioned IOPS EBS volume types.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Throughput`  <a name="cfn-opensearchservice-domain-ebsoptions-throughput"></a>
The throughput (in MiB/s) of the EBS volumes attached to data nodes. Applies only to the `gp3` volume type.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`VolumeSize`  <a name="cfn-opensearchservice-domain-ebsoptions-volumesize"></a>
The size (in GiB) of the EBS volume for each data node. The minimum and maximum size of an EBS volume depends on the EBS volume type and the instance type to which it is attached. For more information, see [EBS volume size limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html#ebsresource) in the *Amazon OpenSearch Service Developer Guide*.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`VolumeType`  <a name="cfn-opensearchservice-domain-ebsoptions-volumetype"></a>
The EBS volume type to use with the OpenSearch Service domain. If you choose `gp3`, you must also specify values for `Iops` and `Throughput`. For more information about each type, see [Amazon EBS volume types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) in the *Amazon EC2 User Guide for Linux Instances*.  
*Required*: No  
*Type*: String  
*Allowed values*: `standard | gp2 | io1 | gp3`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain EncryptionAtRestOptions
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions"></a>

Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service key to use.

## Syntax
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-encryptionatrestoptions-enabled)" : Boolean,
  "[KmsKeyId](#cfn-opensearchservice-domain-encryptionatrestoptions-kmskeyid)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-encryptionatrestoptions-enabled): Boolean
  [KmsKeyId](#cfn-opensearchservice-domain-encryptionatrestoptions-kmskeyid): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-encryptionatrestoptions-enabled"></a>
Specify `true` to enable encryption at rest. Required if you enable fine-grained access control in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
If no encryption at rest options were initially specified in the template, updating this property by adding it causes no interruption. However, if you change this property after it's already been set within a template, the domain is deleted and recreated in order to modify the property.  
*Required*: Conditional  
*Type*: Boolean  
*Update requires*: [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)

`KmsKeyId`  <a name="cfn-opensearchservice-domain-encryptionatrestoptions-kmskeyid"></a>
The KMS key ID. Takes the form `1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a`. Required if you enable encryption at rest.  
You can also use `keyAlias` as a value.  
If no encryption at rest options were initially specified in the template, updating this property by adding it causes no interruption. However, if you change this property after it's already been set within a template, the domain is deleted and recreated in order to modify the property.  
*Required*: Conditional  
*Type*: String  
*Pattern*: `.*`  
*Minimum*: `1`  
*Maximum*: `500`  
*Update requires*: [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)

## See also
<a name="aws-properties-opensearchservice-domain-encryptionatrestoptions--seealso"></a>
+ [CreateDomain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-createdomain) in the *Amazon OpenSearch Service Developer Guide*.



# AWS::OpenSearchService::Domain IAMFederationOptions
<a name="aws-properties-opensearchservice-domain-iamfederationoptions"></a>

<a name="aws-properties-opensearchservice-domain-iamfederationoptions-description"></a>The `IAMFederationOptions` property type specifies Property description not available. for an [AWS::OpenSearchService::Domain](aws-resource-opensearchservice-domain.md).

## Syntax
<a name="aws-properties-opensearchservice-domain-iamfederationoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-iamfederationoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-iamfederationoptions-enabled)" : Boolean,
  "[RolesKey](#cfn-opensearchservice-domain-iamfederationoptions-roleskey)" : String,
  "[SubjectKey](#cfn-opensearchservice-domain-iamfederationoptions-subjectkey)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-iamfederationoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-iamfederationoptions-enabled): Boolean
  [RolesKey](#cfn-opensearchservice-domain-iamfederationoptions-roleskey): String
  [SubjectKey](#cfn-opensearchservice-domain-iamfederationoptions-subjectkey): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-iamfederationoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-iamfederationoptions-enabled"></a>
Property description not available.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RolesKey`  <a name="cfn-opensearchservice-domain-iamfederationoptions-roleskey"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubjectKey`  <a name="cfn-opensearchservice-domain-iamfederationoptions-subjectkey"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain IdentityCenterOptions
<a name="aws-properties-opensearchservice-domain-identitycenteroptions"></a>

Settings container for integrating IAM Identity Center with OpenSearch UI applications, which enables enabling secure user authentication and access control across multiple data sources. This setup supports single sign-on (SSO) through IAM Identity Center, allowing centralized user management.

## Syntax
<a name="aws-properties-opensearchservice-domain-identitycenteroptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-identitycenteroptions-syntax.json"></a>

```
{
  "[EnabledAPIAccess](#cfn-opensearchservice-domain-identitycenteroptions-enabledapiaccess)" : Boolean,
  "[IdentityCenterApplicationARN](#cfn-opensearchservice-domain-identitycenteroptions-identitycenterapplicationarn)" : String,
  "[IdentityCenterInstanceARN](#cfn-opensearchservice-domain-identitycenteroptions-identitycenterinstancearn)" : String,
  "[IdentityStoreId](#cfn-opensearchservice-domain-identitycenteroptions-identitystoreid)" : String,
  "[RolesKey](#cfn-opensearchservice-domain-identitycenteroptions-roleskey)" : String,
  "[SubjectKey](#cfn-opensearchservice-domain-identitycenteroptions-subjectkey)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-identitycenteroptions-syntax.yaml"></a>

```
  [EnabledAPIAccess](#cfn-opensearchservice-domain-identitycenteroptions-enabledapiaccess): Boolean
  [IdentityCenterApplicationARN](#cfn-opensearchservice-domain-identitycenteroptions-identitycenterapplicationarn): String
  [IdentityCenterInstanceARN](#cfn-opensearchservice-domain-identitycenteroptions-identitycenterinstancearn): String
  [IdentityStoreId](#cfn-opensearchservice-domain-identitycenteroptions-identitystoreid): String
  [RolesKey](#cfn-opensearchservice-domain-identitycenteroptions-roleskey): String
  [SubjectKey](#cfn-opensearchservice-domain-identitycenteroptions-subjectkey): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-identitycenteroptions-properties"></a>

`EnabledAPIAccess`  <a name="cfn-opensearchservice-domain-identitycenteroptions-enabledapiaccess"></a>
Indicates whether IAM Identity Center is enabled for the application.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IdentityCenterApplicationARN`  <a name="cfn-opensearchservice-domain-identitycenteroptions-identitycenterapplicationarn"></a>
The ARN of the IAM Identity Center application that integrates with Amazon OpenSearch Service.  
*Required*: No  
*Type*: String  
*Pattern*: `^arn:aws[a-z\\-]*:[a-z]+:[a-z0-9\\-]*:[0-9]*:[a-z0-9\\-]+\/[a-z0-9\\-]+\/[a-z0-9\\-]+`  
*Minimum*: `20`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IdentityCenterInstanceARN`  <a name="cfn-opensearchservice-domain-identitycenteroptions-identitycenterinstancearn"></a>
The Amazon Resource Name (ARN) of the IAM Identity Center instance.  
*Required*: No  
*Type*: String  
*Pattern*: `^arn:aws[a-z\\-]*:[a-z]+:[a-z0-9\\-]*:[0-9]*:[a-z0-9\\-]+\/[a-z0-9\\-]+`  
*Minimum*: `20`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`IdentityStoreId`  <a name="cfn-opensearchservice-domain-identitycenteroptions-identitystoreid"></a>
The identifier of the IAM Identity Store.  
*Required*: No  
*Type*: String  
*Pattern*: `^d-[0-9a-f]{10}$|^[0-9a-f]{8}\\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\\b[0-9a-f]{12}$`  
*Minimum*: `1`  
*Maximum*: `64`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RolesKey`  <a name="cfn-opensearchservice-domain-identitycenteroptions-roleskey"></a>
Specifies the attribute that contains the backend role identifier (such as group name or group ID) in IAM Identity Center.  
*Required*: No  
*Type*: String  
*Allowed values*: `GroupName | GroupId`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubjectKey`  <a name="cfn-opensearchservice-domain-identitycenteroptions-subjectkey"></a>
Specifies the attribute that contains the subject identifier (such as username, user ID, or email) in IAM Identity Center.  
*Required*: No  
*Type*: String  
*Allowed values*: `UserName | UserId | Email`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain Idp
<a name="aws-properties-opensearchservice-domain-idp"></a>

The SAML Identity Provider's information.

## Syntax
<a name="aws-properties-opensearchservice-domain-idp-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-idp-syntax.json"></a>

```
{
  "[EntityId](#cfn-opensearchservice-domain-idp-entityid)" : String,
  "[MetadataContent](#cfn-opensearchservice-domain-idp-metadatacontent)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-idp-syntax.yaml"></a>

```
  [EntityId](#cfn-opensearchservice-domain-idp-entityid): String
  [MetadataContent](#cfn-opensearchservice-domain-idp-metadatacontent): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-idp-properties"></a>

`EntityId`  <a name="cfn-opensearchservice-domain-idp-entityid"></a>
The unique entity ID of the application in the SAML identity provider.  
*Required*: Yes  
*Type*: String  
*Minimum*: `8`  
*Maximum*: `512`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MetadataContent`  <a name="cfn-opensearchservice-domain-idp-metadatacontent"></a>
The metadata of the SAML application, in XML format.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `1048576`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain JWTOptions
<a name="aws-properties-opensearchservice-domain-jwtoptions"></a>

<a name="aws-properties-opensearchservice-domain-jwtoptions-description"></a>The `JWTOptions` property type specifies Property description not available. for an [AWS::OpenSearchService::Domain](aws-resource-opensearchservice-domain.md).

## Syntax
<a name="aws-properties-opensearchservice-domain-jwtoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-jwtoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-jwtoptions-enabled)" : Boolean,
  "[PublicKey](#cfn-opensearchservice-domain-jwtoptions-publickey)" : String,
  "[RolesKey](#cfn-opensearchservice-domain-jwtoptions-roleskey)" : String,
  "[SubjectKey](#cfn-opensearchservice-domain-jwtoptions-subjectkey)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-jwtoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-jwtoptions-enabled): Boolean
  [PublicKey](#cfn-opensearchservice-domain-jwtoptions-publickey): String
  [RolesKey](#cfn-opensearchservice-domain-jwtoptions-roleskey): String
  [SubjectKey](#cfn-opensearchservice-domain-jwtoptions-subjectkey): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-jwtoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-jwtoptions-enabled"></a>
Property description not available.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PublicKey`  <a name="cfn-opensearchservice-domain-jwtoptions-publickey"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RolesKey`  <a name="cfn-opensearchservice-domain-jwtoptions-roleskey"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubjectKey`  <a name="cfn-opensearchservice-domain-jwtoptions-subjectkey"></a>
Property description not available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain LogPublishingOption
<a name="aws-properties-opensearchservice-domain-logpublishingoption"></a>

Specifies whether the OpenSearch Service domain publishes application, search slow logs, or index slow logs to Amazon CloudWatch. Each option must be an object of name `SEARCH_SLOW_LOGS`, `ES_APPLICATION_LOGS`, `INDEX_SLOW_LOGS`, or `AUDIT_LOGS` depending on the type of logs you want to publish. For the full syntax, see the [examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-opensearchservice-domain.html#aws-resource-opensearchservice-domain--examples).

Before you enable log publishing, you need to create a CloudWatch log group and provide OpenSearch Service the correct permissions to write to it. To learn more, see [Enabling log publishing (AWS CloudFormation)](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html#createdomain-configure-slow-logs-cfn).

## Syntax
<a name="aws-properties-opensearchservice-domain-logpublishingoption-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-logpublishingoption-syntax.json"></a>

```
{
  "[CloudWatchLogsLogGroupArn](#cfn-opensearchservice-domain-logpublishingoption-cloudwatchlogsloggrouparn)" : String,
  "[Enabled](#cfn-opensearchservice-domain-logpublishingoption-enabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-logpublishingoption-syntax.yaml"></a>

```
  [CloudWatchLogsLogGroupArn](#cfn-opensearchservice-domain-logpublishingoption-cloudwatchlogsloggrouparn): String
  [Enabled](#cfn-opensearchservice-domain-logpublishingoption-enabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-logpublishingoption-properties"></a>

`CloudWatchLogsLogGroupArn`  <a name="cfn-opensearchservice-domain-logpublishingoption-cloudwatchlogsloggrouparn"></a>
Specifies the CloudWatch log group to publish to. Required if you enable log publishing.  
*Required*: Conditional  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Enabled`  <a name="cfn-opensearchservice-domain-logpublishingoption-enabled"></a>
If `true`, enables the publishing of logs to CloudWatch.  
Default: `false`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## See also
<a name="aws-properties-opensearchservice-domain-logpublishingoption--seealso"></a>
+ [Monitoring OpenSearch logs with Amazon CloudWatch Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html) and [LogPublishingOptions](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-datatypes-logpublishingoptions) in the *Amazon OpenSearch Service Developer Guide*.



# AWS::OpenSearchService::Domain MasterUserOptions
<a name="aws-properties-opensearchservice-domain-masteruseroptions"></a>

Specifies information about the master user.

Required if `InternalUserDatabaseEnabled` is true in [AdvancedSecurityOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).

## Syntax
<a name="aws-properties-opensearchservice-domain-masteruseroptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-masteruseroptions-syntax.json"></a>

```
{
  "[MasterUserARN](#cfn-opensearchservice-domain-masteruseroptions-masteruserarn)" : String,
  "[MasterUserName](#cfn-opensearchservice-domain-masteruseroptions-masterusername)" : String,
  "[MasterUserPassword](#cfn-opensearchservice-domain-masteruseroptions-masteruserpassword)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-masteruseroptions-syntax.yaml"></a>

```
  [MasterUserARN](#cfn-opensearchservice-domain-masteruseroptions-masteruserarn): String
  [MasterUserName](#cfn-opensearchservice-domain-masteruseroptions-masterusername): String
  [MasterUserPassword](#cfn-opensearchservice-domain-masteruseroptions-masteruserpassword): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-masteruseroptions-properties"></a>

`MasterUserARN`  <a name="cfn-opensearchservice-domain-masteruseroptions-masteruserarn"></a>
Amazon Resource Name (ARN) for the master user. The ARN can point to an IAM user or role. This property is required for Amazon Cognito to work, and it must match the role configured for Cognito. Only specify if `InternalUserDatabaseEnabled` is false in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MasterUserName`  <a name="cfn-opensearchservice-domain-masteruseroptions-masterusername"></a>
Username for the master user. Only specify if `InternalUserDatabaseEnabled` is true in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
If you don't want to specify this value directly within the template, you can use a [dynamic reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html) instead.  
*Required*: No  
*Type*: String  
*Pattern*: `.*`  
*Minimum*: `1`  
*Maximum*: `64`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MasterUserPassword`  <a name="cfn-opensearchservice-domain-masteruseroptions-masteruserpassword"></a>
Password for the master user. Only specify if `InternalUserDatabaseEnabled` is true in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
If you don't want to specify this value directly within the template, you can use a [dynamic reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html) instead.  
*Required*: No  
*Type*: String  
*Pattern*: `.*`  
*Minimum*: `8`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain NodeConfig
<a name="aws-properties-opensearchservice-domain-nodeconfig"></a>

Configuration options for defining the setup of any node type within the cluster.

## Syntax
<a name="aws-properties-opensearchservice-domain-nodeconfig-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-nodeconfig-syntax.json"></a>

```
{
  "[Count](#cfn-opensearchservice-domain-nodeconfig-count)" : Integer,
  "[Enabled](#cfn-opensearchservice-domain-nodeconfig-enabled)" : Boolean,
  "[Type](#cfn-opensearchservice-domain-nodeconfig-type)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-nodeconfig-syntax.yaml"></a>

```
  [Count](#cfn-opensearchservice-domain-nodeconfig-count): Integer
  [Enabled](#cfn-opensearchservice-domain-nodeconfig-enabled): Boolean
  [Type](#cfn-opensearchservice-domain-nodeconfig-type): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-nodeconfig-properties"></a>

`Count`  <a name="cfn-opensearchservice-domain-nodeconfig-count"></a>
The number of nodes of a specific type within the cluster.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Enabled`  <a name="cfn-opensearchservice-domain-nodeconfig-enabled"></a>
A boolean value indicating whether a specific node type is active or inactive.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Type`  <a name="cfn-opensearchservice-domain-nodeconfig-type"></a>
The instance type of a particular node within the cluster.  
*Required*: No  
*Type*: String  
*Allowed values*: `m3.medium.search | m3.large.search | m3.xlarge.search | m3.2xlarge.search | m4.large.search | m4.xlarge.search | m4.2xlarge.search | m4.4xlarge.search | m4.10xlarge.search | m5.large.search | m5.xlarge.search | m5.2xlarge.search | m5.4xlarge.search | m5.12xlarge.search | m5.24xlarge.search | r5.large.search | r5.xlarge.search | r5.2xlarge.search | r5.4xlarge.search | r5.12xlarge.search | r5.24xlarge.search | c5.large.search | c5.xlarge.search | c5.2xlarge.search | c5.4xlarge.search | c5.9xlarge.search | c5.18xlarge.search | t3.nano.search | t3.micro.search | t3.small.search | t3.medium.search | t3.large.search | t3.xlarge.search | t3.2xlarge.search | or1.medium.search | or1.large.search | or1.xlarge.search | or1.2xlarge.search | or1.4xlarge.search | or1.8xlarge.search | or1.12xlarge.search | or1.16xlarge.search | ultrawarm1.medium.search | ultrawarm1.large.search | ultrawarm1.xlarge.search | t2.micro.search | t2.small.search | t2.medium.search | r3.large.search | r3.xlarge.search | r3.2xlarge.search | r3.4xlarge.search | r3.8xlarge.search | i2.xlarge.search | i2.2xlarge.search | d2.xlarge.search | d2.2xlarge.search | d2.4xlarge.search | d2.8xlarge.search | c4.large.search | c4.xlarge.search | c4.2xlarge.search | c4.4xlarge.search | c4.8xlarge.search | r4.large.search | r4.xlarge.search | r4.2xlarge.search | r4.4xlarge.search | r4.8xlarge.search | r4.16xlarge.search | i3.large.search | i3.xlarge.search | i3.2xlarge.search | i3.4xlarge.search | i3.8xlarge.search | i3.16xlarge.search | r6g.large.search | r6g.xlarge.search | r6g.2xlarge.search | r6g.4xlarge.search | r6g.8xlarge.search | r6g.12xlarge.search | m6g.large.search | m6g.xlarge.search | m6g.2xlarge.search | m6g.4xlarge.search | m6g.8xlarge.search | m6g.12xlarge.search | c6g.large.search | c6g.xlarge.search | c6g.2xlarge.search | c6g.4xlarge.search | c6g.8xlarge.search | c6g.12xlarge.search | r6gd.large.search | r6gd.xlarge.search | r6gd.2xlarge.search | r6gd.4xlarge.search | r6gd.8xlarge.search | r6gd.12xlarge.search | r6gd.16xlarge.search | t4g.small.search | t4g.medium.search`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain NodeOption
<a name="aws-properties-opensearchservice-domain-nodeoption"></a>

Configuration settings for defining the node type within a cluster.

## Syntax
<a name="aws-properties-opensearchservice-domain-nodeoption-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-nodeoption-syntax.json"></a>

```
{
  "[NodeConfig](#cfn-opensearchservice-domain-nodeoption-nodeconfig)" : NodeConfig,
  "[NodeType](#cfn-opensearchservice-domain-nodeoption-nodetype)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-nodeoption-syntax.yaml"></a>

```
  [NodeConfig](#cfn-opensearchservice-domain-nodeoption-nodeconfig): 
    NodeConfig
  [NodeType](#cfn-opensearchservice-domain-nodeoption-nodetype): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-nodeoption-properties"></a>

`NodeConfig`  <a name="cfn-opensearchservice-domain-nodeoption-nodeconfig"></a>
Configuration options for defining the setup of any node type.  
*Required*: No  
*Type*: [NodeConfig](aws-properties-opensearchservice-domain-nodeconfig.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NodeType`  <a name="cfn-opensearchservice-domain-nodeoption-nodetype"></a>
Defines the type of node, such as coordinating nodes.  
*Required*: No  
*Type*: String  
*Allowed values*: `coordinator`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain NodeToNodeEncryptionOptions
<a name="aws-properties-opensearchservice-domain-nodetonodeencryptionoptions"></a>

Specifies options for node-to-node encryption.

## Syntax
<a name="aws-properties-opensearchservice-domain-nodetonodeencryptionoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-nodetonodeencryptionoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-nodetonodeencryptionoptions-enabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-nodetonodeencryptionoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-nodetonodeencryptionoptions-enabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-nodetonodeencryptionoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-nodetonodeencryptionoptions-enabled"></a>
Specifies to enable or disable node-to-node encryption on the domain. Required if you enable fine-grained access control in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html).  
*Required*: Conditional  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain OffPeakWindow
<a name="aws-properties-opensearchservice-domain-offpeakwindow"></a>

A custom 10-hour, low-traffic window during which OpenSearch Service can perform mandatory configuration changes on the domain. These actions can include scheduled service software updates and blue/green Auto-Tune enhancements. OpenSearch Service will schedule these actions during the window that you specify. If you don't specify a window start time, it defaults to 10:00 P.M. local time.

## Syntax
<a name="aws-properties-opensearchservice-domain-offpeakwindow-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-offpeakwindow-syntax.json"></a>

```
{
  "[WindowStartTime](#cfn-opensearchservice-domain-offpeakwindow-windowstarttime)" : WindowStartTime
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-offpeakwindow-syntax.yaml"></a>

```
  [WindowStartTime](#cfn-opensearchservice-domain-offpeakwindow-windowstarttime): 
    WindowStartTime
```

## Properties
<a name="aws-properties-opensearchservice-domain-offpeakwindow-properties"></a>

`WindowStartTime`  <a name="cfn-opensearchservice-domain-offpeakwindow-windowstarttime"></a>
The desired start time for an off-peak maintenance window.  
*Required*: No  
*Type*: [WindowStartTime](aws-properties-opensearchservice-domain-windowstarttime.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain OffPeakWindowOptions
<a name="aws-properties-opensearchservice-domain-offpeakwindowoptions"></a>

Off-peak window settings for the domain.

## Syntax
<a name="aws-properties-opensearchservice-domain-offpeakwindowoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-offpeakwindowoptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-offpeakwindowoptions-enabled)" : Boolean,
  "[OffPeakWindow](#cfn-opensearchservice-domain-offpeakwindowoptions-offpeakwindow)" : OffPeakWindow
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-offpeakwindowoptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-offpeakwindowoptions-enabled): Boolean
  [OffPeakWindow](#cfn-opensearchservice-domain-offpeakwindowoptions-offpeakwindow): 
    OffPeakWindow
```

## Properties
<a name="aws-properties-opensearchservice-domain-offpeakwindowoptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-offpeakwindowoptions-enabled"></a>
Specifies whether off-peak window settings are enabled for the domain.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OffPeakWindow`  <a name="cfn-opensearchservice-domain-offpeakwindowoptions-offpeakwindow"></a>
Off-peak window settings for the domain.  
*Required*: No  
*Type*: [OffPeakWindow](aws-properties-opensearchservice-domain-offpeakwindow.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain S3VectorsEngine
<a name="aws-properties-opensearchservice-domain-s3vectorsengine"></a>

Options for enabling S3 vectors engine features on the specified domain.

## Syntax
<a name="aws-properties-opensearchservice-domain-s3vectorsengine-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-s3vectorsengine-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-s3vectorsengine-enabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-s3vectorsengine-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-s3vectorsengine-enabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-s3vectorsengine-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-s3vectorsengine-enabled"></a>
Enables S3 vectors engine features.  
*Required*: Yes  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain SAMLOptions
<a name="aws-properties-opensearchservice-domain-samloptions"></a>

Container for information about the SAML configuration for OpenSearch Dashboards.

## Syntax
<a name="aws-properties-opensearchservice-domain-samloptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-samloptions-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-samloptions-enabled)" : Boolean,
  "[Idp](#cfn-opensearchservice-domain-samloptions-idp)" : Idp,
  "[MasterBackendRole](#cfn-opensearchservice-domain-samloptions-masterbackendrole)" : String,
  "[MasterUserName](#cfn-opensearchservice-domain-samloptions-masterusername)" : String,
  "[RolesKey](#cfn-opensearchservice-domain-samloptions-roleskey)" : String,
  "[SessionTimeoutMinutes](#cfn-opensearchservice-domain-samloptions-sessiontimeoutminutes)" : Integer,
  "[SubjectKey](#cfn-opensearchservice-domain-samloptions-subjectkey)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-samloptions-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-samloptions-enabled): Boolean
  [Idp](#cfn-opensearchservice-domain-samloptions-idp): 
    Idp
  [MasterBackendRole](#cfn-opensearchservice-domain-samloptions-masterbackendrole): String
  [MasterUserName](#cfn-opensearchservice-domain-samloptions-masterusername): String
  [RolesKey](#cfn-opensearchservice-domain-samloptions-roleskey): String
  [SessionTimeoutMinutes](#cfn-opensearchservice-domain-samloptions-sessiontimeoutminutes): Integer
  [SubjectKey](#cfn-opensearchservice-domain-samloptions-subjectkey): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-samloptions-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-samloptions-enabled"></a>
True to enable SAML authentication for a domain.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Idp`  <a name="cfn-opensearchservice-domain-samloptions-idp"></a>
The SAML Identity Provider's information.  
*Required*: No  
*Type*: [Idp](aws-properties-opensearchservice-domain-idp.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MasterBackendRole`  <a name="cfn-opensearchservice-domain-samloptions-masterbackendrole"></a>
The backend role that the SAML master user is mapped to.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MasterUserName`  <a name="cfn-opensearchservice-domain-samloptions-masterusername"></a>
The SAML master user name, which is stored in the domain's internal user database.  
*Required*: No  
*Type*: String  
*Pattern*: `.*`  
*Minimum*: `1`  
*Maximum*: `64`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RolesKey`  <a name="cfn-opensearchservice-domain-samloptions-roleskey"></a>
Element of the SAML assertion to use for backend roles. Default is `roles`.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SessionTimeoutMinutes`  <a name="cfn-opensearchservice-domain-samloptions-sessiontimeoutminutes"></a>
The duration, in minutes, after which a user session becomes inactive. Acceptable values are between 1 and 1440, and the default value is 60.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubjectKey`  <a name="cfn-opensearchservice-domain-samloptions-subjectkey"></a>
Element of the SAML assertion to use for the user name. Default is `NameID`.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain ServerlessVectorAcceleration
<a name="aws-properties-opensearchservice-domain-serverlessvectoracceleration"></a>

Configuration for serverless vector acceleration, which provides [GPU-accelerated](https://docs.aws.amazon.com//opensearch-service/latest/developerguide/gpu-acceleration-vector-index.html) vector search capabilities for improved performance on vector workloads.

## Syntax
<a name="aws-properties-opensearchservice-domain-serverlessvectoracceleration-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-serverlessvectoracceleration-syntax.json"></a>

```
{
  "[Enabled](#cfn-opensearchservice-domain-serverlessvectoracceleration-enabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-serverlessvectoracceleration-syntax.yaml"></a>

```
  [Enabled](#cfn-opensearchservice-domain-serverlessvectoracceleration-enabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-serverlessvectoracceleration-properties"></a>

`Enabled`  <a name="cfn-opensearchservice-domain-serverlessvectoracceleration-enabled"></a>
Specifies whether serverless vector acceleration is enabled for the domain.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain ServiceSoftwareOptions
<a name="aws-properties-opensearchservice-domain-servicesoftwareoptions"></a>

The current status of the service software for an Amazon OpenSearch Service domain. For more information, see [Service software updates in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html).

## Syntax
<a name="aws-properties-opensearchservice-domain-servicesoftwareoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-servicesoftwareoptions-syntax.json"></a>

```
{
  "[AutomatedUpdateDate](#cfn-opensearchservice-domain-servicesoftwareoptions-automatedupdatedate)" : String,
  "[Cancellable](#cfn-opensearchservice-domain-servicesoftwareoptions-cancellable)" : Boolean,
  "[CurrentVersion](#cfn-opensearchservice-domain-servicesoftwareoptions-currentversion)" : String,
  "[Description](#cfn-opensearchservice-domain-servicesoftwareoptions-description)" : String,
  "[NewVersion](#cfn-opensearchservice-domain-servicesoftwareoptions-newversion)" : String,
  "[OptionalDeployment](#cfn-opensearchservice-domain-servicesoftwareoptions-optionaldeployment)" : Boolean,
  "[UpdateAvailable](#cfn-opensearchservice-domain-servicesoftwareoptions-updateavailable)" : Boolean,
  "[UpdateStatus](#cfn-opensearchservice-domain-servicesoftwareoptions-updatestatus)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-servicesoftwareoptions-syntax.yaml"></a>

```
  [AutomatedUpdateDate](#cfn-opensearchservice-domain-servicesoftwareoptions-automatedupdatedate): String
  [Cancellable](#cfn-opensearchservice-domain-servicesoftwareoptions-cancellable): Boolean
  [CurrentVersion](#cfn-opensearchservice-domain-servicesoftwareoptions-currentversion): String
  [Description](#cfn-opensearchservice-domain-servicesoftwareoptions-description): String
  [NewVersion](#cfn-opensearchservice-domain-servicesoftwareoptions-newversion): String
  [OptionalDeployment](#cfn-opensearchservice-domain-servicesoftwareoptions-optionaldeployment): Boolean
  [UpdateAvailable](#cfn-opensearchservice-domain-servicesoftwareoptions-updateavailable): Boolean
  [UpdateStatus](#cfn-opensearchservice-domain-servicesoftwareoptions-updatestatus): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-servicesoftwareoptions-properties"></a>

`AutomatedUpdateDate`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-automatedupdatedate"></a>
The timestamp, in Epoch time, until which you can manually request a service software update. After this date, we automatically update your service software.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Cancellable`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-cancellable"></a>
 True if you're able to cancel your service software version update. False if you can't cancel your service software update.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CurrentVersion`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-currentversion"></a>
The current service software version present on the domain.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Description`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-description"></a>
A description of the service software update status.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NewVersion`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-newversion"></a>
The new service software version, if one is available.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OptionalDeployment`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-optionaldeployment"></a>
True if a service software is never automatically updated. False if a service software is automatically updated after the automated update date.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UpdateAvailable`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-updateavailable"></a>
True if you're able to update your service software version. False if you can't update your service software version.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UpdateStatus`  <a name="cfn-opensearchservice-domain-servicesoftwareoptions-updatestatus"></a>
The status of your service software update.  
*Required*: No  
*Type*: String  
*Allowed values*: `PENDING_UPDATE | IN_PROGRESS | COMPLETED | NOT_ELIGIBLE | ELIGIBLE`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain SnapshotOptions
<a name="aws-properties-opensearchservice-domain-snapshotoptions"></a>

**DEPRECATED**. This setting is only relevant to domains running legacy Elasticsearch OSS versions earlier than 5.3. It does not apply to OpenSearch domains.

The automated snapshot configuration for the OpenSearch Service domain indexes.

## Syntax
<a name="aws-properties-opensearchservice-domain-snapshotoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-snapshotoptions-syntax.json"></a>

```
{
  "[AutomatedSnapshotStartHour](#cfn-opensearchservice-domain-snapshotoptions-automatedsnapshotstarthour)" : Integer
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-snapshotoptions-syntax.yaml"></a>

```
  [AutomatedSnapshotStartHour](#cfn-opensearchservice-domain-snapshotoptions-automatedsnapshotstarthour): Integer
```

## Properties
<a name="aws-properties-opensearchservice-domain-snapshotoptions-properties"></a>

`AutomatedSnapshotStartHour`  <a name="cfn-opensearchservice-domain-snapshotoptions-automatedsnapshotstarthour"></a>
The hour in UTC during which the service takes an automated daily snapshot of the indexes in the OpenSearch Service domain. For example, if you specify 0, OpenSearch Service takes an automated snapshot everyday between midnight and 1 am. You can specify a value between 0 and 23.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain SoftwareUpdateOptions
<a name="aws-properties-opensearchservice-domain-softwareupdateoptions"></a>

Options for configuring service software updates for a domain.

## Syntax
<a name="aws-properties-opensearchservice-domain-softwareupdateoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-softwareupdateoptions-syntax.json"></a>

```
{
  "[AutoSoftwareUpdateEnabled](#cfn-opensearchservice-domain-softwareupdateoptions-autosoftwareupdateenabled)" : Boolean
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-softwareupdateoptions-syntax.yaml"></a>

```
  [AutoSoftwareUpdateEnabled](#cfn-opensearchservice-domain-softwareupdateoptions-autosoftwareupdateenabled): Boolean
```

## Properties
<a name="aws-properties-opensearchservice-domain-softwareupdateoptions-properties"></a>

`AutoSoftwareUpdateEnabled`  <a name="cfn-opensearchservice-domain-softwareupdateoptions-autosoftwareupdateenabled"></a>
Specifies whether automatic service software updates are enabled for the domain.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain Tag
<a name="aws-properties-opensearchservice-domain-tag"></a>

A tag (key-value pair) for an Amazon OpenSearch Service resource.

## Syntax
<a name="aws-properties-opensearchservice-domain-tag-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-tag-syntax.json"></a>

```
{
  "[Key](#cfn-opensearchservice-domain-tag-key)" : String,
  "[Value](#cfn-opensearchservice-domain-tag-value)" : String
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-tag-syntax.yaml"></a>

```
  [Key](#cfn-opensearchservice-domain-tag-key): String
  [Value](#cfn-opensearchservice-domain-tag-value): String
```

## Properties
<a name="aws-properties-opensearchservice-domain-tag-properties"></a>

`Key`  <a name="cfn-opensearchservice-domain-tag-key"></a>
The tag key. Tag keys must be unique for the domain to which they are attached.  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-opensearchservice-domain-tag-value"></a>
The value assigned to the corresponding tag key. Tag values can be null and don't have to be unique in a tag set. For example, you can have a key value pair in a tag set of `project : Trinity` and `cost-center : Trinity`  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain VPCOptions
<a name="aws-properties-opensearchservice-domain-vpcoptions"></a>

The virtual private cloud (VPC) configuration for the OpenSearch Service domain. For more information, see [Launching your Amazon OpenSearch Service domains using a VPC](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html) in the *Amazon OpenSearch Service Developer Guide*.

## Syntax
<a name="aws-properties-opensearchservice-domain-vpcoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-vpcoptions-syntax.json"></a>

```
{
  "[SecurityGroupIds](#cfn-opensearchservice-domain-vpcoptions-securitygroupids)" : [ String, ... ],
  "[SubnetIds](#cfn-opensearchservice-domain-vpcoptions-subnetids)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-vpcoptions-syntax.yaml"></a>

```
  [SecurityGroupIds](#cfn-opensearchservice-domain-vpcoptions-securitygroupids): 
    - String
  [SubnetIds](#cfn-opensearchservice-domain-vpcoptions-subnetids): 
    - String
```

## Properties
<a name="aws-properties-opensearchservice-domain-vpcoptions-properties"></a>

`SecurityGroupIds`  <a name="cfn-opensearchservice-domain-vpcoptions-securitygroupids"></a>
The list of security group IDs that are associated with the VPC endpoints for the domain. If you don't provide a security group ID, OpenSearch Service uses the default security group for the VPC. To learn more, see [Security groups for your VPC ](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) in the *Amazon VPC User Guide*.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubnetIds`  <a name="cfn-opensearchservice-domain-vpcoptions-subnetids"></a>
Provide one subnet ID for each Availability Zone that your domain uses. For example, you must specify three subnet IDs for a three-AZ domain. To learn more, see [VPCs and subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html) in the *Amazon VPC User Guide*.  
If you specify more than one subnet, you must also configure `ZoneAwarenessEnabled` and `ZoneAwarenessConfig` within [ClusterConfig](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-clusterconfig.html), otherwise you'll see the error "You must specify exactly one subnet" during template creation.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## See also
<a name="aws-properties-opensearchservice-domain-vpcoptions--seealso"></a>
+ [Launching your Amazon OpenSearch Service domains within a VPC](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html) in the *Amazon OpenSearch Service Developer Guide*.



# AWS::OpenSearchService::Domain WindowStartTime
<a name="aws-properties-opensearchservice-domain-windowstarttime"></a>

A custom start time for the off-peak window, in Coordinated Universal Time (UTC). The window length will always be 10 hours, so you can't specify an end time. For example, if you specify 11:00 P.M. UTC as a start time, the end time will automatically be set to 9:00 A.M.

## Syntax
<a name="aws-properties-opensearchservice-domain-windowstarttime-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-windowstarttime-syntax.json"></a>

```
{
  "[Hours](#cfn-opensearchservice-domain-windowstarttime-hours)" : Integer,
  "[Minutes](#cfn-opensearchservice-domain-windowstarttime-minutes)" : Integer
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-windowstarttime-syntax.yaml"></a>

```
  [Hours](#cfn-opensearchservice-domain-windowstarttime-hours): Integer
  [Minutes](#cfn-opensearchservice-domain-windowstarttime-minutes): Integer
```

## Properties
<a name="aws-properties-opensearchservice-domain-windowstarttime-properties"></a>

`Hours`  <a name="cfn-opensearchservice-domain-windowstarttime-hours"></a>
The start hour of the window in Coordinated Universal Time (UTC), using 24-hour time. For example, 17 refers to 5:00 P.M. UTC. The minimum value is 0 and the maximum value is 23.  
*Required*: Yes  
*Type*: Integer  
*Minimum*: `0`  
*Maximum*: `23`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Minutes`  <a name="cfn-opensearchservice-domain-windowstarttime-minutes"></a>
The start minute of the window, in UTC. The minimum value is 0 and the maximum value is 59.  
*Required*: Yes  
*Type*: Integer  
*Minimum*: `0`  
*Maximum*: `59`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::OpenSearchService::Domain ZoneAwarenessConfig
<a name="aws-properties-opensearchservice-domain-zoneawarenessconfig"></a>

Specifies zone awareness configuration options. Only use if `ZoneAwarenessEnabled` is `true`.

## Syntax
<a name="aws-properties-opensearchservice-domain-zoneawarenessconfig-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-opensearchservice-domain-zoneawarenessconfig-syntax.json"></a>

```
{
  "[AvailabilityZoneCount](#cfn-opensearchservice-domain-zoneawarenessconfig-availabilityzonecount)" : Integer
}
```

### YAML
<a name="aws-properties-opensearchservice-domain-zoneawarenessconfig-syntax.yaml"></a>

```
  [AvailabilityZoneCount](#cfn-opensearchservice-domain-zoneawarenessconfig-availabilityzonecount): Integer
```

## Properties
<a name="aws-properties-opensearchservice-domain-zoneawarenessconfig-properties"></a>

`AvailabilityZoneCount`  <a name="cfn-opensearchservice-domain-zoneawarenessconfig-availabilityzonecount"></a>
If you enabled multiple Availability Zones (AZs), the number of AZs that you want the domain to use.  
Valid values are `2` and `3`. Default is 2.  
*Required*: No  
*Type*: Integer  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)