Install OpenSearch (Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch with 4 vCPU+ and RAM ≥ 8 GB (heap sizing: ~50% of RAM).
   Expected result curl http://127.0.0.1:9200/ on the instance returns the cluster banner.
2. For network access: INSTALL and configure the security plugin (TLS + users) FIRST — it is not on the image — then set network.host and open 9200 to your app subnet only. Never expose 9200 without auth.
   Expected result Remote client authenticates over TLS; anonymous requests are refused.

Google Cloud

1. Deploy from the listing (IAP-only SSH; 9200 closed by the package by default).
   Expected result On the VM: curl http://127.0.0.1:9200/ returns the cluster banner.
2. For in-VPC clients: install + configure the security plugin first, set network.host in /usr/share/opensearch/config/opensearch.yml, restart opensearch, then add a firewall rule for 9200 from your subnet only.
   Expected result Remote client authenticates over TLS; anonymous requests are refused.

Validate

curl -s http://127.0.0.1:9200/_cluster/health | jq .status   → green (single node: yellow for replicated indices is normal)

First boot: Node data directory initializes fresh on first start (build-time state is wiped). vm.max_map_count preset via /etc/sysctl.d/99-opensearch.conf. No credential is generated.

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. There is no application credential: the security plugin is not installed, so `curl http://127.0.0.1:9200/` answers without authentication — on localhost only.
3. Before exposing 9200: install the security plugin (command on the Configuration page), configure TLS + users, then set network.host and open the firewall to your app subnet only. Never expose 9200 without auth.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes