analytics-opensearch-expertise

OpenSearch Domain Health Assessment

Overview

This skill performs a comprehensive, read-only health assessment of Amazon OpenSearch Service domains using AWS APIs available through the customer's local AWS profile. It produces a structured report with findings and actionable recommendations.

Scope: CLI-agent compatible. No external packages, no IDE workspace, no human review gates.

Trigger Keywords

opensearch, opensearch health, domain health, cluster review, opensearch review, opensearch assessment, opensearch check, open search, opensearch performance, opensearch security, opensearch cost

Prerequisites

• AWS CLI profile configured with read-only access to the target account
• IAM permissions required:
  • es:DescribeDomain
  • es:DescribeDomainHealth
  • es:GetCompatibleVersions
  • es:DescribeReservedInstances
  • es:ListDomainNames
  • cloudwatch:GetMetricData

Execution Flow

Input

Required: Domain ARN (e.g., arn:aws:es:us-west-2:123456789012:domain/my-domain)

Parse the ARN to extract:

• Region: field 4 (e.g., us-west-2)
• Account ID: field 5 (e.g., 123456789012)
• Domain name: after domain/ in field 6

Fallback / Target Resolution (apply these rules exactly — never silently substitute a target):

1. Exact match: the ARN (or name + region) resolves via DescribeDomain → proceed with the assessment.
2. No domain specified: run ListDomainNames in the user's likely region(s) (cross-region scan if needed) and present the discovered domains as options for the user to choose. Do not pick one yourself unless exactly one domain exists in the entire account — state that you did so.
3. Specified but NOT found: search for candidates (ListDomainNames in the ARN's region, then other regions). Then STOP and confirm — do NOT assess:
   • Report clearly: "Domain {given} not found in {region}."
   • List the closest candidate(s) with their regions (e.g., name differs by a suffix, or same name in another region).
   • Ask the user to confirm which domain to assess. Never run the assessment against a domain the user did not name without their explicit confirmation — in accounts with similarly-named sibling domains (e.g., prod-es-content / prod-es-users), a silently substituted target produces a confident report about the wrong domain, which is worse than an error.
4. If the user provides only a domain name with no region, ask for the region (or apply rule 3's candidate search).