AWSAmazon OpenSearch ServiceDatabase

`aws_opensearch_domain` cost estimation

A managed OpenSearch (formerly Elasticsearch) cluster. Priced per node-hour by instance type, plus storage and optional UltraWarm/Cold tiers.

An aws_opensearch_domain is a managed OpenSearch (formerly Elasticsearch) cluster used for full-text search, log analytics, and observability. Pricing has three parts.

First, instance hours. OpenSearch domains have data nodes (where indices live), optional dedicated master nodes (for cluster stability with 3+ nodes), and optional UltraWarm/Cold nodes for tiered storage. Each is billed per hour by class. A typical 3-node m6g.large.search cluster costs about 3 × $0.156/hour × 730 hours = $342/month for compute alone.

Second, storage. EBS volumes attached to data nodes are billed per GB-month at standard EBS rates. UltraWarm storage (S3-backed, slower) is much cheaper: $0.024/GB-month vs $0.10+/GB-month for EBS. Cold storage is cheaper still ($0.018/GB-month) but takes longer to query.

Third, optional features: - Multi-AZ with standby (multi_az_with_standby = true): roughly doubles node count for HA - KMS encryption at rest: free if using AWS-managed key - Cross-cluster replication: per-replica node cost - VPC endpoints (interface): $7/month each per AZ

OpenSearch Serverless is a different resource (aws_opensearchserverless_collection) priced per OCU-hour (OpenSearch Compute Units) for indexing and search separately. Right for variable workloads with low baseline.

c3x reads cluster_config.instance_type, instance_count, dedicated_master_enabled/count/type, warm_enabled/count/type, and ebs_options. Storage size is from ebs_options.volume_size.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_opensearch_domain" "logs" {
  domain_name    = "logs"
  engine_version = "OpenSearch_2.13"

  cluster_config {
    instance_type            = "m6g.large.search"
    instance_count           = 3
    dedicated_master_enabled = true
    dedicated_master_count   = 3
    dedicated_master_type    = "m6g.large.search"
    zone_awareness_enabled   = true

    zone_awareness_config {
      availability_zone_count = 3
    }

    warm_enabled = true
    warm_count   = 2
    warm_type    = "ultrawarm1.medium.search"
  }

  ebs_options {
    ebs_enabled = true
    volume_type = "gp3"
    volume_size = 100
  }

  encrypt_at_rest {
    enabled = true
  }
}

Pricing dimensions

What you actually pay for when you provision aws_opensearch_domain.

Dimension	Unit	What's being charged
Data node hours	per node per hour	Each data node billed by class. Multiplied by instance_count. $0.156/hour for m6g.large.search in us-east-1
Dedicated master node hours	per node per hour	Recommended for clusters with 6+ data nodes. Typically 3 master nodes for quorum.
UltraWarm node hours	per node per hour	S3-backed warm tier. Cheaper per GB but slower queries. Bills both for node hours and warm storage.
EBS storage (hot tier)	per GB-month	EBS volumes attached to data nodes, billed at gp3 rates.
UltraWarm/Cold storage	per GB-month	Object-storage-backed tiers. Cheaper but slower to query than hot. $0.024/GB-month UltraWarm, $0.018/GB-month Cold

Optimization tips

Common ways to reduce aws_opensearch_domain cost without changing the workload.

Use UltraWarm for older indices

75%+ on aged indices

Log search use cases often query the last 7 days heavily and older data rarely. Move indices older than 7 days to UltraWarm via Index State Management. Storage drops from $0.10+ to $0.024/GB-month.

Use Cold storage for compliance-only retention

85% on compliance-only data

If you keep logs for 12+ months for compliance but rarely query them, Cold tier is even cheaper. Queries take longer but cost ~85% less than hot.

Right-size nodes by CPU and JVM heap

30-50%

OpenSearch nodes are often overprovisioned by 2-4x. Check JVMMemoryPressure and CPUUtilization in CloudWatch. Most production clusters can drop one instance size with no impact.

Buy reserved instances for steady-state clusters

30-50%

OpenSearch reserved instances cut node costs by 30-50% with 1-3 year commitments. Right for log retention clusters that won't shrink.

Consider OpenSearch Serverless for low-baseline workloads

Workload-dependent

Serverless bills per OCU-hour for indexing and search separately. Right for sporadic search workloads that don't justify 24/7 nodes. Crossover point depends on average vs peak utilization.

FAQ

What's the difference vs Elasticsearch Service?

Amazon Elasticsearch Service was renamed to Amazon OpenSearch Service in 2021. The resource type was renamed from aws_elasticsearch_domain to aws_opensearch_domain. Both still work in Terraform; new deployments should use aws_opensearch_domain.

How does c3x handle UltraWarm?

c3x reads warm_enabled, warm_count, and warm_type from cluster_config. Plus, you can specify expected UltraWarm storage size in c3x-usage.yml for the per-GB storage cost.

Should I run my own OpenSearch on EC2 instead?

Possible for cost savings (~30-40%) but adds significant operational burden: cluster management, upgrades, snapshots, monitoring. Most teams pay the managed-service premium for the operational simplicity. Calculate true cost including engineering time.

Are snapshots included in storage cost?

Automated snapshots to a domain-managed S3 bucket are free up to 14 days of retention. Manual snapshots to your own S3 bucket are billed at standard S3 rates.