OpenSearch (Hardened) — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	OpenSearch (Apache-2.0) — see licenses
Version	OpenSearch 2.x line; security plugin not pre-seeded with demo certificates or passwords. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• AWS Marketplace — submission in progress (image verified 2026-07-21) (base: Amazon Linux 2023)

Network ports

Port	Purpose	State
22	SSH (key-only)	default-open
9200	REST API — bound to 127.0.0.1	customer-must-open (config + firewall)
9300	Transport — localhost (single node)	optional

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH with your launch key; the API answers on localhost without auth (local-only posture).

No demo certificates and no default admin password are installed (the upstream demo config is the classic trap — we ship without it).

Local REST works immediately: curl http://127.0.0.1:9200/

Rotation: When you enable the security plugin for network use, you generate your own certs and admin credentials — see the configuration page.

Data & dependencies

• Data locations: /var/lib/opensearch — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: Node data directory initializes fresh on first start (build-time state is wiped). vm.max_map_count preset via sysctl.
• Update / patch: Replace with the newest image version (monthly + event-driven rebuilds; Java CVE class handled at build). In-place minor bumps possible but image-replace is the supported path.
• Backup / restore: Snapshot API to a repository (S3 plugin available) or volume snapshots with the service stopped.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: /var/log/opensearch; `journalctl -u opensearch -f`
• Health check: curl -s http://127.0.0.1:9200/_cluster/health | jq .status → green (single node: yellow for replicated indices is normal)

Known limitations

Single node; dashboards not bundled (pair with the OpenSearch Dashboards package if needed).

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy