Provisioning capability — entry point and reference
This file is the entry point for the provisioning capability. It covers cost considerations, security, high availability, and provides a navigation index over the rest of the provisioning files. Infrastructure operations use standard AWS CLI commands (e.g., aws opensearch describe-domain, aws opensearchserverless create-collection); the AWS MCP server's call_aws is a streamlined alternative when available but is not required. Data-plane operations (queries, mappings, ISM) use awscurl (SigV4-authenticated HTTP requests) regardless of MCP presence.
When to use this capability
SKILL.md routes here when the user is provisioning or managing AOS domains and AOSS collections. Concrete triggers:
- Phrases: "create OpenSearch domain", "scale to N nodes", "AOSS collection", "upgrade my domain", "set up monitoring", "FGAC master user", "snapshot policy", "UltraWarm", "Auto-Tune", "engine version"
- Tasks: domain creation, upgrades, blue/green, storage tiers (UltraWarm, cold), monitoring (CloudWatch alarms), snapshots, FGAC, AOSS collection lifecycle, security policies
All provisioning files (capability index)
After loading this entry, you can discover every provisioning-capability file from this list. There are NO other provisioning files outside references/provisioning-*.md.
| User need | File |
|---|---|
| Create AOS domain | provisioning-domain-provision.md |
| Deploy search config to a domain | provisioning-domain-deploy-search.md |
| Create AOSS collection | provisioning-serverless-provision.md |
| Deploy search config to a collection | provisioning-serverless-deploy-search.md |
| Tear down (deprovision) an AOSS collection | provisioning-serverless-deprovision.md |
| Configure agentic search on a domain (conversational, stateful) | provisioning-agentic-setup.md |
| Configure agentic search on a serverless collection (flow agent, stateless) | provisioning-serverless-agentic-setup.md |
| Upgrade domain version | provisioning-upgrades.md |
| Storage tier management (UltraWarm, cold) | provisioning-storage-tiers.md |
| CloudWatch alarms / monitoring | provisioning-monitoring.md |
| Troubleshoot domain or collection issues | provisioning-troubleshooting.md |
Cross-cutting refs you may also load: sizing.md (instance/storage math), security.md (FGAC, encryption, VPC), personas.md (DevOps / SRE communication).
Sizing-related universal rules (apply when this capability sizes a domain)
- Current-generation instances. Prefer Graviton and the latest generation available. Always fetch the authoritative list for the target region and engine version with
aws opensearch list-instance-type-details --engine-version <version>(or supported-instance-types.html) — new generations supersede older ones and the supported set varies by region. As a fallback if the API is unavailable, prefer the latest Graviton memory-optimized family for data nodes and the latest Graviton general-purpose family for cluster managers; use earlier Graviton generations only with explicit justification (existing RIs, specific compatibility need). Rule and rationale: sizing.md §Instance family selection. - Input honesty. When sizing on UNKNOWN inputs, lead with
[BLOCKER — need input]OR present 2–3 tiered bands (small/medium/large workload assumption). Never present a single point estimate built on invented numbers.
Cross-capability handoff
- For post-provision search setup (vector / RAG / semantic): see
search-semantic-search-guide.md. - For post-provision log ingestion (OSI pipelines, OpenSearch Dashboards): see
log-analytics-guide.md. - For trace ingestion + queries on the new domain: see
trace-analytics-trace-queries.md. - For migrating into a freshly provisioned domain: see
assessment-workflow.md.
Cost: OpenSearch Serverless
- Charged per OCU (OpenSearch Compute Units) hour
- For current OCU floors, redundancy options, and Vector-Search OCU isolation rules, see sizing.md §OCU model.
- Scales automatically based on workload
- Storage charged separately per GB
- Neural sparse enrichment: charged based on SemanticSearchOCU CloudWatch metric
Cost: OpenSearch Domain
- Instance hours (varies by instance type)
- EBS storage (GB-month)
- Data transfer and snapshot storage
For monthly cost figures, plug your sizing inputs into https://calculator.aws — pricing changes per-region and per-account (RI / Savings Plan / EDP discount math).
Cost optimization levers (no dollar figures — see calculator.aws): Reserved Instances, right-sizing, UltraWarm for cold data, OR1 for log workloads, gp3 storage, Auto-Tune. For instance-family selection rule and rationale, see sizing.md §Instance family selection; full instance family catalog at supported-instance-types.html.
Security Best Practices
- Network: Deploy in VPC for production, use security groups, enable VPC Flow Logs
- Access: Enable fine-grained access control, use IAM roles, least-privilege policies
- Encryption: At-rest encryption, node-to-node encryption, enforce HTTPS
- Monitoring: Enable CloudWatch logs, set up security alerting
High Availability (Domain)
- Enable zone awareness, distribute across 3 AZs
- Enable automated snapshots to S3
- Configure standby replicas
- Test restore procedures
Monitoring
- CloudWatch logs: index slow logs, search slow logs, error logs, audit logs
- CloudWatch alarms: cluster health, CPU/memory, storage, JVM pressure
- SNS notifications for alerts
Troubleshooting Quick Reference
| Issue | Check |
|---|---|
| Domain creation fails | Service quotas, VPC config, IAM permissions |
| Cluster health yellow/red | Shard allocation, storage space, node health |
| Access denied | Fine-grained access control, IAM policies, data access policies |
| Model deployment fails | ML plugin enabled, memory allocation, Bedrock region availability |
| Slow queries | Slow logs, query optimization, resource utilization |
| Collection creation fails | Service quotas, region availability, encryption policy |
