{"id":29481901,"url":"https://github.com/aws-samples/sample-opensearch-extended-support-cost-estimator","last_synced_at":"2026-02-27T09:11:09.735Z","repository":{"id":297386885,"uuid":"980711128","full_name":"aws-samples/sample-opensearch-extended-support-cost-estimator","owner":"aws-samples","description":"OpenSearch Extended Support Cost Estimator Script","archived":false,"fork":false,"pushed_at":"2025-05-12T17:16:24.000Z","size":28,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-05T08:20:46.499Z","etag":null,"topics":["cost","elasticsearch","end-of-support","estimator","extended","opensearch","support"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit-0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aws-samples.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-09T15:25:03.000Z","updated_at":"2025-05-15T08:05:12.000Z","dependencies_parsed_at":"2025-06-05T08:20:53.224Z","dependency_job_id":"16d8429e-ad37-4787-b6f0-65de36ea0bd2","html_url":"https://github.com/aws-samples/sample-opensearch-extended-support-cost-estimator","commit_stats":null,"previous_names":["aws-samples/sample-opensearch-extended-support-cost-estimator"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/aws-samples/sample-opensearch-extended-support-cost-estimator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Fsample-opensearch-extended-support-cost-estimator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Fsample-opensearch-extended-support-cost-estimator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Fsample-opensearch-extended-support-cost-estimator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Fsample-opensearch-extended-support-cost-estimator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aws-samples","download_url":"https://codeload.github.com/aws-samples/sample-opensearch-extended-support-cost-estimator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Fsample-opensearch-extended-support-cost-estimator/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265382141,"owners_count":23756301,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cost","elasticsearch","end-of-support","estimator","extended","opensearch","support"],"created_at":"2025-07-15T01:01:41.728Z","updated_at":"2026-02-27T09:11:09.665Z","avatar_url":"https://github.com/aws-samples.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# opensearch-extended-support-cost-estimator-script\n## Opensearch Extended Support Cost Estimator Scripts\n\nIn November 2024, [Amazon OpenSearch Service announced Extended Support for engine versions](https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-opensearch-service-support-engine-versions/), which allows you to continue running your Opensearch domains on a major engine version past its end of standard support date for legacy Elasticsearch versions and OpenSearch Versions at an additional cost. \n\nThese scripts can be used to help estimate the cost of Opensearch Extended Support for Opensearch/Elasticsearch domains in your AWS accounts and organization. This script runs in all AWS regions that are available, and if a region is not enabled in the specific account, that region is skipped. \n\nThese scripts should be run from the payer account of your organization to identify the Opensearch \u0026 ElasticSearch clusters in your organization that will be impacted by the extended support and the estimated additional cost for the versions below.\n\n* The end of support schedule for _Elasticsearch_ versions is as follows:\n\n| Software Version\t| End of Standard Support\t| End of Extended Support |\n| ----------------- | ------------------------- | ----------------------- |\n| Elasticsearch versions 1.5 and 2.3\t| 11/07/2025\t| 11/07/2026 |\n| Elasticsearch versions 5.1 and 5.5\t| 11/07/2025\t| 11/07/2026 |\n| Elasticsearch versions 5.6\t| 11/07/2025\t| 11/07/2028 |\n| Elasticsearch versions 6.0 to 6.7\t| 11/07/2025\t| 11/07/2026 |\n| Elasticsearch versions 6.8\t| Not announced\t| 11/07/2028 |\n| Elasticsearch versions 7.1 to 7.8\t| 11/07/2025\t| 11/07/2026 |\n| Elasticsearch versions 7.9\t| Not announced\t| Not announced |\n| Elasticsearch versions 7.10\t| Not announced\t| Not announced |\n\n* The end of support schedule for _OpenSearch_ versions is as follows:\n\n| Software Version\t| End of Standard Support\t| End of Extended Support |\n| ----------------- | ------------------------- | ----------------------- |\n| OpenSearch versions 1.0 and 1.2\t| 11/07/2025\t| 11/07/2026 |\n| OpenSearch versions 1.3\t| Not announced\t| Not announced |\n| OpenSearch versions 2.3 to 2.9\t| 11/07/2025\t| 11/07/2026 |\n| OpenSearch versions 2.11 and higher versions\t| Not announced\t| Not announced |\n\n\nThe scripts will create a CSV file with all the Openserach domains that will be impacted by extended support across all accounts \u0026 regions in your organization.\n\n## Calculating extended support charges\n\nDomains running versions under extended support will be charged a flat additional fee/Normalized Instance Hour (NIH), for example, $0.0065 in the US East (North Virginia) Region. NIH is computed as a factor of the instance size (e.g., medium, large), and the number of instance hours. For example, if you are running an m7g.medium.search instance for 24 hours in the US East (North Virginia) Region, which is priced at $0.068/Instance hour (on-demand), you will typically pay $1.632 ($0.068x24). If you are running a version that is in extended support, you will pay an additional $0.0065/NIH, which is computed as $0.0065 x 24 (number of instance hours) x 2 (size normalization factor; 2 for medium-sized instances), which comes to $0.312 for extended support for 24 hours. The total amount you will pay for 24 hours will be a sum of the standard instance usage cost and the extended support cost, which is $1.944 ($1.632+$0.312). The table [here](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html#calculating-charges) shows the normalization factor for various instance sizes in OpenSearch Service.\n\nThese scripts provide the following benefits:\n* Streamlined identification: Quickly identify all Amazon Opensearch domains enabled for Extended Support across your entire AWS organization and all regions in one go.\n* Enhanced visibility and cost awareness: Easily calculate the total yearly cost of extended support for eligible instances, gaining insight into cost implications and enabling informed decision-making to optimize expenses, maximize savings, and ensure timely action and compliance.\n* Time-saving automation: Eliminate manual effort by automating the process of listing Opensearch \u0026 ElasticSearch domains, saving valuable time for your team. Run the script for a single account, a list of accounts or for the entire organization.\n* Proactive management: Stay ahead of extended support deadlines by proactively identifying instances requiring attention, minimizing potential disruptions.\n\n\n## Current Challenges\n1. Opensearch \u0026 Elasticsearh versions on extended support are hardcoded currently. Fix the function to dynamically lookup AOS Extended Support versions from AWS documentation or Pricing API if supported, so that future versions can be included.\n2. Extended support costs are scraped from the Opensearch pricing page. However, this might break if the HTML code of that page changes, whihc happens frequently.\n        The alternatives are:\n          1/ hard code the current regional proce for extended support in a file, which will/can get outdated \n          2/ dynamically get the Opensearch Extended Support costs using teh AWS Pricing API - however, the Pricing API doesn't yet return extended support costs for Opensearch. \n\n## Security and Access Considerations\n\nThis script runs locally on your computer and may store sensitive domain information in the output files. Please ensure you follow your organization's security policies regarding data handling and storage of AWS resource information. Consider removing output files after analysis if they are no longer needed.\n\nWhile the script can run for all accounts in your entire AWS Organization, some organizations may have security policies that restrict access to the management account. In such cases, you can still run the script on individual accounts where you have appropriate access permissions.\n\nThis tool follows the AWS Shared Responsibility Model - while AWS manages security of the cloud infrastructure, security of your local environment and handling of the output data is your responsibility. Ensure you have appropriate controls in place to protect any sensitive information generated by this script.\n\n\n## Prerequisites\n\n1. Download and install [Python 3](https://www.python.org/downloads/).\n\n2. Ensure that you have an IAM principal in your payer/management account that has at least the following IAM permissions:\n\u003e NOTE: The script does NOT create these roles/policies in your management account. It is assumed that a user with these permissions already granted to them will run the steps listed here.\n\n```\n\"organizations:ListAccounts\",\n\"organizations:DescribeOrganization\",\n\n\"sts:AssumeRole\",\n\n\"cloudformation:CreateStackSet\",\n\"cloudformation:UpdateStackSet\",\n\"cloudformation:DeleteStackSet\",\n\"cloudformation:ListStackSetOperationResults\",\n\"cloudformation:ListStackInstances\",\n\"cloudformation:StopStackSetOperation\"\n\"cloudformation:CreateStackInstances\",\n\"cloudformation:UpdateStackInstances\",\n\"cloudformation:DeleteStackInstances\",\n\n\"es:ListDomainNames\",\n\"es:DescribeElasticsearchDomains\"\n```\nThese are the minimum permissions needed to create and execute the cloudformation stack/stack-set across the management \u0026 all linked accounts in your AWS Organizations. In addition, this also includes the permissions needed to read Amazon Opensearch domain details used by the script. You will be using this IAM principal to configure AWS credentials before running the scripts.\n\n## Step 1: Clone the repo\n\n1. On your laptop, clone the project in a local directory\n    ```\n    git clone https://github.com/aws-samples/sample-opensearch-extended-support-cost-estimator.git\n    ```\n\n2. Navigate into the project\n    ```\n    cd sample-opensearch-extended-support-cost-estimator\n    ```\n\n## Step 2: Create the CloudFormation StackSets\n\nFollow this procedure to create CloudFormation StackSets. The stack set creates an IAM role named *AOSExtendedSupportCostEstimatorRole*\nacross all member accounts of your organization. This IAM role will be assumed by the payer account during the script execution\nto query affected Opensearch \u0026 ElasticSearch instances in the member accounts.\n\n**Note**:\nYou only need to complete this step once from the management account (payer account).\n\n**Important**:\nRunning a stack set does not execute the stack on the management account itself, it will only run on all child accounts. \nTo run on management account, in case there are Opensearch domains in it, run it as a standalone cloudformation stack first, and then run a stack set for the Organization.\n\n\n**To create the CloudFormation StackSets**\n\n1. Sign in to the AWS Management Console of the payer/management account as a user assigned the minimum IAM permissions as mentioned in Prerequisites step #2 above.\n2. In the CloudFormation console, select StackSets in the left navigation panel and create a stack set with the template file that you downloaded. Provide the Management Account ID as the input parameter when asked on the console.\n3. For the template, use the [aos_extended_support_cost_estimator_role.yaml](opensearch_extended_support_cost_estimator/cfn_template/aos_extended_support_cost_estimator_role.yaml) template file in the cfn_template directory of the cloned repo.\n4. For Region, select any one region only (eg us-east-1). You only need to select a single region as the cloudformation template creates a single IAM role, which is a global service.\n\nFor more information, see [Creating a stack set on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html)\nin the AWS CloudFormation User Guide.\n\nAfter CloudFormation creates the stack set, each member account in your organization has *AOSExtendedSupportCostEstimatorRole* IAM role.\nThe IAM role contains the following permissions:\n```\n\"es:ListDomainNames\",\n\"es:DescribeElasticsearchDomains\"\n```\n\n## Step 3: Set up the environment\n\nExecute the following steps from the directory that was created after cloning the project. \n\n1. [**ONLY applicable to Debian/Ubuntu systems**] Install python3-venv\n\n   This command should only be run if you are using Debian/Ubuntu systems. For all other systems, skip this and\n   move to 4.\n   ```\n   sudo apt install -y python3-venv\n   ```\n\n2. Setup virtualenv\n    ```\n    python3 -m venv venv\n    ```\n\n3. Activate virtualenv\n    ```\n    source venv/bin/activate\n    ```\n\n4. Install dependencies\n    ```\n    pip install -r requirements.txt\n    ```\n\n5. Navigate to directory containing the scripts\n    ```\n    cd scripts/\n    ```\n\n6. Configure the credentials using AWS CLI. You can read more about how to do this [here](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#interactive-configuration).\n   Credentials can be configured in multiple ways. Regardless of the method that you choose, you must have both **AWS credentials**\n   and an **AWS Region** set before running the scripts. The simplest way is to do this in an interactive manner using AWS CLI\n   and running `aws configure` command to set up your credentials and default region. Follow the prompts, and it will generate\n   configuration files in the correct locations for you.\n\n**Note:**\nSpecifying incorrect region can cause errors during script execution. For e.g. when running the script in China regions,\nif the region is set to *us-east-1* you will see errors like - `The security token included in the request is invalid`.\nFor China regions, the region value should be either *cn-north-1* or *cn-northwest-1*.\n\n\n## Step 4: Identify the affected Opensearch \u0026 ElasticSearch instances\n\nTo identify affected Openserach \u0026 ElasticSearch domains run the `find_aos_extended_support_instances.py` script\n\nThe script supports the following arguments:\n```\n$ python3 find_aos_extended_support_instances.py -h\n\nusage: find_aos_extended_support_instances.py [-h] [-a ACCOUNTS | --accounts-file ACCOUNTS_FILE | --all] [--regions-file REGIONS_FILE] [--exclude-accounts EXCLUDE_ACCOUNTS] [--generate-accounts-file] [--generate-regions-file]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -a ACCOUNTS, --accounts ACCOUNTS\n                        comma separated list of AWS account IDs\n  --accounts-file ACCOUNTS_FILE\n                        Absolute path of the CSV file containing AWS account IDs\n  --all                 runs script for the entire AWS Organization\n  --regions-file REGIONS_FILE\n                        Absolute path of the CSV file containing specific AWS regions to run the script against\n  --exclude-accounts EXCLUDE_ACCOUNTS\n                        comma separated list of AWS account IDs to be excluded, only applies when --all flag is used\n  --generate-accounts-file\n                        Creates a `accounts.csv` CSV file containing all AWS accounts in the AWS Organization\n  --generate-regions-file\n                        Creates a `regions.csv` CSV file containing all AWS regions\n``` \n\nThe details about using these input parameters are below:\n\n* --all – Scans all member accounts in your organization.\n\n```\npython find_aos_extended_support_instances.py --all\n```\n\n* --accounts – Scans a subset of member accounts in your organization.\n\n```\npython find_aos_extended_support_instances.py --accounts 111122223333,444455556666,777788889999\n```\n\n* --accounts-file – Absolute path to the CSV file containing a subset of member accounts in your organization that needs\n  to be scanned. The CSV file should have no headers and contain 12 digit AWS Account IDs in the first column of the file.\n\n```\npython find_aos_extended_support_instances.py --accounts-file /path/to/accounts_file.csv\n```\n\n* --exclude-accounts – Excludes specific member accounts in your organization. Can only be used with --all\n\n```\npython find_aos_extended_support_instances.py --all --exclude-accounts 111111111111,222222222222,333333333333\n```\n\n* If no argument is provided, script runs for the current account (payer account)\n\n```\npython find_aos_extended_support_instances.py\n```\n\n* --generate-accounts-file - Creates a `accounts.csv` CSV file in the current directory containing all AWS accounts in the AWS Organization. You can then edit/remove the accounts that you do not need from the CSV and use this file as a script input. Note: using this option will ignore all other script parameters and exit after generating the file.\n\n```\npython find_aos_extended_support_instances.py --generate-accounts-file\npython find_aos_extended_support_instances.py --accounts-file /path/to/accounts.csv\n```\n\n* --generate-regions-file - Creates a `regions.csv` CSV file in the current directory containing all AWS regions. You can then edit/remove the regions that you do not need from the CSV and use this file as a script input. Note: using this option will ignore all other script parameters and exit after generating the file.\n\n```\npython find_aos_extended_support_instances.py --generate-regions-file\npython find_aos_extended_support_instances.py --all --regions-file /path/to/regions.csv\n```\n\nAfter you run the script, it creates a CSV file in the \u003cpwd\u003e/output/aos_extended_support_instances_\u003c*Timestamp*\u003e format in the `output` directory.\n\n## Output\nThe script creates a folder called `output/` in the same directory where the script runs from on first run. Subsequently, it uses the `output/` folder to save the results.\n\nThe final output of the script is a csv called `./output/opensearch_extended_support_instances-\u003ctimestamp\u003e.csv` in the same directory where the script is run from. The headers of the csv are: \n```\nAccountId                    : The AWS account ID\nRegion                       : The Region in which the Opensearch/ElasticSearch instance is in, eg `us-east-1`\nRegionName                   : The full AWS region name, eg `US East (N. Virginia)`\nDomainName                   : Opensearch/Elasticsearch Domain name\nARN                          : ARN of the Oepensearch domain\nEngineVersion                : Opensearch/Elasticsearch version, e.g. OpenSearch_1.0, Elasticsearch_1.5\nDedicatedMasterType          : Instance type of Master nodes\nDedicatedMasterCount         : Number of Master nodes\nNormalization Factor (Master Nodes) : The NF for Master node instance size, e.g. medium = 2, xlarge = 8\nInstanceType                 : Instance type of data/instance nodes\nInstanceCount                : Number of Data/Instance nodes\nNormalization Factor (Data Nodes)         : The NF for instance size, e.g. medium = 2, xlarge = 8\nWarmType                     : Instance type of UltraWarm nodes, if used.\nWarmCount                    : Number of UltraWarm Nodes\nNormalization Factor (Ultrawarm Nodes) : The NF for UltraWarm instance size, e.g. medium = 2, xlarge = 8\nCoordinatorNodeType          : Instance type of Coordinator nodes, if used.\nCoordinatorNodeCount         : Number of Coordinator nodes\nNormalization Factor (Coordinator Nodes): The NF for Coordinator node instance size, e.g. medium = 2, xlarge = 8\nRegional Price Per NIH       : Price per NIH in the region \nEnd of Standard Support      : Date when Standard support ends\nEnd of Extended Support      : Date when Extended support ends\nYearly Extended Support Cost : Yearly cost of being on extended support \n```\n\n**Note** - the Yearly cost is just the additional cost of extended support charges, it DOES NOT include the regular cost of running the opensearch cluster.\n\n\n## Cleanup\nIf you do not need to run the script again in future, you can simply delete the project folder from your laptop.\n\nTo remove the IAM role that was created using the CloudFormation Stack/StackSets, follow the steps to remove the stacks and then delete the stack set, as per the [AWS Documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started.html). This will delete the IAM role from your linked accounts. If the cloudformation stack set was deployed for the organization, then you will need the AWS Organizations OU-ID when deleting stack from the stack set. You can obtain it from the AWS Organizations console. \n\nIf the Cloudformation stack fails to delete for any reason, please perform a manual cleanup of the *AOSExtendedSupportCostEstimatorRole* IAM role from the accounts where the stack failed to delete.\n\n**NOTE:** Make sure you [Delete stack instances from your stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stackinstances-delete.html) before trying to [Delete the stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-delete.html) itself. \n\n## Troubleshooting\n\n### IAM role “AOSExtendedSupportCostEstimatorRole” not created in all member accounts of an AWS Organization\n\nThis issue mostly occurs when you create a stack instead of a **“stack set”** in [step 2](README.md#step-2-create-the-cloudformation-stack-set)\nof this procedure. If you create a stack, this only creates the required IAM role in the management account.\nYou must create a CloudFormation “stack set” in the management account of your AWS organization. Using a stack set\nensures that the required IAM role is created for all member accounts in the organization. Please see this AWS Documentation link to get started with [AWS CloudFormation Stack Sets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started.html)\n\n## Security\n\nSee [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.\n\n## License\n\nThis library is licensed under the MIT-0 License. See the LICENSE file.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-samples%2Fsample-opensearch-extended-support-cost-estimator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faws-samples%2Fsample-opensearch-extended-support-cost-estimator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-samples%2Fsample-opensearch-extended-support-cost-estimator/lists"}