# Source: https://docs.datadoghq.com/security/default_rules/def-000-9k4.md

---
title: OpenSearch domains should be deployed within a VPC
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > OpenSearch domains should be deployed
  within a VPC
---

# OpenSearch domains should be deployed within a VPC
 
## Description{% #description %}

This control verifies if OpenSearch domains are deployed within a VPC. Note that this control does not assess the VPC network configuration to determine if the domain is publicly accessible.

Deploying OpenSearch domains within a VPC allows them to communicate with other VPC resources over AWS's private network, avoiding public internet exposure. This setup enhances security by protecting data in transit. VPCs offer various network controls, such as security groups and network ACLs, to manage and secure access to OpenSearch domains. Transition public OpenSearch domains to VPCs to leverage these security features.

## Remediation{% #remediation %}

If you set up a domain with a public endpoint, you cannot move it into a VPC later. Instead, you need to create a new domain and transfer your data to it.

For guidance on deploying OpenSearch domains to a VPC and migrating data, refer to the [Launching your Amazon OpenSearch Service domains within a VPC](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html) and [Migrating data between domains and collections using Amazon OpenSearch Ingestion](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/creating-opensearch-service-pipeline.html) sections of the Amazon OpenSearch Service Developer Guide.