OpenSearch: Stack Deployment Issue - CDK Opensearch is not Allow gp3 IOPS greater than 16k

[ashishdhingra]

Describe the bug

Typescript CDK limits the IOPS of the GP3 EBS volume for OpenSearch domains to 16000. While this limit is correct for GP3 volumes, OpenSearch allows for IOPS higher than 16000 as it will attach multiple GP3 volumes. Customers attempting to update their OpenSearch domain to use more than 16000 IOPS w/ GP3 are unable to due to this imposed limit.

        // Enforce minimum & maximum IOPS:
        // https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-ebs-volume.html
        const iopsRanges: { [key: string]: { Min: number; Max: number } } = {};
        iopsRanges[ec2.EbsDeviceVolumeType.GENERAL_PURPOSE_SSD_GP3] = { Min: 3000, Max: 16000 };
        iopsRanges[ec2.EbsDeviceVolumeType.PROVISIONED_IOPS_SSD] = { Min: 100, Max: 64000 };
        iopsRanges[ec2.EbsDeviceVolumeType.PROVISIONED_IOPS_SSD_IO2] = { Min: 100, Max: 64000 };
        const { Min, Max } = iopsRanges[volumeType];
        if (props.ebs?.iops < Min || props.ebs?.iops > Max) {
          throw new Error(`\`${volumeType}\` volumes iops must be between ${Min} and ${Max}.`);
        }

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts#L1636

Code Snippets: N/A

Errors or Stack Traces :

jsii.errors.JavaScriptError: 
  Error: `gp3` volumes iops must be between 3000 and 16000.
      at new Domain (/tmp/jsii-kernel-yVrGdt/node_modules/aws-cdk-lib/aws-opensearchservice/lib/domain.js:1:14840)
      at Kernel._Kernel_create (/tmp/tmpza50b2vr/lib/program.js:10108:25)
      at Kernel.create (/tmp/tmpza50b2vr/lib/program.js:9779:93)
      at KernelHost.processRequest (/tmp/tmpza50b2vr/lib/program.js:11696:36)
      at KernelHost.run (/tmp/tmpza50b2vr/lib/program.js:11656:22)
      at Immediate._onImmediate (/tmp/tmpza50b2vr/lib/program.js:11657:46)
      at process.processImmediate (node:internal/timers:476:21)

Expected Behavior

CDK OpenSearch construct should allow setting IOPS greater than 16000.

Kindly note that in AWS OpenSearch console, depending on other parameters (like Instance Type, etc.), UI allows setting IOPS upto or greater than 16000 with prescribed lower and upper limits. These parameter and IOPS limits need to be confirmed with OpenSearch team.

Current Behavior

Error is thrown:

jsii.errors.JavaScriptError: 
  Error: `gp3` volumes iops must be between 3000 and 16000.
      at new Domain (/tmp/jsii-kernel-yVrGdt/node_modules/aws-cdk-lib/aws-opensearchservice/lib/domain.js:1:14840)
      at Kernel._Kernel_create (/tmp/tmpza50b2vr/lib/program.js:10108:25)
      at Kernel.create (/tmp/tmpza50b2vr/lib/program.js:9779:93)
      at KernelHost.processRequest (/tmp/tmpza50b2vr/lib/program.js:11696:36)
      at KernelHost.run (/tmp/tmpza50b2vr/lib/program.js:11656:22)
      at Immediate._onImmediate (/tmp/tmpza50b2vr/lib/program.js:11657:46)
      at process.processImmediate (node:internal/timers:476:21)

Reproduction Steps

Refer issue description.

Possible Solution

No response

Additional Information/Context

External customer issue internal ticket for reference: V1321041874

There is a workaround proposed in the ticket:

const domain = new opensearch.Domain(this, 'OpenSearchDomain', {
        version: opensearch.EngineVersion.OPENSEARCH_2_11,
        capacity: {
          masterNodeInstanceType: 'r6g.8xlarge.search',
          masterNodes: 3,
          dataNodeInstanceType: 'r6g.8xlarge.search',
          dataNodes: 2,
        },
        ebs: {
          enabled: true,
          volumeType:  ec2.EbsDeviceVolumeType.GP3,
          volumeSize: 10240,
          iops: 16000,     #<-------This value will get overriden by the lines at the end. 
          throughput: 1000,
        },
        encryptionAtRest: {
          enabled: true,
        },
        nodeToNodeEncryption: true,
        zoneAwareness: {
          enabled: true,
          availabilityZoneCount: 2,
        },
      });

      const cfnDomain = domain.node.defaultChild as opensearch.CfnDomain
      cfnDomain.addPropertyOverride('EBSOptions.Iops', 40000);
      cfnDomain.addPropertyOverride('EBSOptions.Throughput',1187 )

CDK CLI Version

N/A

Framework Version

No response

Node.js Version

N/A

OS

N/A

Language

TypeScript

Language Version

No response

Other information

No response