diff --git a/packages/@aws-cdk/aws-appsync/test/appsync-elasticsearch.test.ts b/packages/@aws-cdk/aws-appsync/test/appsync-elasticsearch.test.ts
index ad5057cf5d999..c6049ba4b3baa 100644
--- a/packages/@aws-cdk/aws-appsync/test/appsync-elasticsearch.test.ts
+++ b/packages/@aws-cdk/aws-appsync/test/appsync-elasticsearch.test.ts
@@ -1,7 +1,7 @@
 import * as path from 'path';
 import { Template } from '@aws-cdk/assertions';
 import * as es from '@aws-cdk/aws-elasticsearch';
-import { testDeprecated } from '@aws-cdk/cdk-build-tools';
+import { describeDeprecated } from '@aws-cdk/cdk-build-tools';
 import * as cdk from '@aws-cdk/core';
 import * as appsync from '../lib';
 
@@ -9,143 +9,146 @@ import * as appsync from '../lib';
 let stack: cdk.Stack;
 let api: appsync.GraphqlApi;
 let domain: es.Domain;
-beforeEach(() => {
-  stack = new cdk.Stack();
-  api = new appsync.GraphqlApi(stack, 'baseApi', {
-    name: 'api',
-    schema: appsync.Schema.fromAsset(path.join(__dirname, 'appsync.test.graphql')),
-  });
-  domain = new es.Domain(stack, 'EsDomain', {
-    version: es.ElasticsearchVersion.V7_10,
-  });
-});
-
-describe('Elasticsearch Data Source Configuration', () => {
-  testDeprecated('Elasticsearch configure properly', () => {
-    // WHEN
-    api.addElasticsearchDataSource('ds', domain);
-
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [{
-          Action: [
-            'es:ESHttpGet',
-            'es:ESHttpHead',
-            'es:ESHttpDelete',
-            'es:ESHttpPost',
-            'es:ESHttpPut',
-            'es:ESHttpPatch',
-          ],
-          Effect: 'Allow',
-          Resource: [{
-            'Fn::GetAtt': ['EsDomain1213C634', 'Arn'],
-          },
-          {
-            'Fn::Join': ['', [{
-              'Fn::GetAtt': ['EsDomain1213C634', 'Arn'],
-            }, '/*']],
-          }],
-        }],
-      },
+
+describeDeprecated('Appsync Elasticsearch integration', () => {
+  beforeEach(() => {
+    stack = new cdk.Stack();
+    api = new appsync.GraphqlApi(stack, 'baseApi', {
+      name: 'api',
+      schema: appsync.Schema.fromAsset(path.join(__dirname, 'appsync.test.graphql')),
+    });
+    domain = new es.Domain(stack, 'EsDomain', {
+      version: es.ElasticsearchVersion.V7_10,
     });
   });
 
-  testDeprecated('Elastic search configuration contains fully qualified url', () => {
-    // WHEN
-    api.addElasticsearchDataSource('ds', domain);
-
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      ElasticsearchConfig: {
-        Endpoint: {
-          'Fn::Join': ['', ['https://', {
-            'Fn::GetAtt': ['EsDomain1213C634', 'DomainEndpoint'],
-          }]],
+  describe('Elasticsearch Data Source Configuration', () => {
+    test('Elasticsearch configure properly', () => {
+      // WHEN
+      api.addElasticsearchDataSource('ds', domain);
+
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+        PolicyDocument: {
+          Version: '2012-10-17',
+          Statement: [{
+            Action: [
+              'es:ESHttpGet',
+              'es:ESHttpHead',
+              'es:ESHttpDelete',
+              'es:ESHttpPost',
+              'es:ESHttpPut',
+              'es:ESHttpPatch',
+            ],
+            Effect: 'Allow',
+            Resource: [{
+              'Fn::GetAtt': ['EsDomain1213C634', 'Arn'],
+            },
+            {
+              'Fn::Join': ['', [{
+                'Fn::GetAtt': ['EsDomain1213C634', 'Arn'],
+              }, '/*']],
+            }],
+          }],
         },
-      },
+      });
     });
-  });
 
-  testDeprecated('default configuration produces name identical to the id', () => {
-    // WHEN
-    api.addElasticsearchDataSource('ds', domain);
+    test('Elastic search configuration contains fully qualified url', () => {
+      // WHEN
+      api.addElasticsearchDataSource('ds', domain);
 
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      Type: 'AMAZON_ELASTICSEARCH',
-      Name: 'ds',
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        ElasticsearchConfig: {
+          Endpoint: {
+            'Fn::Join': ['', ['https://', {
+              'Fn::GetAtt': ['EsDomain1213C634', 'DomainEndpoint'],
+            }]],
+          },
+        },
+      });
     });
-  });
 
-  testDeprecated('appsync configures name correctly', () => {
-    // WHEN
-    api.addElasticsearchDataSource('ds', domain, {
-      name: 'custom',
-    });
+    test('default configuration produces name identical to the id', () => {
+      // WHEN
+      api.addElasticsearchDataSource('ds', domain);
 
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      Type: 'AMAZON_ELASTICSEARCH',
-      Name: 'custom',
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        Type: 'AMAZON_ELASTICSEARCH',
+        Name: 'ds',
+      });
     });
-  });
 
-  testDeprecated('appsync configures name and description correctly', () => {
-    // WHEN
-    api.addElasticsearchDataSource('ds', domain, {
-      name: 'custom',
-      description: 'custom description',
+    test('appsync configures name correctly', () => {
+      // WHEN
+      api.addElasticsearchDataSource('ds', domain, {
+        name: 'custom',
+      });
+
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        Type: 'AMAZON_ELASTICSEARCH',
+        Name: 'custom',
+      });
     });
 
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      Type: 'AMAZON_ELASTICSEARCH',
-      Name: 'custom',
-      Description: 'custom description',
+    test('appsync configures name and description correctly', () => {
+      // WHEN
+      api.addElasticsearchDataSource('ds', domain, {
+        name: 'custom',
+        description: 'custom description',
+      });
+
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        Type: 'AMAZON_ELASTICSEARCH',
+        Name: 'custom',
+        Description: 'custom description',
+      });
     });
-  });
 
-  testDeprecated('appsync errors when creating multiple elasticsearch data sources with no configuration', () => {
-    // WHEN
-    const when = () => {
-      api.addElasticsearchDataSource('ds', domain);
-      api.addElasticsearchDataSource('ds', domain);
-    };
-
-    // THEN
-    expect(when).toThrow('There is already a Construct with name \'ds\' in GraphqlApi [baseApi]');
-  });
-});
-
-describe('adding elasticsearch data source from imported api', () => {
-  testDeprecated('imported api can add ElasticsearchDataSource from id', () => {
-    // WHEN
-    const importedApi = appsync.GraphqlApi.fromGraphqlApiAttributes(stack, 'importedApi', {
-      graphqlApiId: api.apiId,
-    });
-    importedApi.addElasticsearchDataSource('ds', domain);
+    test('appsync errors when creating multiple elasticsearch data sources with no configuration', () => {
+      // WHEN
+      const when = () => {
+        api.addElasticsearchDataSource('ds', domain);
+        api.addElasticsearchDataSource('ds', domain);
+      };
 
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      Type: 'AMAZON_ELASTICSEARCH',
-      ApiId: { 'Fn::GetAtt': ['baseApiCDA4D43A', 'ApiId'] },
+      // THEN
+      expect(when).toThrow('There is already a Construct with name \'ds\' in GraphqlApi [baseApi]');
     });
   });
 
-  testDeprecated('imported api can add ElasticsearchDataSource from attributes', () => {
-    // WHEN
-    const importedApi = appsync.GraphqlApi.fromGraphqlApiAttributes(stack, 'importedApi', {
-      graphqlApiId: api.apiId,
-      graphqlApiArn: api.arn,
+  describe('adding elasticsearch data source from imported api', () => {
+    test('imported api can add ElasticsearchDataSource from id', () => {
+      // WHEN
+      const importedApi = appsync.GraphqlApi.fromGraphqlApiAttributes(stack, 'importedApi', {
+        graphqlApiId: api.apiId,
+      });
+      importedApi.addElasticsearchDataSource('ds', domain);
+
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        Type: 'AMAZON_ELASTICSEARCH',
+        ApiId: { 'Fn::GetAtt': ['baseApiCDA4D43A', 'ApiId'] },
+      });
     });
-    importedApi.addElasticsearchDataSource('ds', domain);
 
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
-      Type: 'AMAZON_ELASTICSEARCH',
-      ApiId: { 'Fn::GetAtt': ['baseApiCDA4D43A', 'ApiId'] },
+    test('imported api can add ElasticsearchDataSource from attributes', () => {
+      // WHEN
+      const importedApi = appsync.GraphqlApi.fromGraphqlApiAttributes(stack, 'importedApi', {
+        graphqlApiId: api.apiId,
+        graphqlApiArn: api.arn,
+      });
+      importedApi.addElasticsearchDataSource('ds', domain);
+
+      // THEN
+      Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+        Type: 'AMAZON_ELASTICSEARCH',
+        ApiId: { 'Fn::GetAtt': ['baseApiCDA4D43A', 'ApiId'] },
+      });
     });
   });
 });
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticsearch/README.md b/packages/@aws-cdk/aws-elasticsearch/README.md
index 4aaa5c72d75c8..fab6cc2691548 100644
--- a/packages/@aws-cdk/aws-elasticsearch/README.md
+++ b/packages/@aws-cdk/aws-elasticsearch/README.md
@@ -3,20 +3,9 @@
 
 ---
 
-Features                           | Stability
------------------------------------|----------------------------------------------------------------
-CFN Resources                      | ![Stable](https://img.shields.io/badge/stable-success.svg?style=for-the-badge)
-Higher level constructs for Domain | ![Stable](https://img.shields.io/badge/stable-success.svg?style=for-the-badge)
+![Deprecated](https://img.shields.io/badge/deprecated-critical.svg?style=for-the-badge)
 
-> **CFN Resources:** All classes with the `Cfn` prefix in this module ([CFN Resources]) are always
-> stable and safe to use.
->
-> [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
-
-<!-- -->
-
-> **Stable:** Higher level constructs in this module that are marked stable will not undergo any
-> breaking changes. They will strictly follow the [Semantic Versioning](https://semver.org/) model.
+> This API may emit warnings. Backward compatibility is not guaranteed.
 
 ---
 
diff --git a/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts b/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
index 88930526b81a5..fbd769440fab1 100644
--- a/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
@@ -20,61 +20,99 @@ import * as perms from './perms';
  * Elasticsearch version
  */
 export class ElasticsearchVersion {
-  /** AWS Elasticsearch 1.5 */
+  /**
+   * AWS Elasticsearch 1.5
+   */
   public static readonly V1_5 = ElasticsearchVersion.of('1.5');
 
-  /** AWS Elasticsearch 2.3 */
+  /**
+   * AWS Elasticsearch 2.3
+   */
   public static readonly V2_3 = ElasticsearchVersion.of('2.3');
 
-  /** AWS Elasticsearch 5.1 */
+  /**
+   * AWS Elasticsearch 5.1
+   */
   public static readonly V5_1 = ElasticsearchVersion.of('5.1');
 
-  /** AWS Elasticsearch 5.3 */
+  /**
+   * AWS Elasticsearch 5.3
+   */
   public static readonly V5_3 = ElasticsearchVersion.of('5.3');
 
-  /** AWS Elasticsearch 5.5 */
+  /**
+   * AWS Elasticsearch 5.5
+   */
   public static readonly V5_5 = ElasticsearchVersion.of('5.5');
 
-  /** AWS Elasticsearch 5.6 */
+  /**
+   * AWS Elasticsearch 5.6
+   */
   public static readonly V5_6 = ElasticsearchVersion.of('5.6');
 
-  /** AWS Elasticsearch 6.0 */
+  /**
+   * AWS Elasticsearch 6.0
+   */
   public static readonly V6_0 = ElasticsearchVersion.of('6.0');
 
-  /** AWS Elasticsearch 6.2 */
+  /**
+   * AWS Elasticsearch 6.2
+   */
   public static readonly V6_2 = ElasticsearchVersion.of('6.2');
 
-  /** AWS Elasticsearch 6.3 */
+  /**
+   * AWS Elasticsearch 6.3
+   */
   public static readonly V6_3 = ElasticsearchVersion.of('6.3');
 
-  /** AWS Elasticsearch 6.4 */
+  /**
+   * AWS Elasticsearch 6.4
+   */
   public static readonly V6_4 = ElasticsearchVersion.of('6.4');
 
-  /** AWS Elasticsearch 6.5 */
+  /**
+   * AWS Elasticsearch 6.5
+   */
   public static readonly V6_5 = ElasticsearchVersion.of('6.5');
 
-  /** AWS Elasticsearch 6.7 */
+  /**
+   * AWS Elasticsearch 6.7
+   */
   public static readonly V6_7 = ElasticsearchVersion.of('6.7');
 
-  /** AWS Elasticsearch 6.8 */
+  /**
+   * AWS Elasticsearch 6.8
+   */
   public static readonly V6_8 = ElasticsearchVersion.of('6.8');
 
-  /** AWS Elasticsearch 7.1 */
+  /**
+   * AWS Elasticsearch 7.1
+   */
   public static readonly V7_1 = ElasticsearchVersion.of('7.1');
 
-  /** AWS Elasticsearch 7.4 */
+  /**
+   * AWS Elasticsearch 7.4
+   */
   public static readonly V7_4 = ElasticsearchVersion.of('7.4');
 
-  /** AWS Elasticsearch 7.7 */
+  /**
+   * AWS Elasticsearch 7.7
+   */
   public static readonly V7_7 = ElasticsearchVersion.of('7.7');
 
-  /** AWS Elasticsearch 7.8 */
+  /**
+   * AWS Elasticsearch 7.8
+   */
   public static readonly V7_8 = ElasticsearchVersion.of('7.8');
 
-  /** AWS Elasticsearch 7.9 */
+  /**
+   * AWS Elasticsearch 7.9
+   */
   public static readonly V7_9 = ElasticsearchVersion.of('7.9');
 
-  /** AWS Elasticsearch 7.10 */
+  /**
+   * AWS Elasticsearch 7.10
+   */
   public static readonly V7_10 = ElasticsearchVersion.of('7.10');
 
   /**
@@ -93,12 +131,15 @@ export class ElasticsearchVersion {
 /**
  * Configures the capacity of the cluster such as the instance type and the
  * number of instances.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface CapacityConfig {
   /**
    * The number of instances to use for the master node.
    *
    * @default - no dedicated master nodes
+   * @deprecated use opensearchservice module instead
    */
   readonly masterNodes?: number;
 
@@ -110,6 +151,7 @@ export interface CapacityConfig {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default - r5.large.elasticsearch
+   * @deprecated use opensearchservice module instead
    */
   readonly masterNodeInstanceType?: string;
 
@@ -117,6 +159,7 @@ export interface CapacityConfig {
    * The number of data nodes (instances) to use in the Amazon ES domain.
    *
    * @default - 1
+   * @deprecated use opensearchservice module instead
    */
   readonly dataNodes?: number;
 
@@ -127,6 +170,7 @@ export interface CapacityConfig {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default - r5.large.elasticsearch
+   * @deprecated use opensearchservice module instead
    */
   readonly dataNodeInstanceType?: string;
 
@@ -134,6 +178,7 @@ export interface CapacityConfig {
    * The number of UltraWarm nodes (instances) to use in the Amazon ES domain.
    *
    * @default - no UltraWarm nodes
+   * @deprecated use opensearchservice module instead
    */
   readonly warmNodes?: number;
 
@@ -144,6 +189,7 @@ export interface CapacityConfig {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default - ultrawarm1.medium.elasticsearch
+   * @deprecated use opensearchservice module instead
    */
   readonly warmInstanceType?: string;
 
@@ -151,6 +197,8 @@ export interface CapacityConfig {
 
 /**
  * Specifies zone awareness configuration options.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface ZoneAwarenessConfig {
   /**
@@ -165,6 +213,7 @@ export interface ZoneAwarenessConfig {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly enabled?: boolean;
 
@@ -173,6 +222,7 @@ export interface ZoneAwarenessConfig {
    * want the domain to use. Valid values are 2 and 3.
    *
    * @default - 2 if zone awareness is enabled.
+   * @deprecated use opensearchservice module instead
    */
   readonly availabilityZoneCount?: number;
 }
@@ -183,6 +233,8 @@ export interface ZoneAwarenessConfig {
  * [Configuring EBS-based Storage]
  * (https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html#es-createdomain-configure-ebs)
  * in the Amazon Elasticsearch Service Developer Guide.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface EbsOptions {
   /**
@@ -190,6 +242,7 @@ export interface EbsOptions {
    * Amazon ES domain.
    *
    * @default - true
+   * @deprecated use opensearchservice module instead
    */
   readonly enabled?: boolean;
 
@@ -199,6 +252,7 @@ export interface EbsOptions {
    * volume type.
    *
    * @default - iops are not set.
+   * @deprecated use opensearchservice module instead
    */
   readonly iops?: number;
 
@@ -211,6 +265,7 @@ export interface EbsOptions {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default 10
+   * @deprecated use opensearchservice module instead
    */
   readonly volumeSize?: number;
 
@@ -221,12 +276,15 @@ export interface EbsOptions {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default gp2
+   * @deprecated use opensearchservice module instead
    */
   readonly volumeType?: ec2.EbsDeviceVolumeType;
 }
 
 /**
  * Configures log settings for the domain.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface LoggingOptions {
   /**
@@ -234,6 +292,7 @@ export interface LoggingOptions {
    * Requires Elasticsearch version 5.1 or later.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly slowSearchLogEnabled?: boolean;
 
@@ -241,6 +300,7 @@ export interface LoggingOptions {
    * Log slow searches to this log group.
    *
    * @default - a new log group is created if slow search logging is enabled
+   * @deprecated use opensearchservice module instead
    */
   readonly slowSearchLogGroup?: logs.ILogGroup;
 
@@ -249,6 +309,7 @@ export interface LoggingOptions {
    * Requires Elasticsearch version 5.1 or later.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly slowIndexLogEnabled?: boolean;
 
@@ -256,6 +317,7 @@ export interface LoggingOptions {
    * Log slow indices to this log group.
    *
    * @default - a new log group is created if slow index logging is enabled
+   * @deprecated use opensearchservice module instead
    */
   readonly slowIndexLogGroup?: logs.ILogGroup;
 
@@ -264,6 +326,7 @@ export interface LoggingOptions {
    * Requires Elasticsearch version 5.1 or later.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly appLogEnabled?: boolean;
 
@@ -271,6 +334,7 @@ export interface LoggingOptions {
    * Log Elasticsearch application logs to this log group.
    *
    * @default - a new log group is created if app logging is enabled
+   * @deprecated use opensearchservice module instead
    */
   readonly appLogGroup?: logs.ILogGroup;
 
@@ -279,6 +343,7 @@ export interface LoggingOptions {
    * Requires Elasticsearch version 6.7 or later and fine grained access control to be enabled.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly auditLogEnabled?: boolean;
 
@@ -286,6 +351,7 @@ export interface LoggingOptions {
    * Log Elasticsearch audit logs to this log group.
    *
    * @default - a new log group is created if audit logging is enabled
+   * @deprecated use opensearchservice module instead
    */
   readonly auditLogGroup?: logs.ILogGroup;
 }
@@ -294,12 +360,15 @@ export interface LoggingOptions {
  * Whether the domain should encrypt data at rest, and if so, the AWS Key
  * Management Service (KMS) key to use. Can only be used to create a new domain,
  * not update an existing one. Requires Elasticsearch version 5.1 or later.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface EncryptionAtRestOptions {
   /**
    * Specify true to enable encryption at rest.
    *
    * @default - encryption at rest is disabled.
+   * @deprecated use opensearchservice module instead
    */
   readonly enabled?: boolean;
 
@@ -307,6 +376,7 @@ export interface EncryptionAtRestOptions {
    * Supply if using KMS key for encryption at rest.
    *
    * @default - uses default aws/es KMS key.
+   * @deprecated use opensearchservice module instead
    */
   readonly kmsKey?: kms.IKey;
 }
@@ -314,10 +384,13 @@ export interface EncryptionAtRestOptions {
 /**
  * Configures Amazon ES to use Amazon Cognito authentication for Kibana.
  * @see https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html
+ * @deprecated use opensearchservice module instead
  */
 export interface CognitoOptions {
   /**
    * The Amazon Cognito identity pool ID that you want Amazon ES to use for Kibana authentication.
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly identityPoolId: string;
 
@@ -325,17 +398,22 @@ export interface CognitoOptions {
    * A role that allows Amazon ES to configure your user pool and identity pool. It must have the `AmazonESCognitoAccess` policy attached to it.
    *
    * @see https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html#es-cognito-auth-prereq
+   * @deprecated use opensearchservice module instead
    */
   readonly role: iam.IRole;
 
   /**
    * The Amazon Cognito user pool ID that you want Amazon ES to use for Kibana authentication.
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly userPoolId: string;
 }
 
 /**
  * The minimum TLS version required for traffic to the domain.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export enum TLSSecurityPolicy {
   /** Cipher suite TLS 1.0 */
@@ -346,12 +424,15 @@ export enum TLSSecurityPolicy {
 
 /**
  * Specifies options for fine-grained access control.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface AdvancedSecurityOptions {
   /**
    * ARN for the master user. Only specify this or masterUserName, but not both.
    *
    * @default - fine-grained access control is disabled
+   * @deprecated use opensearchservice module instead
    */
   readonly masterUserArn?: string;
 
@@ -359,6 +440,7 @@ export interface AdvancedSecurityOptions {
    * Username for the master user. Only specify this or masterUserArn, but not both.
    *
    * @default - fine-grained access control is disabled
+   * @deprecated use opensearchservice module instead
    */
   readonly masterUserName?: string;
 
@@ -370,40 +452,50 @@ export interface AdvancedSecurityOptions {
    * Secrets Manager.
    *
    * @default - A Secrets Manager generated password
+   * @deprecated use opensearchservice module instead
    */
   readonly masterUserPassword?: cdk.SecretValue;
 }
 
 /**
  * Configures a custom domain endpoint for the ES domain
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface CustomEndpointOptions {
   /**
    * The custom domain name to assign
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly domainName: string;
 
   /**
    * The certificate to use
    * @default - create a new one
+   * @deprecated use opensearchservice module instead
    */
   readonly certificate?: acm.ICertificate;
 
   /**
    * The hosted zone in Route53 to create the CNAME record in
    * @default - do not create a CNAME
+   * @deprecated use opensearchservice module instead
    */
   readonly hostedZone?: route53.IHostedZone;
 }
 
 /**
  * Properties for an AWS Elasticsearch Domain.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface DomainProps {
   /**
    * Domain Access policies.
    *
    * @default - No access policies.
+   * @deprecated use opensearchservice module instead
    */
   readonly accessPolicies?: iam.PolicyStatement[];
 
@@ -412,6 +504,7 @@ export interface DomainProps {
    *
    * @see https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html#es-createdomain-configure-advanced-options
    * @default - no advanced options are specified
+   * @deprecated use opensearchservice module instead
    */
   readonly advancedOptions?: { [key: string]: (string) };
 
@@ -419,6 +512,7 @@ export interface DomainProps {
    * Configures Amazon ES to use Amazon Cognito authentication for Kibana.
    *
    * @default - Cognito not used for authentication to Kibana.
+   * @deprecated use opensearchservice module instead
    */
   readonly cognitoKibanaAuth?: CognitoOptions;
 
@@ -426,6 +520,7 @@ export interface DomainProps {
    * Enforces a particular physical domain name.
    *
    * @default - A name will be auto-generated.
+   * @deprecated use opensearchservice module instead
    */
   readonly domainName?: string;
 
@@ -437,6 +532,7 @@ export interface DomainProps {
    * in the Amazon Elasticsearch Service Developer Guide.
    *
    * @default - 10 GiB General Purpose (SSD) volumes per node.
+   * @deprecated use opensearchservice module instead
    */
   readonly ebs?: EbsOptions;
 
@@ -444,6 +540,7 @@ export interface DomainProps {
    * The cluster capacity configuration for the Amazon ES domain.
    *
    * @default - 1 r5.large.elasticsearch data node; no dedicated master nodes.
+   * @deprecated use opensearchservice module instead
    */
   readonly capacity?: CapacityConfig;
 
@@ -451,11 +548,14 @@ export interface DomainProps {
    * The cluster zone awareness configuration for the Amazon ES domain.
    *
    * @default - no zone awareness (1 AZ)
+   * @deprecated use opensearchservice module instead
    */
   readonly zoneAwareness?: ZoneAwarenessConfig;
 
   /**
    * The Elasticsearch version that your domain will leverage.
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly version: ElasticsearchVersion;
 
@@ -463,6 +563,7 @@ export interface DomainProps {
    * Encryption at rest options for the cluster.
    *
    * @default - No encryption at rest
+   * @deprecated use opensearchservice module instead
    */
   readonly encryptionAtRest?: EncryptionAtRestOptions;
 
@@ -470,6 +571,7 @@ export interface DomainProps {
    * Configuration log publishing configuration options.
    *
    * @default - No logs are published
+   * @deprecated use opensearchservice module instead
    */
   readonly logging?: LoggingOptions;
 
@@ -478,6 +580,7 @@ export interface DomainProps {
    * Requires Elasticsearch version 6.0 or later.
    *
    * @default - Node to node encryption is not enabled.
+   * @deprecated use opensearchservice module instead
    */
   readonly nodeToNodeEncryption?: boolean;
 
@@ -487,6 +590,7 @@ export interface DomainProps {
    * versions below 5.3.
    *
    * @default - Hourly automated snapshots not used
+   * @deprecated use opensearchservice module instead
    */
   readonly automatedSnapshotStartHour?: number;
 
@@ -495,6 +599,7 @@ export interface DomainProps {
    *
    * @see https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html
    * @default - Domain is not placed in a VPC.
+   * @deprecated use opensearchservice module instead
    */
   readonly vpc?: ec2.IVpc;
 
@@ -506,6 +611,7 @@ export interface DomainProps {
    *
    * @see https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
    * @default - One new security group is created.
+   * @deprecated use opensearchservice module instead
    */
   readonly securityGroups?: ec2.ISecurityGroup[];
 
@@ -518,6 +624,7 @@ export interface DomainProps {
    *
    * @see https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
    * @default - All private subnets.
+   * @deprecated use opensearchservice module instead
    */
   readonly vpcSubnets?: ec2.SubnetSelection[];
 
@@ -525,6 +632,7 @@ export interface DomainProps {
    * True to require that all traffic to the domain arrive over HTTPS.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly enforceHttps?: boolean;
 
@@ -532,6 +640,7 @@ export interface DomainProps {
    * The minimum TLS version required for traffic to the domain.
    *
    * @default - TLSSecurityPolicy.TLS_1_0
+   * @deprecated use opensearchservice module instead
    */
   readonly tlsSecurityPolicy?: TLSSecurityPolicy;
 
@@ -542,6 +651,7 @@ export interface DomainProps {
    * enforced HTTPS.
    *
    * @default - fine-grained access control is disabled
+   * @deprecated use opensearchservice module instead
    */
   readonly fineGrainedAccessControl?: AdvancedSecurityOptions;
 
@@ -556,6 +666,7 @@ export interface DomainProps {
    * setting will cause a failure.
    *
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly useUnsignedBasicAuth?: boolean;
 
@@ -565,6 +676,7 @@ export interface DomainProps {
    *
    * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-upgradeelasticsearchdomain
    * @default - false
+   * @deprecated use opensearchservice module instead
    */
   readonly enableVersionUpgrade?: boolean;
 
@@ -572,6 +684,7 @@ export interface DomainProps {
    * Policy to apply when the domain is removed from the stack
    *
    * @default RemovalPolicy.RETAIN
+   * @deprecated use opensearchservice module instead
    */
   readonly removalPolicy?: cdk.RemovalPolicy;
 
@@ -580,18 +693,22 @@ export interface DomainProps {
    *
    * If you specify a Route53 hosted zone it will create a CNAME record and use DNS validation for the certificate
    * @default - no custom domain endpoint will be configured
+   * @deprecated use opensearchservice module instead
    */
   readonly customEndpoint?: CustomEndpointOptions;
 }
 
 /**
  * An interface that represents an Elasticsearch domain - either created with the CDK, or an existing one.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface IDomain extends cdk.IResource {
   /**
    * Arn of the Elasticsearch domain.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   readonly domainArn: string;
 
@@ -599,6 +716,7 @@ export interface IDomain extends cdk.IResource {
    * Domain name of the Elasticsearch domain.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   readonly domainName: string;
 
@@ -606,6 +724,7 @@ export interface IDomain extends cdk.IResource {
    * Endpoint of the Elasticsearch domain.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   readonly domainEndpoint: string;
 
@@ -614,6 +733,7 @@ export interface IDomain extends cdk.IResource {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantRead(identity: iam.IGrantable): iam.Grant;
 
@@ -622,6 +742,7 @@ export interface IDomain extends cdk.IResource {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantWrite(identity: iam.IGrantable): iam.Grant;
 
@@ -630,6 +751,7 @@ export interface IDomain extends cdk.IResource {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantReadWrite(identity: iam.IGrantable): iam.Grant;
 
@@ -639,6 +761,7 @@ export interface IDomain extends cdk.IResource {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexRead(index: string, identity: iam.IGrantable): iam.Grant;
 
@@ -648,6 +771,7 @@ export interface IDomain extends cdk.IResource {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexWrite(index: string, identity: iam.IGrantable): iam.Grant;
 
@@ -657,6 +781,7 @@ export interface IDomain extends cdk.IResource {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexReadWrite(index: string, identity: iam.IGrantable): iam.Grant;
 
@@ -666,6 +791,7 @@ export interface IDomain extends cdk.IResource {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathRead(path: string, identity: iam.IGrantable): iam.Grant;
 
@@ -675,6 +801,7 @@ export interface IDomain extends cdk.IResource {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathWrite(path: string, identity: iam.IGrantable): iam.Grant;
 
@@ -684,11 +811,14 @@ export interface IDomain extends cdk.IResource {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathReadWrite(path: string, identity: iam.IGrantable): iam.Grant;
 
   /**
    * Return the given named metric for this Domain.
+   *
+   * @deprecated use opensearchservice module instead
    */
   metric(metricName: string, props?: MetricOptions): Metric;
 
@@ -696,6 +826,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for the time the cluster status is red.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricClusterStatusRed(props?: MetricOptions): Metric;
 
@@ -703,6 +834,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for the time the cluster status is yellow.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricClusterStatusYellow(props?: MetricOptions): Metric;
 
@@ -710,6 +842,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for the storage space of nodes in the cluster.
    *
    * @default minimum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricFreeStorageSpace(props?: MetricOptions): Metric;
 
@@ -717,6 +850,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for the cluster blocking index writes.
    *
    * @default maximum over 1 minute
+   * @deprecated use opensearchservice module instead
    */
   metricClusterIndexWritesBlocked(props?: MetricOptions): Metric;
 
@@ -724,6 +858,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for the number of nodes.
    *
    * @default minimum over 1 hour
+   * @deprecated use opensearchservice module instead
    */
   metricNodes(props?: MetricOptions): Metric;
 
@@ -731,6 +866,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for automated snapshot failures.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricAutomatedSnapshotFailure(props?: MetricOptions): Metric;
 
@@ -738,6 +874,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for CPU utilization.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricCPUUtilization(props?: MetricOptions): Metric;
 
@@ -745,6 +882,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for JVM memory pressure.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricJVMMemoryPressure(props?: MetricOptions): Metric;
 
@@ -752,6 +890,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for master CPU utilization.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricMasterCPUUtilization(props?: MetricOptions): Metric;
 
@@ -759,6 +898,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for master JVM memory pressure.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricMasterJVMMemoryPressure(props?: MetricOptions): Metric;
 
@@ -766,6 +906,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for KMS key errors.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricKMSKeyError(props?: MetricOptions): Metric;
 
@@ -773,6 +914,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for KMS key being inaccessible.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricKMSKeyInaccessible(props?: MetricOptions): Metric;
 
@@ -780,6 +922,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for number of searchable documents.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricSearchableDocuments(props?: MetricOptions): Metric;
 
@@ -787,6 +930,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for search latency.
    *
    * @default p99 over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricSearchLatency(props?: MetricOptions): Metric;
 
@@ -794,6 +938,7 @@ export interface IDomain extends cdk.IResource {
    * Metric for indexing latency.
    *
    * @default p99 over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   metricIndexingLatency(props?: MetricOptions): Metric;
 }
@@ -812,6 +957,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantRead(identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -827,6 +973,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantWrite(identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -842,6 +989,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * principal (Role/Group/User).
    *
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantReadWrite(identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -858,6 +1006,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexRead(index: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -874,6 +1023,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexWrite(index: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -890,6 +1040,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param index The index to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantIndexReadWrite(index: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -906,6 +1057,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathRead(path: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -921,6 +1073,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathWrite(path: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -936,6 +1089,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    *
    * @param path The path to grant permissions for
    * @param identity The principal
+   * @deprecated use opensearchservice module instead
    */
   grantPathReadWrite(path: string, identity: iam.IGrantable): iam.Grant {
     return this.grant(
@@ -947,6 +1101,8 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
 
   /**
    * Return the given named metric for this Domain.
+   *
+   * @deprecated use opensearchservice module instead
    */
   public metric(metricName: string, props?: MetricOptions): Metric {
     return new Metric({
@@ -964,6 +1120,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for the time the cluster status is red.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricClusterStatusRed(props?: MetricOptions): Metric {
     return this.metric('ClusterStatus.red', {
@@ -976,6 +1133,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for the time the cluster status is yellow.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricClusterStatusYellow(props?: MetricOptions): Metric {
     return this.metric('ClusterStatus.yellow', {
@@ -988,6 +1146,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for the storage space of nodes in the cluster.
    *
    * @default minimum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricFreeStorageSpace(props?: MetricOptions): Metric {
     return this.metric('FreeStorageSpace', {
@@ -1000,6 +1159,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for the cluster blocking index writes.
    *
    * @default maximum over 1 minute
+   * @deprecated use opensearchservice module instead
    */
   public metricClusterIndexWritesBlocked(props?: MetricOptions): Metric {
     return this.metric('ClusterIndexWritesBlocked', {
@@ -1013,6 +1173,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for the number of nodes.
    *
    * @default minimum over 1 hour
+   * @deprecated use opensearchservice module instead
    */
   public metricNodes(props?: MetricOptions): Metric {
     return this.metric('Nodes', {
@@ -1026,6 +1187,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for automated snapshot failures.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricAutomatedSnapshotFailure(props?: MetricOptions): Metric {
     return this.metric('AutomatedSnapshotFailure', {
@@ -1038,6 +1200,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for CPU utilization.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricCPUUtilization(props?: MetricOptions): Metric {
     return this.metric('CPUUtilization', {
@@ -1050,6 +1213,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for JVM memory pressure.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricJVMMemoryPressure(props?: MetricOptions): Metric {
     return this.metric('JVMMemoryPressure', {
@@ -1062,6 +1226,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for master CPU utilization.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricMasterCPUUtilization(props?: MetricOptions): Metric {
     return this.metric('MasterCPUUtilization', {
@@ -1074,6 +1239,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for master JVM memory pressure.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricMasterJVMMemoryPressure(props?: MetricOptions): Metric {
     return this.metric('MasterJVMMemoryPressure', {
@@ -1086,6 +1252,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for KMS key errors.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricKMSKeyError(props?: MetricOptions): Metric {
     return this.metric('KMSKeyError', {
@@ -1098,6 +1265,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for KMS key being inaccessible.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricKMSKeyInaccessible(props?: MetricOptions): Metric {
     return this.metric('KMSKeyInaccessible', {
@@ -1110,6 +1278,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for number of searchable documents.
    *
    * @default maximum over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricSearchableDocuments(props?: MetricOptions): Metric {
     return this.metric('SearchableDocuments', {
@@ -1122,6 +1291,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for search latency.
    *
    * @default p99 over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricSearchLatency(props?: MetricOptions): Metric {
     return this.metric('SearchLatency', { statistic: 'p99', ...props });
@@ -1131,6 +1301,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
    * Metric for indexing latency.
    *
    * @default p99 over 5 minutes
+   * @deprecated use opensearchservice module instead
    */
   public metricIndexingLatency(props?: MetricOptions): Metric {
     return this.metric('IndexingLatency', { statistic: 'p99', ...props });
@@ -1159,15 +1330,21 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
 
 /**
  * Reference to an Elasticsearch domain.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export interface DomainAttributes {
   /**
    * The ARN of the Elasticsearch domain.
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly domainArn: string;
 
   /**
    * The domain endpoint of the Elasticsearch domain.
+   *
+   * @deprecated use opensearchservice module instead
    */
   readonly domainEndpoint: string;
 }
@@ -1175,6 +1352,8 @@ export interface DomainAttributes {
 
 /**
  * Provides an Elasticsearch domain.
+ *
+ * @deprecated use opensearchservice module instead
  */
 export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
   /**
@@ -1183,6 +1362,7 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
    * @param scope The parent creating construct (usually `this`).
    * @param id The construct's name.
    * @param domainEndpoint The domain's endpoint.
+   * @deprecated use opensearchservice module instead
    */
   public static fromDomainEndpoint(
     scope: Construct,
@@ -1209,6 +1389,7 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
    * @param scope The parent creating construct (usually `this`).
    * @param id The construct's name.
    * @param attrs A `DomainAttributes` object.
+   * @deprecated use opensearchservice module instead
    */
   public static fromDomainAttributes(scope: Construct, id: string, attrs: DomainAttributes): IDomain {
     const { domainArn, domainEndpoint } = attrs;
@@ -1224,14 +1405,26 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
     };
   }
 
+  /**
+   * @deprecated use opensearchservice module instead
+   */
   public readonly domainArn: string;
+
+  /**
+   * @deprecated use opensearchservice module instead
+   */
   public readonly domainName: string;
+
+  /**
+   * @deprecated use opensearchservice module instead
+   */
   public readonly domainEndpoint: string;
 
   /**
    * Log group that slow searches are logged to.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   public readonly slowSearchLogGroup?: logs.ILogGroup;
 
@@ -1239,6 +1432,7 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
    * Log group that slow indices are logged to.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   public readonly slowIndexLogGroup?: logs.ILogGroup;
 
@@ -1246,6 +1440,7 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
    * Log group that application logs are logged to.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   public readonly appLogGroup?: logs.ILogGroup;
 
@@ -1253,11 +1448,14 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
    * Log group that audit logs are logged to.
    *
    * @attribute
+   * @deprecated use opensearchservice module instead
    */
   public readonly auditLogGroup?: logs.ILogGroup;
 
   /**
    * Master user password if fine grained access control is configured.
+   *
+   * @deprecated use opensearchservice module instead
    */
   public readonly masterUserPassword?: cdk.SecretValue;
 
@@ -1735,6 +1933,8 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
   /**
    * Manages network connections to the domain. This will throw an error in case the domain
    * is not placed inside a VPC.
+   *
+   * @deprecated use opensearchservice module instead
    */
   public get connections(): ec2.Connections {
     if (!this._connections) {
@@ -1745,6 +1945,8 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
 
   /**
    * Add policy statements to the domain access policy
+   *
+   * @deprecated use opensearchservice module instead
    */
   public addAccessPolicies(...accessPolicyStatements: iam.PolicyStatement[]) {
     if (accessPolicyStatements.length > 0) {
diff --git a/packages/@aws-cdk/aws-elasticsearch/package.json b/packages/@aws-cdk/aws-elasticsearch/package.json
index bbcdd5dbe8061..6bc9107a0abf5 100644
--- a/packages/@aws-cdk/aws-elasticsearch/package.json
+++ b/packages/@aws-cdk/aws-elasticsearch/package.json
@@ -118,12 +118,6 @@
   },
   "stability": "stable",
   "maturity": "stable",
-  "features": [
-    {
-      "name": "Higher level constructs for Domain",
-      "stability": "Stable"
-    }
-  ],
   "awscdkio": {
     "announce": false
   },
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts b/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
index 63387de5ee64f..ac12536fdcd30 100644
--- a/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
@@ -7,8 +7,10 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as logs from '@aws-cdk/aws-logs';
 import * as route53 from '@aws-cdk/aws-route53';
+import { testDeprecated } from '@aws-cdk/cdk-build-tools';
 import { App, Stack, Duration, SecretValue, CfnParameter, Token } from '@aws-cdk/core';
-import { Domain, ElasticsearchVersion } from '../lib';
+
+import { Domain, ElasticsearchVersion } from '../lib/domain';
 
 let app: App;
 let stack: Stack;
@@ -29,7 +31,7 @@ const readWriteActions = [
   ...writeActions,
 ];
 
-test('connections throws if domain is placed inside a vpc', () => {
+testDeprecated('connections throws if domain is placed inside a vpc', () => {
 
   expect(() => {
     new Domain(stack, 'Domain', {
@@ -38,7 +40,7 @@ test('connections throws if domain is placed inside a vpc', () => {
   }).toThrowError("Connections are only available on VPC enabled domains. Use the 'vpc' property to place a domain inside a VPC");
 });
 
-test('subnets and security groups can be provided when vpc is used', () => {
+testDeprecated('subnets and security groups can be provided when vpc is used', () => {
 
   const vpc = new Vpc(stack, 'Vpc');
   const securityGroup = new SecurityGroup(stack, 'CustomSecurityGroup', {
@@ -71,7 +73,7 @@ test('subnets and security groups can be provided when vpc is used', () => {
   });
 });
 
-test('default subnets and security group when vpc is used', () => {
+testDeprecated('default subnets and security group when vpc is used', () => {
 
   const vpc = new Vpc(stack, 'Vpc');
   const domain = new Domain(stack, 'Domain', {
@@ -105,7 +107,7 @@ test('default subnets and security group when vpc is used', () => {
   });
 });
 
-test('default removalpolicy is retain', () => {
+testDeprecated('default removalpolicy is retain', () => {
   new Domain(stack, 'Domain', {
     version: ElasticsearchVersion.V7_1,
   });
@@ -115,7 +117,7 @@ test('default removalpolicy is retain', () => {
   });
 });
 
-test('grants kms permissions if needed', () => {
+testDeprecated('grants kms permissions if needed', () => {
 
   const key = new kms.Key(stack, 'Key');
 
@@ -153,7 +155,7 @@ test('grants kms permissions if needed', () => {
 
 });
 
-test('minimal example renders correctly', () => {
+testDeprecated('minimal example renders correctly', () => {
   new Domain(stack, 'Domain', { version: ElasticsearchVersion.V7_1 });
 
   Template.fromStack(stack).hasResourceProperties('AWS::Elasticsearch::Domain', {
@@ -187,7 +189,7 @@ test('minimal example renders correctly', () => {
   });
 });
 
-test('can enable version upgrade update policy', () => {
+testDeprecated('can enable version upgrade update policy', () => {
   new Domain(stack, 'Domain', {
     version: ElasticsearchVersion.V7_1,
     enableVersionUpgrade: true,
@@ -200,7 +202,7 @@ test('can enable version upgrade update policy', () => {
   });
 });
 
-test('can set a self-referencing custom policy', () => {
+testDeprecated('can set a self-referencing custom policy', () => {
   const domain = new Domain(stack, 'Domain', {
     version: ElasticsearchVersion.V7_1,
   });
@@ -263,7 +265,7 @@ test('can set a self-referencing custom policy', () => {
 
 describe('UltraWarm instances', () => {
 
-  test('can enable UltraWarm instances', () => {
+  testDeprecated('can enable UltraWarm instances', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       capacity: {
@@ -282,7 +284,7 @@ describe('UltraWarm instances', () => {
     });
   });
 
-  test('can enable UltraWarm instances with specific instance type', () => {
+  testDeprecated('can enable UltraWarm instances with specific instance type', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       capacity: {
@@ -304,7 +306,7 @@ describe('UltraWarm instances', () => {
 
 });
 
-test('can use tokens in capacity configuration', () => {
+testDeprecated('can use tokens in capacity configuration', () => {
   new Domain(stack, 'Domain', {
     version: ElasticsearchVersion.V7_10,
     capacity: {
@@ -345,7 +347,7 @@ test('can use tokens in capacity configuration', () => {
 
 describe('log groups', () => {
 
-  test('slowSearchLogEnabled should create a custom log group', () => {
+  testDeprecated('slowSearchLogEnabled should create a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -371,7 +373,7 @@ describe('log groups', () => {
     });
   });
 
-  test('slowIndexLogEnabled should create a custom log group', () => {
+  testDeprecated('slowIndexLogEnabled should create a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -397,7 +399,7 @@ describe('log groups', () => {
     });
   });
 
-  test('appLogEnabled should create a custom log group', () => {
+  testDeprecated('appLogEnabled should create a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -423,7 +425,7 @@ describe('log groups', () => {
     });
   });
 
-  test('auditLogEnabled should create a custom log group', () => {
+  testDeprecated('auditLogEnabled should create a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -457,7 +459,7 @@ describe('log groups', () => {
     });
   });
 
-  test('two domains with logging enabled can be created in same stack', () => {
+  testDeprecated('two domains with logging enabled can be created in same stack', () => {
     new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_7,
       logging: {
@@ -540,7 +542,7 @@ describe('log groups', () => {
     });
   });
 
-  test('log group policy is uniquely named for each domain', () => {
+  testDeprecated('log group policy is uniquely named for each domain', () => {
     new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -592,7 +594,7 @@ describe('log groups', () => {
     });
   });
 
-  test('enabling audit logs throws without fine grained access control enabled', () => {
+  testDeprecated('enabling audit logs throws without fine grained access control enabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V6_7,
       logging: {
@@ -601,7 +603,7 @@ describe('log groups', () => {
     })).toThrow(/Fine-grained access control is required when audit logs publishing is enabled\./);
   });
 
-  test('slowSearchLogGroup should use a custom log group', () => {
+  testDeprecated('slowSearchLogGroup should use a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -630,7 +632,7 @@ describe('log groups', () => {
     });
   });
 
-  test('slowIndexLogEnabled should use a custom log group', () => {
+  testDeprecated('slowIndexLogEnabled should use a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -659,7 +661,7 @@ describe('log groups', () => {
     });
   });
 
-  test('appLogGroup should use a custom log group', () => {
+  testDeprecated('appLogGroup should use a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       logging: {
@@ -688,7 +690,7 @@ describe('log groups', () => {
     });
   });
 
-  test('auditLOgGroup should use a custom log group', () => {
+  testDeprecated('auditLOgGroup should use a custom log group', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_4,
       fineGrainedAccessControl: {
@@ -729,19 +731,19 @@ describe('log groups', () => {
 
 describe('grants', () => {
 
-  test('"grantRead" allows read actions associated with this domain resource', () => {
+  testDeprecated('"grantRead" allows read actions associated with this domain resource', () => {
     testGrant(readActions, (p, d) => d.grantRead(p));
   });
 
-  test('"grantWrite" allows write actions associated with this domain resource', () => {
+  testDeprecated('"grantWrite" allows write actions associated with this domain resource', () => {
     testGrant(writeActions, (p, d) => d.grantWrite(p));
   });
 
-  test('"grantReadWrite" allows read and write actions associated with this domain resource', () => {
+  testDeprecated('"grantReadWrite" allows read and write actions associated with this domain resource', () => {
     testGrant(readWriteActions, (p, d) => d.grantReadWrite(p));
   });
 
-  test('"grantIndexRead" allows read actions associated with an index in this domain resource', () => {
+  testDeprecated('"grantIndexRead" allows read actions associated with an index in this domain resource', () => {
     testGrant(
       readActions,
       (p, d) => d.grantIndexRead('my-index', p),
@@ -750,7 +752,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grantIndexWrite" allows write actions associated with an index in this domain resource', () => {
+  testDeprecated('"grantIndexWrite" allows write actions associated with an index in this domain resource', () => {
     testGrant(
       writeActions,
       (p, d) => d.grantIndexWrite('my-index', p),
@@ -759,7 +761,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grantIndexReadWrite" allows read and write actions associated with an index in this domain resource', () => {
+  testDeprecated('"grantIndexReadWrite" allows read and write actions associated with an index in this domain resource', () => {
     testGrant(
       readWriteActions,
       (p, d) => d.grantIndexReadWrite('my-index', p),
@@ -768,7 +770,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grantPathRead" allows read actions associated with a given path in this domain resource', () => {
+  testDeprecated('"grantPathRead" allows read actions associated with a given path in this domain resource', () => {
     testGrant(
       readActions,
       (p, d) => d.grantPathRead('my-index/my-path', p),
@@ -777,7 +779,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grantPathWrite" allows write actions associated with a given path in this domain resource', () => {
+  testDeprecated('"grantPathWrite" allows write actions associated with a given path in this domain resource', () => {
     testGrant(
       writeActions,
       (p, d) => d.grantPathWrite('my-index/my-path', p),
@@ -786,7 +788,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grantPathReadWrite" allows read and write actions associated with a given path in this domain resource', () => {
+  testDeprecated('"grantPathReadWrite" allows read and write actions associated with a given path in this domain resource', () => {
     testGrant(
       readWriteActions,
       (p, d) => d.grantPathReadWrite('my-index/my-path', p),
@@ -795,7 +797,7 @@ describe('grants', () => {
     );
   });
 
-  test('"grant" for an imported domain', () => {
+  testDeprecated('"grant" for an imported domain', () => {
     const domainEndpoint = 'https://test-domain-2w2x2u3tifly-jcjotrt6f7otem4sqcwbch3c4u.testregion.es.amazonaws.com';
     const domain = Domain.fromDomainEndpoint(stack, 'Domain', domainEndpoint);
     const user = new iam.User(stack, 'user');
@@ -858,7 +860,7 @@ describe('grants', () => {
 
 describe('metrics', () => {
 
-  test('Can use metricClusterStatusRed on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricClusterStatusRed on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricClusterStatusRed(),
       'ClusterStatus.red',
@@ -866,7 +868,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricClusterStatusYellow on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricClusterStatusYellow on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricClusterStatusYellow(),
       'ClusterStatus.yellow',
@@ -874,7 +876,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricFreeStorageSpace on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricFreeStorageSpace on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricFreeStorageSpace(),
       'FreeStorageSpace',
@@ -882,7 +884,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricClusterIndexWriteBlocked on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricClusterIndexWriteBlocked on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricClusterIndexWritesBlocked(),
       'ClusterIndexWritesBlocked',
@@ -891,7 +893,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricNodes on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricNodes on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricNodes(),
       'Nodes',
@@ -900,7 +902,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricAutomatedSnapshotFailure on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricAutomatedSnapshotFailure on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricAutomatedSnapshotFailure(),
       'AutomatedSnapshotFailure',
@@ -908,7 +910,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricCPUUtilization on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricCPUUtilization on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricCPUUtilization(),
       'CPUUtilization',
@@ -916,7 +918,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricJVMMemoryPressure on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricJVMMemoryPressure on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricJVMMemoryPressure(),
       'JVMMemoryPressure',
@@ -924,7 +926,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricMasterCPUUtilization on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricMasterCPUUtilization on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricMasterCPUUtilization(),
       'MasterCPUUtilization',
@@ -932,7 +934,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricMasterJVMMemoryPressure on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricMasterJVMMemoryPressure on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricMasterJVMMemoryPressure(),
       'MasterJVMMemoryPressure',
@@ -940,7 +942,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricKMSKeyError on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricKMSKeyError on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricKMSKeyError(),
       'KMSKeyError',
@@ -948,7 +950,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricKMSKeyInaccessible on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricKMSKeyInaccessible on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricKMSKeyInaccessible(),
       'KMSKeyInaccessible',
@@ -956,7 +958,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricSearchableDocuments on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricSearchableDocuments on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricSearchableDocuments(),
       'SearchableDocuments',
@@ -964,7 +966,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricSearchLatency on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricSearchLatency on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricSearchLatency(),
       'SearchLatency',
@@ -972,7 +974,7 @@ describe('metrics', () => {
     );
   });
 
-  test('Can use metricIndexingLatency on an Elasticsearch Domain', () => {
+  testDeprecated('Can use metricIndexingLatency on an Elasticsearch Domain', () => {
     testMetric(
       (domain) => domain.metricIndexingLatency(),
       'IndexingLatency',
@@ -984,7 +986,7 @@ describe('metrics', () => {
 
 describe('import', () => {
 
-  test('static fromDomainEndpoint(endpoint) allows importing an external/existing domain', () => {
+  testDeprecated('static fromDomainEndpoint(endpoint) allows importing an external/existing domain', () => {
     const domainName = 'test-domain-2w2x2u3tifly';
     const domainEndpointWithoutHttps = `${domainName}-jcjotrt6f7otem4sqcwbch3c4u.testregion.es.amazonaws.com`;
     const domainEndpoint = `https://${domainEndpointWithoutHttps}`;
@@ -997,7 +999,7 @@ describe('import', () => {
     Template.fromStack(stack).resourceCountIs('AWS::Elasticsearch::Domain', 0);
   });
 
-  test('static fromDomainAttributes(attributes) allows importing an external/existing domain', () => {
+  testDeprecated('static fromDomainAttributes(attributes) allows importing an external/existing domain', () => {
     const domainName = 'test-domain-2w2x2u3tifly';
     const domainArn = `arn:aws:es:testregion:1234:domain/${domainName}`;
     const domainEndpointWithoutHttps = `${domainName}-jcjotrt6f7otem4sqcwbch3c4u.testregion.es.amazonaws.com`;
@@ -1014,7 +1016,7 @@ describe('import', () => {
     Template.fromStack(stack).resourceCountIs('AWS::Elasticsearch::Domain', 0);
   });
 
-  test('static fromDomainAttributes(attributes) allows importing with token arn and endpoint', () => {
+  testDeprecated('static fromDomainAttributes(attributes) allows importing with token arn and endpoint', () => {
     const domainArn = new CfnParameter(stack, 'domainArn', { type: 'String' }).valueAsString;
     const domainEndpoint = new CfnParameter(stack, 'domainEndpoint', { type: 'String' }).valueAsString;
     const imported = Domain.fromDomainAttributes(stack, 'Domain', {
@@ -1059,7 +1061,7 @@ describe('advanced security options', () => {
   const password = 'password';
   const masterUserPassword = SecretValue.plainText(password);
 
-  test('enable fine-grained access control with a master user ARN', () => {
+  testDeprecated('enable fine-grained access control with a master user ARN', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       fineGrainedAccessControl: {
@@ -1092,7 +1094,7 @@ describe('advanced security options', () => {
     });
   });
 
-  test('enable fine-grained access control with a master user name and password', () => {
+  testDeprecated('enable fine-grained access control with a master user name and password', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       fineGrainedAccessControl: {
@@ -1127,7 +1129,7 @@ describe('advanced security options', () => {
     });
   });
 
-  test('enable fine-grained access control with a master user name and dynamically generated password', () => {
+  testDeprecated('enable fine-grained access control with a master user name and dynamically generated password', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       fineGrainedAccessControl: {
@@ -1178,7 +1180,7 @@ describe('advanced security options', () => {
     });
   });
 
-  test('enabling fine-grained access control throws with Elasticsearch < 6.7', () => {
+  testDeprecated('enabling fine-grained access control throws with Elasticsearch < 6.7', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V6_5,
       fineGrainedAccessControl: {
@@ -1192,7 +1194,7 @@ describe('advanced security options', () => {
     })).toThrow(/Fine-grained access control requires Elasticsearch version 6\.7 or later/);
   });
 
-  test('enabling fine-grained access control throws without node-to-node encryption enabled', () => {
+  testDeprecated('enabling fine-grained access control throws without node-to-node encryption enabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       fineGrainedAccessControl: {
@@ -1206,7 +1208,7 @@ describe('advanced security options', () => {
     })).toThrow(/Node-to-node encryption is required when fine-grained access control is enabled/);
   });
 
-  test('enabling fine-grained access control throws without encryption-at-rest enabled', () => {
+  testDeprecated('enabling fine-grained access control throws without encryption-at-rest enabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       fineGrainedAccessControl: {
@@ -1220,7 +1222,7 @@ describe('advanced security options', () => {
     })).toThrow(/Encryption-at-rest is required when fine-grained access control is enabled/);
   });
 
-  test('enabling fine-grained access control throws without enforceHttps enabled', () => {
+  testDeprecated('enabling fine-grained access control throws without enforceHttps enabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       fineGrainedAccessControl: {
@@ -1238,7 +1240,7 @@ describe('advanced security options', () => {
 describe('custom endpoints', () => {
   const customDomainName = 'search.example.com';
 
-  test('custom domain without hosted zone and default cert', () => {
+  testDeprecated('custom domain without hosted zone and default cert', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       nodeToNodeEncryption: true,
@@ -1264,7 +1266,7 @@ describe('custom endpoints', () => {
     });
   });
 
-  test('custom domain with hosted zone and default cert', () => {
+  testDeprecated('custom domain with hosted zone and default cert', () => {
     const zone = new route53.HostedZone(stack, 'DummyZone', { zoneName: 'example.com' });
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
@@ -1315,7 +1317,7 @@ describe('custom endpoints', () => {
     });
   });
 
-  test('custom domain with hosted zone and given cert', () => {
+  testDeprecated('custom domain with hosted zone and given cert', () => {
     const zone = new route53.HostedZone(stack, 'DummyZone', {
       zoneName: 'example.com',
     });
@@ -1365,7 +1367,7 @@ describe('custom endpoints', () => {
 
 describe('custom error responses', () => {
 
-  test('error when availabilityZoneCount does not match vpcOptions.subnets length', () => {
+  testDeprecated('error when availabilityZoneCount does not match vpcOptions.subnets length', () => {
     const vpc = new Vpc(stack, 'Vpc', {
       maxAzs: 1,
     });
@@ -1380,7 +1382,7 @@ describe('custom error responses', () => {
     })).toThrow(/you need to provide a subnet for each AZ you are using/);
   });
 
-  test('error when master, data or Ultra Warm instance types do not end with .elasticsearch', () => {
+  testDeprecated('error when master, data or Ultra Warm instance types do not end with .elasticsearch', () => {
     const error = /instance types must end with ".elasticsearch"/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
@@ -1402,7 +1404,7 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when Ultra Warm instance types do not start with ultrawarm', () => {
+  testDeprecated('error when Ultra Warm instance types do not start with ultrawarm', () => {
     const error = /UltraWarm node instance type must start with "ultrawarm"./;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
@@ -1412,13 +1414,13 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when elasticsearchVersion is unsupported/unknown', () => {
+  testDeprecated('error when elasticsearchVersion is unsupported/unknown', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.of('5.4'),
     })).toThrow(/Unknown Elasticsearch version: 5\.4/);
   });
 
-  test('error when invalid domain name is given', () => {
+  testDeprecated('error when invalid domain name is given', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       domainName: 'InvalidName',
@@ -1433,7 +1435,7 @@ describe('custom error responses', () => {
     })).toThrow(/It must start with a lowercase letter/);
   });
 
-  test('error when error log publishing is enabled for elasticsearch version < 5.1', () => {
+  testDeprecated('error when error log publishing is enabled for elasticsearch version < 5.1', () => {
     const error = /Error logs publishing requires Elasticsearch version 5.1 or later/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V2_3,
@@ -1443,7 +1445,7 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when encryption at rest is enabled for elasticsearch version < 5.1', () => {
+  testDeprecated('error when encryption at rest is enabled for elasticsearch version < 5.1', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V2_3,
       encryptionAtRest: {
@@ -1452,7 +1454,7 @@ describe('custom error responses', () => {
     })).toThrow(/Encryption of data at rest requires Elasticsearch version 5.1 or later/);
   });
 
-  test('error when cognito for kibana is enabled for elasticsearch version < 5.1', () => {
+  testDeprecated('error when cognito for kibana is enabled for elasticsearch version < 5.1', () => {
     const user = new iam.User(stack, 'user');
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V2_3,
@@ -1464,7 +1466,7 @@ describe('custom error responses', () => {
     })).toThrow(/Cognito authentication for Kibana requires Elasticsearch version 5.1 or later/);
   });
 
-  test('error when C5, I3, M5, or R5 instance types are specified for elasticsearch version < 5.1', () => {
+  testDeprecated('error when C5, I3, M5, or R5 instance types are specified for elasticsearch version < 5.1', () => {
     const error = /C5, I3, M5, and R5 instance types require Elasticsearch version 5.1 or later/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V2_3,
@@ -1492,14 +1494,14 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when node to node encryption is enabled for elasticsearch version < 6.0', () => {
+  testDeprecated('error when node to node encryption is enabled for elasticsearch version < 6.0', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V5_6,
       nodeToNodeEncryption: true,
     })).toThrow(/Node-to-node encryption requires Elasticsearch version 6.0 or later/);
   });
 
-  test('error when i3 or r6g instance types are specified with EBS enabled', () => {
+  testDeprecated('error when i3 or r6g instance types are specified with EBS enabled', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       capacity: {
@@ -1522,7 +1524,7 @@ describe('custom error responses', () => {
     })).toThrow(/I3 and R6GD instance types do not support EBS storage volumes/);
   });
 
-  test('error when m3, r3, or t2 instance types are specified with encryption at rest enabled', () => {
+  testDeprecated('error when m3, r3, or t2 instance types are specified with encryption at rest enabled', () => {
     const error = /M3, R3, and T2 instance types do not support encryption of data at rest/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
@@ -1553,7 +1555,7 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when t2.micro is specified with elasticsearch version > 2.3', () => {
+  testDeprecated('error when t2.micro is specified with elasticsearch version > 2.3', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V6_7,
       capacity: {
@@ -1562,7 +1564,7 @@ describe('custom error responses', () => {
     })).toThrow(/t2.micro.elasticsearch instance type supports only Elasticsearch 1.5 and 2.3/);
   });
 
-  test('error when any instance type other than R3, I3 and R6GD are specified without EBS enabled', () => {
+  testDeprecated('error when any instance type other than R3, I3 and R6GD are specified without EBS enabled', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       ebs: {
@@ -1583,7 +1585,7 @@ describe('custom error responses', () => {
     })).toThrow(/EBS volumes are required when using instance types other than r3, i3 or r6gd/);
   });
 
-  test('can use compatible master instance types that does not have local storage when data node type is i3 or r6gd', () => {
+  testDeprecated('can use compatible master instance types that does not have local storage when data node type is i3 or r6gd', () => {
     new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       ebs: {
@@ -1609,7 +1611,7 @@ describe('custom error responses', () => {
     Template.fromStack(stack).resourceCountIs('AWS::Elasticsearch::Domain', 2);
   });
 
-  test('error when availabilityZoneCount is not 2 or 3', () => {
+  testDeprecated('error when availabilityZoneCount is not 2 or 3', () => {
     const vpc = new Vpc(stack, 'Vpc');
 
     expect(() => new Domain(stack, 'Domain1', {
@@ -1621,7 +1623,7 @@ describe('custom error responses', () => {
     })).toThrow(/Invalid zone awareness configuration; availabilityZoneCount must be 2 or 3/);
   });
 
-  test('error when UltraWarm instance is used and not supported by elasticsearchVersion', () => {
+  testDeprecated('error when UltraWarm instance is used and not supported by elasticsearchVersion', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V6_7,
       capacity: {
@@ -1631,7 +1633,7 @@ describe('custom error responses', () => {
     })).toThrow(/UltraWarm requires Elasticsearch 6\.8 or later/);
   });
 
-  test('error when t2 or t3 instance types are specified with UltramWarm enabled', () => {
+  testDeprecated('error when t2 or t3 instance types are specified with UltramWarm enabled', () => {
     const error = /T2 and T3 instance types do not support UltraWarm storage/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
@@ -1649,7 +1651,7 @@ describe('custom error responses', () => {
     })).toThrow(error);
   });
 
-  test('error when UltraWarm instance is used and no dedicated master instance specified', () => {
+  testDeprecated('error when UltraWarm instance is used and no dedicated master instance specified', () => {
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
       capacity: {
@@ -1661,7 +1663,7 @@ describe('custom error responses', () => {
 
 });
 
-test('can specify future version', () => {
+testDeprecated('can specify future version', () => {
   new Domain(stack, 'Domain', { version: ElasticsearchVersion.of('8.2') });
 
   Template.fromStack(stack).hasResourceProperties('AWS::Elasticsearch::Domain', {
@@ -1670,7 +1672,7 @@ test('can specify future version', () => {
 });
 
 describe('unsigned basic auth', () => {
-  test('can create a domain with unsigned basic auth', () => {
+  testDeprecated('can create a domain with unsigned basic auth', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       useUnsignedBasicAuth: true,
@@ -1696,7 +1698,7 @@ describe('unsigned basic auth', () => {
     });
   });
 
-  test('does not overwrite master user ARN configuration', () => {
+  testDeprecated('does not overwrite master user ARN configuration', () => {
     const masterUserArn = 'arn:aws:iam::123456789012:user/JohnDoe';
 
     new Domain(stack, 'Domain', {
@@ -1727,7 +1729,7 @@ describe('unsigned basic auth', () => {
     });
   });
 
-  test('does not overwrite master user name and password', () => {
+  testDeprecated('does not overwrite master user name and password', () => {
     const masterUserName = 'JohnDoe';
     const password = 'password';
     const masterUserPassword = SecretValue.plainText(password);
@@ -1762,7 +1764,7 @@ describe('unsigned basic auth', () => {
     });
   });
 
-  test('fails to create a domain with unsigned basic auth when enforce HTTPS is disabled', () => {
+  testDeprecated('fails to create a domain with unsigned basic auth when enforce HTTPS is disabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       useUnsignedBasicAuth: true,
@@ -1770,7 +1772,7 @@ describe('unsigned basic auth', () => {
     })).toThrow(/You cannot disable HTTPS and use unsigned basic auth/);
   });
 
-  test('fails to create a domain with unsigned basic auth when node to node encryption is disabled', () => {
+  testDeprecated('fails to create a domain with unsigned basic auth when node to node encryption is disabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       useUnsignedBasicAuth: true,
@@ -1778,7 +1780,7 @@ describe('unsigned basic auth', () => {
     })).toThrow(/You cannot disable node to node encryption and use unsigned basic auth/);
   });
 
-  test('fails to create a domain with unsigned basic auth when encryption at rest is disabled', () => {
+  testDeprecated('fails to create a domain with unsigned basic auth when encryption at rest is disabled', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_7,
       useUnsignedBasicAuth: true,
@@ -1786,7 +1788,7 @@ describe('unsigned basic auth', () => {
     })).toThrow(/You cannot disable encryption at rest and use unsigned basic auth/);
   });
 
-  test('using unsigned basic auth throws with Elasticsearch < 6.7', () => {
+  testDeprecated('using unsigned basic auth throws with Elasticsearch < 6.7', () => {
     expect(() => new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V6_5,
       useUnsignedBasicAuth: true,
@@ -1795,7 +1797,7 @@ describe('unsigned basic auth', () => {
 });
 
 describe('advanced options', () => {
-  test('use advanced options', () => {
+  testDeprecated('use advanced options', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
       advancedOptions: {
@@ -1812,7 +1814,7 @@ describe('advanced options', () => {
     });
   });
 
-  test('advanced options absent by default', () => {
+  testDeprecated('advanced options absent by default', () => {
     new Domain(stack, 'Domain', {
       version: ElasticsearchVersion.V7_1,
     });
diff --git a/tools/@aws-cdk/pkglint/lib/rules.ts b/tools/@aws-cdk/pkglint/lib/rules.ts
index bb76c64b3205b..5d3de31aa7988 100644
--- a/tools/@aws-cdk/pkglint/lib/rules.ts
+++ b/tools/@aws-cdk/pkglint/lib/rules.ts
@@ -454,6 +454,12 @@ export class MaturitySetting extends ValidationRule {
   }
 
   private validateReadmeHasBanner(pkg: PackageJson, maturity: string, levelsPresent: string[]) {
+    if (pkg.packageName === '@aws-cdk/aws-elasticsearch') {
+      // Special case for elasticsearch, which is labeled as stable in package.json
+      // but all APIs are now marked 'deprecated'
+      return;
+    }
+
     const badge = this.readmeBadge(maturity, levelsPresent);
     if (!badge) {
       // Somehow, we don't have a badge for this stability level