- Elastic Cloud Enterprise - Elastic Cloud on your Infrastructure: other versions:
- What is Elastic Cloud Enterprise?
- Getting started
- Planning your installation
- Preparing your environment
- Installing Elastic Cloud Enterprise
- Configuring your installation
- Securing your installation
- Monitoring your installation
- Administering your installation
- Getting started with deployments
- Administering deployments
- Change your deployment configuration
- Stop routing requests or pause nodes
- Stop a deployment
- Restart a deployment
- Delete a deployment
- Work with snapshots
- Upgrade versions
- Editing your user settings
- Configure Beats and Logstash with Cloud ID
- Keep your clusters healthy
- Secure your clusters
- Manage your Kibana instance
- Manage your APM Server
- Enable Monitoring (formerly Marvel)
- Enable Graph (versions before 5.0)
- Connect to your cluster
- Enable cross cluster search
- Troubleshooting
- RESTful API
- Using the API
- API examples
- A first API call: What deployments are there?
- Create a first deployment: Just an Elasticsearch cluster
- Applying a new plan: Resize and add high availability
- Applying a new plan: Checking on progress
- Applying a new deployment configuration: Upgrade
- Enable more stack features: Add Kibana to a deployment
- Dipping a toe into platform automation: Generate a roles token
- Customize your deployment
- Remove unwanted deployment templates and instance configurations
- API reference
- Authentication
- Clusters - Apm - CRUD
- Clusters - Apm - CRUD - Configuration
- Clusters - Apm - Commands
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Upgrade cluster
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Clusters - Elasticsearch - CRUD
- Clusters - Elasticsearch - CRUD - Configuration
- Get cross-cluster search clusters
- Get remote clusters for cross-cluster search
- Set remote clusters for cross-cluster search
- Get cluster curation settings
- Update cluster curation settings
- Set settings overrides (all instances)
- Set settings overrides
- Get settings from this cluster’s keystore
- Add or remove settings
- Set cluster name
- Get cluster metadata
- Set cluster metadata
- Get cluster metadata settings
- Update cluster metadata settings
- Cancel monitoring
- Set monitoring
- Get plan
- Update plan
- Migrate plan
- Get plan activity
- Cancel pending plan
- Get pending plan
- Set legacy security settings
- Get cluster snapshot settings
- Update cluster snapshot settings
- Clusters - Elasticsearch - Commands
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Take snapshot
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Clusters - Elasticsearch - Proxy
- Clusters - Elasticsearch - Support
- Clusters - Kibana - CRUD
- Clusters - Kibana - CRUD - Configuration
- Clusters - Kibana - Commands
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Upgrade cluster
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Deployments - IP Filtering - CRUD
- Deployments - Notes
- Platform
- Platform - Allocators
- Get allocators
- Search allocators
- Delete allocator
- Get allocator
- Resynchronize allocator
- Move clusters
- Move clusters by type
- Start maintenance mode
- Stop maintenance mode
- Get allocator metadata
- Set allocator metadata
- Delete allocator metadata item
- Set allocator metadata item
- Get allocator settings
- Update allocator settings
- Set allocator settings
- Platform - Configuration - Instances - CRUD
- Platform - Configuration - Security
- Platform - Configuration - TLS
- Platform - Constructors
- Platform - License
- Platform - Repository - CRUD
- Platform - Runners
- Platform - proxies
- Stack - Instance Types - CRUD
- Stack - Versions - CRUD
- Templates - Deployments
- Users
- Definitions
AllocatedInstanceStatus
AllocatorCapacity
AllocatorCapacityMemory
AllocatorHealthStatus
AllocatorInfo
AllocatorMoveRequest
AllocatorOverview
AllocatorSettings
AllocatorZoneInfo
ApmConfiguration
ApmCrudResponse
ApmInfo
ApmPlan
ApmPlanControlConfiguration
ApmPlanInfo
ApmPlansInfo
ApmSubInfo
ApmSystemSettings
ApmTopologyElement
ApmsInfo
AvailableAuthenticationMethods
BasicFailedReply
BasicFailedReplyElement
BoolQuery
CapacityConstraintsResource
ChangeSourceInfo
ClusterCommandResponse
ClusterCredentials
ClusterCrudResponse
ClusterCurationSettings
ClusterCurationSpec
ClusterInstanceConfigurationInfo
ClusterInstanceDiskInfo
ClusterInstanceInfo
ClusterInstanceMemoryInfo
ClusterLicenseInfo
ClusterMetadataCpuResourcesSettings
ClusterMetadataInfo
ClusterMetadataPortInfo
ClusterMetadataResourcesSettings
ClusterMetadataSettings
ClusterPlanStepInfo
ClusterPlanStepLogMessageInfo
ClusterSnapshotRepositoryDefault
ClusterSnapshotRepositoryInfo
ClusterSnapshotRepositoryReference
ClusterSnapshotRepositoryStatic
ClusterSnapshotRequest
ClusterSnapshotResponse
ClusterSnapshotRetention
ClusterSnapshotSettings
ClusterSystemAlert
ClusterTopologyInfo
ClusterUpgradeInfo
CompatibleNodeTypesResource
CompatibleVersionResource
ConstructorHealthStatus
ConstructorInfo
ConstructorOverview
CreateApmInCreateElasticsearchRequest
CreateApmRequest
CreateElasticsearchClusterRequest
CreateKibanaInCreateElasticsearchRequest
CreateKibanaRequest
CrossClusterSearchClusters
CrossClusterSearchSettings
DeploymentTemplateInfo
DeploymentTemplateReference
DiscreteSizes
ElasticsearchClusterBlockingIssueElement
ElasticsearchClusterBlockingIssues
ElasticsearchClusterInfo
ElasticsearchClusterInstanceSettingsOverrides
ElasticsearchClusterPlan
ElasticsearchClusterPlanInfo
ElasticsearchClusterPlansInfo
ElasticsearchClusterRole
ElasticsearchClusterSecurityInfo
ElasticsearchClusterSettings
ElasticsearchClusterTopologyElement
ElasticsearchClusterUser
ElasticsearchClustersInfo
ElasticsearchConfiguration
ElasticsearchCuration
ElasticsearchInfo
ElasticsearchMasterElement
ElasticsearchMasterInfo
ElasticsearchMonitoringInfo
ElasticsearchNodeType
ElasticsearchPlanControlConfiguration
ElasticsearchReplicaElement
ElasticsearchScriptTypeSettings
ElasticsearchScriptingUserSettings
ElasticsearchShardElement
ElasticsearchShardsInfo
ElasticsearchSystemSettings
ElasticsearchUserBundle
ElasticsearchUserPlugin
ElevatePermissionsRequest
ElevatedPermissions
EmptyResponse
EnrollmentTokenRequest
ExistsQuery
ExternalHyperlink
FilterAssociation
GrowShrinkStrategyConfig
Hyperlink
IdResponse
InstanceConfiguration
InstanceMoveRequest
InstanceTypeResource
IpFilterRule
IpFilterRuleset
IpFilterRulesets
IpFilteringSettings
KeystoreContents
KeystoreSecret
KibanaClusterInfo
KibanaClusterPlan
KibanaClusterPlanInfo
KibanaClusterPlansInfo
KibanaClusterTopologyElement
KibanaClustersInfo
KibanaConfiguration
KibanaPlanControlConfiguration
KibanaSubClusterInfo
KibanaSystemSettings
LegacySecuritySettings
LicenseInfo
LicenseObject
ListEnrollmentTokenElement
ListEnrollmentTokenReply
LoginRequest
LoginState
ManagedMonitoringSettings
MatchAllQuery
MatchQuery
MetadataItem
MetadataItemValue
MetadataItems
MoveApmClusterConfiguration
MoveApmClusterDetails
MoveClustersCommandResponse
MoveClustersDetails
MoveClustersRequest
MoveElasticsearchClusterConfiguration
MoveElasticsearchClusterDetails
MoveKibanaClusterConfiguration
MoveKibanaClusterDetails
NestedQuery
NodeTypeResource
Note
Notes
PlanStrategy
PlatformInfo
PlatformServiceImageInfo
PlatformServiceInfo
PrefixQuery
ProxiesHttpSettings
ProxiesSSOSettings
ProxiesSettings
ProxyInfo
ProxyOverview
QueryContainer
QueryStringQuery
RangeQuery
RemoteClusterRef
RepositoryConfig
RepositoryConfigs
RequestEnrollmentTokenReply
RestoreSnapshotApiConfiguration
RestoreSnapshotConfiguration
RestoreSnapshotRepoConfiguration
RollingGrowShrinkStrategyConfig
RollingStrategyConfig
RuleSetResponse
RulesetAssociations
RunnerContainerInfo
RunnerInfo
RunnerOverview
RunnerRoleInfo
RunnerRolesInfo
SearchRequest
SnapshotRepositoryConfiguration
SnapshotStatusInfo
StackVersionApmConfig
StackVersionArchiveProcessingError
StackVersionArchiveProcessingResult
StackVersionConfig
StackVersionConfigPost
StackVersionConfigs
StackVersionElasticsearchConfig
StackVersionInstanceCapacityConstraint
StackVersionKibanaConfig
StackVersionMetadata
StackVersionNodeType
StackVersionTemplateFileHash
StackVersionTemplateInfo
TargetElasticsearchCluster
TermQuery
TiebreakerTopologyElement
TlsPublicCertChain
TokenResponse
TopologySize
TransientApmPlanConfiguration
TransientElasticsearchPlanConfiguration
TransientKibanaPlanConfiguration
User
UserSecurity
- Script reference
- Release notes
- Elastic Cloud Enterprise 2.1.1
- Elastic Cloud Enterprise 2.1.0
- Elastic Cloud Enterprise 2.0.1
- Elastic Cloud Enterprise 2.0.0
- Elastic Cloud Enterprise 1.1.5
- Elastic Cloud Enterprise 1.1.4
- Elastic Cloud Enterprise 1.1.3
- Elastic Cloud Enterprise 1.1.2
- Elastic Cloud Enterprise 1.1.1
- Elastic Cloud Enterprise 1.1.0
- Elastic Cloud Enterprise 1.0.2
- Elastic Cloud Enterprise 1.0.1
- Elastic Cloud Enterprise 1.0.0
- Limitations and known problems
- About this product
It is time to say goodbye: This version of Elastic Cloud Enterprise has reached end-of-life (EOL) and is no longer supported.
The documentation for this version is no longer being maintained. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Manage users and roles in Shield
editManage users and roles in Shield
editFor versions before 5.0: You configure users, their roles, and the roles themselves in the Cloud UI Shield user editor, accessible on the Security page for each deployment.

Users
editDefines the users in your cluster. A user entry consists of a username and a password hash.
To add a new user:
-
In the editor, add a new line with the username and a clear text password in the format
username: password
. Keep the password in a secure location.A valid role or user name must be at least 1 character and no longer than 30 characters. It must begin with a letter (
a-z
) or an underscore (_
). Subsequent characters can be letters, underscores (_
), digits (0-9
) or any of the following symbols@
,-
,.
or$
. - Click Save to hash the password and save the updated Shield configuration.
If you do lose a password, you can enter a new password for the user and resave the Shield configuration. The same applies to passwords that you need to reset: Enter a new password and save the configuration.
If you already use Shield with a cluster running on your own servers, you can simply copy the config/shield/users
file and paste it in this editor. For example:
# Lines starting with # are comments. # This file expects usernames to map passwords or hashes, like the following: elastic: $2a$12$uRopB3Jz3slQQVMUTlNuPeHRhbfbFWDBrXhRk8vzK7xr0mavw2vAq # This password has not been hashed yet, but will be when you save. my_user: bc3rqc0q1xwr4irq3o
To delete a user:
- Remove the user from the editor.
- Click Save to save the updated Shield configuration.
Users per Role
editMaps roles to users. A user can have several roles, and a role can have several users.
To modify the mapping of roles to users:
-
Either add a user name to an existing role or add a new role and specify which users hold that role. The format is
role-name: user1, user2, ...
. Each role is specified on a separate line. - Click Save to save the updated Shield configuration.
For example:
# The users per role file maps roles and users like this: # role_name: user1, user2 admin: elastic readonly: my_user, anonymous
Roles
editCustomize which actions users with the role can perform, both on a cluster and an index level.
To learn more, see configuring role-based access control is available in the Shield documentation.
You can use the default roles or adapt them. Here are two examples of roles with comments that indicate what permissions these roles grant:
# Admins can do everything admin: # If you use a generic group of actions, such as "all", "read", "monitor", etc. # you can simply specify the group without listing every action. cluster: all indices: # The same is true for indices. You can also list aliases here. # Note that the index name '*' is quoted. This is because this is actually # a YAML file, and the * character can have a special meaning. It is a good # practice to quote all the index names. '*': all # This is an example of a role with more granular access. We explicitly list # every action possible, both on the cluster and the indicies. # A user with this role will be able to use Kibana 4 and read the indices # logs-* and even-more-logs-*. Dashboards/Visualizations can be modified # but the indices being analyzed can only be read. kibana4: cluster: - cluster:monitor/nodes/info - cluster:monitor/health # Note that we use a list here. Every action is indented and # starts with `- `. indices: # 'logs-*,even-more-logs-*': - indices:admin/mappings/fields/get - indices:admin/validate/query - indices:data/read/search - indices:data/read/msearch - indices:admin/get '.kibana': - indices:admin/exists - indices:admin/mapping/put - indices:admin/mappings/fields/get - indices:admin/refresh - indices:admin/validate/query - indices:data/read/get - indices:data/read/mget - indices:data/read/search - indices:data/write/delete - indices:data/write/index - indices:data/write/update - indices:admin/create
On this page