IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Reset the password for the elastic user Secure your 7.x clusters with LDAP »
Elastic Docs ›Elastic Cloud Enterprise Reference [2.13] ›Administering deployments ›Secure your clusters

Secure your settings

edit

Secure your settings

edit

Some of the settings that you configure in Elastic Cloud Enterprise are sensitive, such as passwords, and relying on file system permissions to protect these settings is insufficient. To protect your sensitive settings, use the Elasticsearch keystore. With the Elasticsearch keystore, you can add a key and its secret value, then use the key in place of the secret value when you configure your sensitive settings.

There are three types of secrets that you can use:

  • Single string - Associate a secret value to a setting.
  • Multiple strings - Associate multiple keys to multiple secret values.
  • JSON block/file - Associate multiple keys to multiple secret values in JSON format.

Add secret values

edit

Add keys and secret values to the keystore.

  1. Log into the Cloud UI.

  2. On the deployments page, select your deployment.

    Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.

  3. From your deployment menu, select Security.
  4. Locate Elasticsearch keystore and select Add settings.
  5. On the Create setting window, select the secret Type.
  6. Configure the settings, then click Save.
  7. All the modifications to the non-reloadable keystore take effect only after restarting Elasticsearch. Reloadable keystore changes take effect after issuing a reload_secure_settings call.

Only some settings are designed to be read from the keystore. However, the keystore has no validation to block unsupported settings. Adding unsupported settings to the keystore causes Elasticsearch to fail to start. To see whether a setting is supported in the keystore, look for a "Secure" qualifier in the setting reference.

Delete secret values

edit

When your keys and secret values are no longer needed, delete them from the keystore.

  1. Log into the Cloud UI.

  2. On the deployments page, select your deployment.

    Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.

  3. From your deployment menu, select Security.
  4. From the Existing keystores list, click the delete icon next to the Setting Name that you want to delete.
  5. On the Confirm to delete window, click Confirm.
  6. All modifications to the non-reloadable keystore take effect only after restarting Elasticsearch. Reloadable keystore changes take effect after issuing a reload_secure_settings call.
« Reset the password for the elastic user Secure your 7.x clusters with LDAP »