diff --git a/deploy-manage/security.md b/deploy-manage/security.md index b085b550c1..91277a6022 100644 --- a/deploy-manage/security.md +++ b/deploy-manage/security.md @@ -1,4 +1,7 @@ --- +applies_to: + deployment: all + serverless: ga mapped_urls: - https://www.elastic.co/guide/en/elasticsearch/reference/current/security-files.html - https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html @@ -12,8 +15,6 @@ mapped_urls: - https://www.elastic.co/guide/en/cloud/current/ec-faq-technical.html --- -# Security - % SR: include this info somewhere in this section % {{ech}} doesn't support custom SSL certificates, which means that a custom CNAME for an {{ech}} endpoint such as *mycluster.mycompanyname.com* also is not supported. % @@ -22,7 +23,7 @@ mapped_urls: % encryption at rest (EAR) is enabled in {{ech}} by default. We support EAR for both the data stored in your clusters and the snapshots we take for backup, on all cloud platforms and across all regions. % You can also bring your own key (BYOK) to encrypt your Elastic Cloud deployment data and snapshots. For more information, check [Encrypt your deployment with a customer-managed encryption key](../../../deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md). -Note that the encryption happens at the file system level. +% Note that the encryption happens at the file system level. % What needs to be done: Refine @@ -54,15 +55,123 @@ $$$preserving-data-integrity$$$ $$$maintaining-audit-trail$$$ -**This page is a work in progress.** The documentation team is working to combine content pulled from the following pages: - -* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md) -* [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md) -* [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md) -* [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md) -* [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md) -* [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md) -* [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md) -* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md) -* [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md) -* [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md) \ No newline at end of file +:::{warning} +**This page is a work in progress.** +::: + + +% The documentation team is working to combine content pulled from the following pages: + +% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md) +% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md) +% * [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md) +% * [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md) +% * [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md) +% * [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md) +% * [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md) +% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md) +% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md) +% * [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md) + +# Security + +This section covers how to secure your Elastic environment. Learn how to implement TLS encryption, network security controls, and data protection measures. + +## Security overview + +An Elastic implementation comprises many moving parts: {es} nodes forming the cluster, {kib} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment. + +To keep your data secured, Elastic offers comprehensive security features that: +- Prevent unauthorized access to your deployment +- Encrypt communications between components +- Protect data at rest +- Secure sensitive settings and saved objects + +Security requirements and capabilities vary by deployment. Features may be managed automatically by Elastic, require configuration, or must be fully self-managed. Refer to [Security by deployment type](#security-by-deployment-type) for details. + +::::{tip} +See the [Deployment overview](/deploy-manage/deploy.md) to understand your options for deploying Elastic. +:::: + +### Security by deployment type + +Security features have one of these statuses across deployment types: + +| Status | Description | +|--------|-------------| +| **Managed** | Handled automatically by Elastic with no user configuration needed | +| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) | +| **Self-managed** | Infrastructure-level security you implement and maintain | +| **N/A** | Not available for this deployment type | + +#### Communication security + +| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed | +|------------------|------------|--------------|-----|-----|--------------| +| **TLS (HTTP Layer)** | Managed | Managed | Configurable | Configurable | Self-managed | +| **TLS (Transport Layer)** | Managed | Managed | Managed | Managed | Self-managed | + +#### Network security + +| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed | +|------------------|------------|--------------|-----|-----|--------------| +| **IP traffic filtering** | Configurable | Configurable | Configurable | Configurable | Configurable | +| **Private link** | N/A | Configurable | N/A | N/A | N/A | +| **Static IPs** | Configurable | Configurable | N/A | N/A | N/A | + +#### Data security + +| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed | +|------------------|------------|--------------|-----|-----|--------------| +| **Encryption at rest** | Managed | Managed | Self-managed | Self-managed | Self-managed | +| **Bring your own encryption key** | N/A | Configurable | N/A | N/A | N/A | +| **Keystore security** | Managed | Managed | Configurable | Configurable | Configurable | +| **Saved object encryption** | Managed | Managed | Configurable | Configurable | Configurable | + +#### User session security + +| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed | +|------------------|------------|--------------|-----|-----|--------------| +| **Kibana Sessions** | Managed | Configurable | Configurable | Configurable | Configurable | + +### Using this documentation + +Throughout this security documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Each section clearly identifies which deployment types it applies to, and deployment-specific details are separated within each topic. + +To get the most relevant information for your environment, focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model. + +## Security topics + +This security documentation is organized into four main areas: + +% TODO: Add links to the sections below + +### 1. Secure your hosting environment + +The security of your hosting environment forms the foundation of your overall security posture. This section covers environment-specific security controls: + +- **Elastic Cloud Hosted and Serverless**: Organization-level SSO, role-based access control, and cloud API keys +- **Elastic Cloud Enterprise**: TLS certificates, role-based access control, and cloud API keys +- **Self-managed environments**: TLS certificates, HTTPS configuration + +### 2. Secure your deployments and clusters + +Protect your deployments with features available across all deployment types: + +- **Authentication and access controls**: User management, API keys, authentication protocols, and traffic filtering +- **Data protection**: Encryption, sensitive settings, and document-level security +- **Monitoring and compliance**: Audit logging and security best practices + +### 3. Secure your user accounts + +Individual user security helps prevent unauthorized access: + +- **Multi-factor authentication**: Add an extra layer of security to your login process + +### 4. Secure your clients and integrations + +Ensure secure communication between your applications and Elastic: + +- **Client security**: Best practices for securely connecting applications to {es} +- **Integration security**: Secure configuration for Beats, Logstash, and other integrations +