Skip to content

Commit c8f31cf

Browse files
Merge branch 'main' into dm-security-cleanup
2 parents e68968d + d8f9b6c commit c8f31cf

File tree

5 files changed

+151
-27
lines changed

5 files changed

+151
-27
lines changed

deploy-manage/deploy/cloud-on-k8s/troubleshooting-beats.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ When `kubectl` is used to modify a resource, it calculates the diff between the
2525

2626
If you have configured a Beat to run as a `Deployment` and you are using a `hostPath` volume as the Beats data directory, you might encounter an error similar to the following:
2727

28-
```shell script
28+
```shell
2929
ERROR instance/beat.go:958 Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
3030
```
3131

deploy-manage/deploy/elastic-cloud/regions.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ A region is the geographic area where the data center of the cloud provider that
1212
Elastic Cloud Serverless handles all hosting details for you. You are unable to change the region after you create a project.
1313

1414
::::{note}
15-
Currently, a limited number of Amazon Web Services (AWS) and Microsoft Azure regions are available. More regions for AWS and Azure, as well as Google Cloud Platform (GCP), will be added in the future.
15+
Currently, a limited number of Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) regions are available. More regions for AWS, Azure, and GCP, will be added in the future.
1616

1717
::::
1818

@@ -39,4 +39,16 @@ The following Azure regions are currently available:
3939
4040
| Region | Name |
4141
| :--- | :--- |
42-
| eastus | East US |
42+
| eastus | East US |
43+
44+
## Google Cloud Platform (GCP) regions [regions-gcp-regions]
45+
46+
```yaml {applies_to}
47+
serverless: preview
48+
```
49+
50+
The following GCP regions are currently available:
51+
52+
| Region | Name |
53+
| :--- | :--- |
54+
| us-central1 | Iowa |

deploy-manage/security.md

Lines changed: 121 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
applies_to:
33
deployment: all
4-
serverless: all
4+
serverless: ga
55
mapped_urls:
66
- https://www.elastic.co/guide/en/elasticsearch/reference/current/security-files.html
77
- https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html
@@ -15,8 +15,6 @@ mapped_urls:
1515
- https://www.elastic.co/guide/en/cloud/current/ec-faq-technical.html
1616
---
1717

18-
# Security
19-
2018
% SR: include this info somewhere in this section
2119
% {{ech}} doesn't support custom SSL certificates, which means that a custom CNAME for an {{ech}} endpoint such as *mycluster.mycompanyname.com* also is not supported.
2220
%
@@ -25,7 +23,7 @@ mapped_urls:
2523
% encryption at rest (EAR) is enabled in {{ech}} by default. We support EAR for both the data stored in your clusters and the snapshots we take for backup, on all cloud platforms and across all regions.
2624
% You can also bring your own key (BYOK) to encrypt your Elastic Cloud deployment data and snapshots. For more information, check [Encrypt your deployment with a customer-managed encryption key](../../../deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md).
2725

28-
Note that the encryption happens at the file system level.
26+
% Note that the encryption happens at the file system level.
2927

3028
% What needs to be done: Refine
3129

@@ -57,15 +55,122 @@ $$$preserving-data-integrity$$$
5755

5856
$$$maintaining-audit-trail$$$
5957

60-
**This page is a work in progress.** The documentation team is working to combine content pulled from the following pages:
61-
62-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md)
63-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md)
64-
* [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md)
65-
* [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md)
66-
* [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md)
67-
* [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md)
68-
* [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md)
69-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md)
70-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md)
71-
* [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md)
58+
:::{warning}
59+
**This page is a work in progress.**
60+
:::
61+
62+
63+
% The documentation team is working to combine content pulled from the following pages:
64+
65+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md)
66+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md)
67+
% * [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md)
68+
% * [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md)
69+
% * [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md)
70+
% * [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md)
71+
% * [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md)
72+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md)
73+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md)
74+
% * [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md)
75+
76+
# Security
77+
78+
This section covers how to secure your Elastic environment. Learn how to implement TLS encryption, network security controls, and data protection measures.
79+
80+
## Security overview
81+
82+
An Elastic implementation comprises many moving parts: {es} nodes forming the cluster, {kib} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
83+
84+
To keep your data secured, Elastic offers comprehensive security features that:
85+
- Prevent unauthorized access to your deployment
86+
- Encrypt communications between components
87+
- Protect data at rest
88+
- Secure sensitive settings and saved objects
89+
90+
Security requirements and capabilities vary by deployment. Features may be managed automatically by Elastic, require configuration, or must be fully self-managed. Refer to [Security by deployment type](#security-by-deployment-type) for details.
91+
92+
::::{tip}
93+
See the [Deployment overview](/deploy-manage/deploy.md) to understand your options for deploying Elastic.
94+
::::
95+
96+
### Security by deployment type
97+
98+
Security features have one of these statuses across deployment types:
99+
100+
| Status | Description |
101+
|--------|-------------|
102+
| **Managed** | Handled automatically by Elastic with no user configuration needed |
103+
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
104+
| **Self-managed** | Infrastructure-level security you implement and maintain |
105+
| **N/A** | Not available for this deployment type |
106+
107+
#### Communication security
108+
109+
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
110+
|------------------|------------|--------------|-----|-----|--------------|
111+
| **TLS (HTTP Layer)** | Managed | Managed | Configurable | Configurable | Self-managed |
112+
| **TLS (Transport Layer)** | Managed | Managed | Managed | Managed | Self-managed |
113+
114+
#### Network security
115+
116+
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
117+
|------------------|------------|--------------|-----|-----|--------------|
118+
| **IP traffic filtering** | Configurable | Configurable | Configurable | Configurable | Configurable |
119+
| **Private link** | N/A | Configurable | N/A | N/A | N/A |
120+
| **Static IPs** | Configurable | Configurable | N/A | N/A | N/A |
121+
122+
#### Data security
123+
124+
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
125+
|------------------|------------|--------------|-----|-----|--------------|
126+
| **Encryption at rest** | Managed | Managed | Self-managed | Self-managed | Self-managed |
127+
| **Bring your own encryption key** | N/A | Configurable | N/A | N/A | N/A |
128+
| **Keystore security** | Managed | Managed | Configurable | Configurable | Configurable |
129+
| **Saved object encryption** | Managed | Managed | Configurable | Configurable | Configurable |
130+
131+
#### User session security
132+
133+
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
134+
|------------------|------------|--------------|-----|-----|--------------|
135+
| **Kibana Sessions** | Managed | Configurable | Configurable | Configurable | Configurable |
136+
137+
### Using this documentation
138+
139+
Throughout this security documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Each section clearly identifies which deployment types it applies to, and deployment-specific details are separated within each topic.
140+
141+
To get the most relevant information for your environment, focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
142+
143+
## Security topics
144+
145+
This security documentation is organized into four main areas:
146+
147+
% TODO: Add links to the sections below
148+
149+
### 1. Secure your hosting environment
150+
151+
The security of your hosting environment forms the foundation of your overall security posture. This section covers environment-specific security controls:
152+
153+
- **Elastic Cloud Hosted and Serverless**: Organization-level SSO, role-based access control, and cloud API keys
154+
- **Elastic Cloud Enterprise**: TLS certificates, role-based access control, and cloud API keys
155+
- **Self-managed environments**: TLS certificates, HTTPS configuration
156+
157+
### 2. Secure your deployments and clusters
158+
159+
Protect your deployments with features available across all deployment types:
160+
161+
- **Authentication and access controls**: User management, API keys, authentication protocols, and traffic filtering
162+
- **Data protection**: Encryption, sensitive settings, and document-level security
163+
- **Monitoring and compliance**: Audit logging and security best practices
164+
165+
### 3. Secure your user accounts
166+
167+
Individual user security helps prevent unauthorized access:
168+
169+
- **Multi-factor authentication**: Add an extra layer of security to your login process
170+
171+
### 4. Secure your clients and integrations
172+
173+
Ensure secure communication between your applications and Elastic:
174+
175+
- **Client security**: Best practices for securely connecting applications to {es}
176+
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations

release-notes/breaking-changes/elastic-apm.md

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,19 @@ To learn how to upgrade, check out <uprade docs>.
1717
% **Action**<br> Steps for mitigating deprecation impact.
1818
% ::::
1919

20-
% ## 9.0.0 [elastic-apm-900-breaking-changes]
21-
% **Release date:** March 25, 2025
20+
## 9.0.0 [elastic-apm-9-0-0-breaking-changes]
21+
**Release date:** March 25, 2025
2222

2323
% ::::{dropdown} Title of breaking change
2424
% Description of the breaking change.
2525
% For more information, check [PR #](PR link).
2626
% **Impact**<br> Impact of the breaking change.
2727
% **Action**<br> Steps for mitigating deprecation impact.
28-
% ::::
28+
% ::::
29+
30+
::::{dropdown} Change server information endpoint "/" to only accept GET and HEAD requests
31+
This will surface any agent misconfiguration causing data to be sent to `/` instead of the correct endpoint (for example, `/v1/traces` for OTLP/HTTP).
32+
For more information, check [PR #15976](https://github.com/elastic/apm-server/pull/15976).
33+
**Impact**<br> Any methods other than `GET` and `HEAD` to `/` will return HTTP 405 Method Not Allowed.
34+
**Action**<br> Update any existing usage, for example, update `POST /` to `GET /`.
35+
::::

solutions/observability/apps/apm-server-information-api.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ This is the server information endpoint:
1616
http(s)://{hostname}:{port}/
1717
```
1818

19-
Sending an `HTTP GET` or `HTTP POST` request to the server information endpoint will return an HTTP 200, indicating that the server is up.
19+
Sending an `HTTP GET` request to the server information endpoint will return an HTTP 200, indicating that the server is up.
2020

2121
To configure authenticated access to the APM server, the instructions at [APM API key](api-keys.md) or [APM Secret Token](secret-token.md), must be followed to configure the correct permissions for APM access.
2222

23-
If an [API keys](api-keys.md) or a [Secret token](secret-token.md) is passed along with the `HTTP GET` or `HTTP POST` request, in addition to an HTTP 200, the response payload will include some information about the APM server.
23+
If an [API keys](api-keys.md) or a [Secret token](secret-token.md) is passed along with the `HTTP GET` request, in addition to an HTTP 200, the response payload will include some information about the APM server.
2424

2525

2626
### Example: GET, without credentials [apm-api-info-example-get-without-credentials]
@@ -48,12 +48,12 @@ curl --verbose -X GET http://127.0.0.1:8200
4848
```
4949
5050
51-
### Example: POST, with secret token [apm-api-info-example-post-with-secret-token]
51+
### Example: GET, with secret token [apm-api-info-example-get-with-secret-token]
5252
53-
Example APM Server information request with POST, with a [Secret token](secret-token.md):
53+
Example APM Server information request with GET, with a [Secret token](secret-token.md):
5454
5555
```sh
56-
curl -X POST http://127.0.0.1:8200/ \
56+
curl -X GET http://127.0.0.1:8200/ \
5757
-H "Authorization: Bearer secret_token"
5858

5959
{

0 commit comments

Comments
 (0)