Skip to content

Commit d0b5df0

Browse files
eedugoneedugon
committed
review in progress
1 parent f82bfbd commit d0b5df0

File tree

5 files changed

+36
-32
lines changed

5 files changed

+36
-32
lines changed

‎deploy-manage/security/_snippets/cluster-comparison.md‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ Security feature availability varies by deployment type, with each feature havin
55
| **Fully managed** | Handled automatically by Elastic with no user configuration needed |
66
| **Managed** | Handled automatically by Elastic, but certain configuration allowed |
77
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
8-
| **Self-managed** | Infrastructure-level security you implement and maintain |
98
| **N/A** | Not available for this deployment type |
109

1110
Select your deployment type below to see what's available and how implementation responsibilities are distributed:
@@ -20,7 +19,7 @@ Select your deployment type below to see what's available and how implementation
2019
|------------------|------------|--------------|-------------|
2120
| **Communication** | TLS (HTTP Layer) | Fully managed | Automatically configured by Elastic |
2221
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
23-
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-traffic-filtering.md) |
22+
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-cloud.md) |
2423
| | Private link | Configurable | [Establish a secure VPC connection](/deploy-manage/security/private-link-traffic-filters.md) |
2524
| | Kubernetes Network Policies | N/A | |
2625
| **Data** | Encryption at rest | Managed | You can [bring your own encryption key](/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md) |
@@ -33,31 +32,31 @@ Select your deployment type below to see what's available and how implementation
3332
:::{tab-item} Serverless
3433
:sync: serverless
3534

36-
| Category| Security feature | Status | Description |
35+
| Category| Security feature | Status | Notes |
3736
|------------------|------------|--------------|-------------|
3837
| **Communication** | TLS (HTTP Layer) | Fully managed | Automatically configured by Elastic |
3938
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
40-
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-traffic-filtering.md) |
41-
| | Private link | N/A | X |
39+
| **Network** | IP traffic filtering | N/A | |
40+
| | Private link | N/A | |
4241
| | Kubernetes Network Policies | N/A | |
4342
| **Data** | Encryption at rest | Fully managed | Automatically encrypted by Elastic |
44-
| | Secure settings | Configurable | Automatically protected by Elastic |
43+
| | Secure settings | N/A | |
4544
| | Saved object encryption | Fully managed | Automatically encrypted by Elastic |
46-
| **User Session** | Kibana Sessions | Managed | Automatically configured by Elastic |
45+
| **User Session** | Kibana Sessions | Fully managed | Automatically configured by Elastic |
4746

4847
:::
4948

5049
:::{tab-item} ECE
5150
:sync: ece
5251

53-
| Category| Security feature | Status | Description |
52+
| Category| Security feature | Status | Notes |
5453
|------------------|------------|--------------|-------------|
5554
| **Communication** | TLS (HTTP Layer) | Managed | You can [configure custom certificates](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md) |
5655
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
57-
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-traffic-filtering.md) |
58-
| | Private link | N/A | X |
56+
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-cloud.md) |
57+
| | Private link | N/A | |
5958
| | Kubernetes Network Policies | N/A | |
60-
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
59+
| **Data** | Encryption at rest | N/A | |
6160
| | Secure settings | Configurable | [Configure secure settings](/deploy-manage/security/secure-settings.md) |
6261
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
6362
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
@@ -67,14 +66,14 @@ Select your deployment type below to see what's available and how implementation
6766
:::{tab-item} ECK
6867
:sync: eck
6968

70-
| Category| Security feature | Status | Description |
69+
| Category| Security feature | Status | Notes |
7170
|------------------|------------|--------------|-------------|
7271
| **Communication** | TLS (HTTP Layer) | Managed | [Multiple options](/deploy-manage/security/k8s-https-settings.md) |
7372
| | TLS (Transport Layer) | Managed | [Multiple options](/deploy-manage/security/k8s-transport-settings.md) |
74-
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-traffic-filtering.md) |
73+
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-basic.md) |
7574
| | Private link | N/A | |
7675
| | Kubernetes Network Policies | Configurable | [Apply network policies to your Pods](/deploy-manage/security/k8s-network-policies.md) |
77-
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
76+
| **Data** | Encryption at rest | N/A | |
7877
| | Secure settings | Configurable | [Configure secure settings](/deploy-manage/security/k8s-secure-settings.md) |
7978
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
8079
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
@@ -85,15 +84,15 @@ Select your deployment type below to see what's available and how implementation
8584
:::{tab-item} Self-managed
8685
:sync: self-managed
8786

88-
| Category| Security feature | Status | Description |
87+
| Category| Security feature | Status | Notes |
8988
|------------------|------------|--------------|-------------|
90-
| **Communication** | TLS (HTTP Layer) | Self-managed | Implement and maintain certificates |
91-
| | TLS (Transport Layer) | Self-managed | Implement and maintain certificates |
92-
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-traffic-filtering.md) |
93-
| | Private link | N/A | X |
89+
| **Communication** | TLS (HTTP Layer) | Configurable | [Initial security setup](/deploy-manage/security/self-setup.md) |
90+
| | TLS (Transport Layer) | Configurable | [Initial security setup](/deploy-manage/security/self-setup.md) |
91+
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-basic.md) |
92+
| | Private link | N/A | |
9493
| | Kubernetes Network Policies | N/A | |
95-
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
96-
| | Keystore security | Configurable | [Configure secure settings](/deploy-manage/security/secure-settings.md) storage |
94+
| **Data** | Encryption at rest | N/A | |
95+
| | Keystore security | Configurable | [Configure secure settings](/deploy-manage/security/secure-settings.md) |
9796
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
9897
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
9998

‎deploy-manage/security/secure-cluster-communications.md‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -92,17 +92,17 @@ While HTTP TLS encryption is optional in self-managed environments, it is strong
9292

9393
The way that HTTP layer security is managed depends on your deployment type:
9494

95-
::::{tab-set}
95+
:::::{tab-set}
9696
:group: deployments
9797

98-
:::{tab-item} ECH and Serverless
98+
::::{tab-item} ECH and Serverless
9999
:sync: ech
100100

101101
HTTP TLS for {{es}} and {{kib}} is fully managed by Elastic. No configuration is required.
102102
{{kib}} instances are automatically configured to connect securely to {{es}}, without requiring manual setup.
103-
:::
103+
::::
104104

105-
:::{tab-item} ECE
105+
::::{tab-item} ECE
106106
:sync: ece
107107

108108
HTTP TLS for deployments is managed at the platform proxy level. Refer to these guides for ECE-specific security customizations:
@@ -111,28 +111,32 @@ HTTP TLS for deployments is managed at the platform proxy level. Refer to these
111111
* [Configure TLS version](./secure-your-elastic-cloud-enterprise-installation/configure-tls-version.md)
112112

113113
{{kib}} instances are automatically configured to connect securely to {{es}}, without requiring manual setup.
114-
:::
114+
::::
115115

116-
:::{tab-item} ECK
116+
::::{tab-item} ECK
117117
:sync: eck
118118

119119
HTTP TLS is automatically enabled for {{es}} and {{kib}} using self-signed certificates, with [several options available for customization](./k8s-https-settings.md), including custom certificates and domain names.
120120

121121
{{kib}} instances are automatically configured to connect securely to {{es}}, without requiring manual setup.
122-
:::
122+
::::
123123

124-
:::{tab-item} Self-managed
124+
::::{tab-item} Self-managed
125125
:sync: self
126126

127127
HTTP TLS certificates for {{es}} can be [automatically configured](self-auto-setup.md), or manually set up by following the steps in [Set up HTTP SSL](./set-up-basic-security-plus-https.md).
128128

129129
{{kib}} acts as both an HTTP client to {{es}} and a server for browser access. It performs operations on behalf of users, so it must be properly configured to trust the {{es}} certificates, and to present its own TLS certificate for secure browser connections. These configurations must be performed manually in self-managed deployments.
130130

131-
For environments with stricter security requirements, refer to [Mutual TLS authentication between {{kib}} and {{es}}](./kibana-es-mutual-tls.md).
131+
:::{note}
132+
The automatic configuration does not enable TLS on the {{kib}} HTTP endpoint. To encrypt browser traffic to {{kib}}, follow the steps in [](./set-up-basic-security-plus-https.md#encrypt-kibana-browser).
132133
:::
133134

135+
For environments with stricter security requirements, refer to [Mutual TLS authentication between {{kib}} and {{es}}](./kibana-es-mutual-tls.md).
134136
::::
135137

138+
:::::
139+
136140
## Certificates lifecycle [generate-certificates]
137141

138142
Managing certificates is critical for secure communications. Certificates have limited lifetimes and must be renewed before expiry to prevent service disruptions. Each deployment type provides different tools or responsibilities for managing certificates lifecycle.

‎deploy-manage/security/secure-your-cluster-deployment.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ applies_to:
55
eck: all
66
ece: all
77
ess: all
8-
mapped_pages:
9-
- https://www.elastic.co/guide/en/elasticsearch/reference/current/manually-configure-security.html
108
---
119

1210
# Secure your cluster or deployment

‎deploy-manage/security/self-setup.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ navigation_title: "Self-managed security setup"
33
applies_to:
44
deployment:
55
self: ga
6+
mapped_pages:
7+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/manually-configure-security.html
68
---
79

810
% scope: initial security setup in self-managed deployments, following the automatic or manual (minimal, basic, https) procedures

‎redirects.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
redirects:
2+
'deploy-manage/security/secure-http-communications.md': '!deploy-manage/security/secure-cluster-communications.md'
23
'deploy-manage/security/manually-configure-security-in-self-managed-cluster.md': '!deploy-manage/security/self-setup.md'
34
'deploy-manage/security/security-certificates-keys.md': '!deploy-manage/security/self-auto-setup.md'
45
'deploy-manage/security/ece-traffic-filtering-through-the-api.md': 'deploy-manage/security/ec-traffic-filtering-through-the-api.md'

0 commit comments

Comments
 (0)