Secure your settings

Some of the settings that you configure in Elastic Cloud Enterprise are sensitive, such as passwords, and relying on file system permissions to protect these settings is insufficient. To protect your sensitive settings, use the Elasticsearch keystore. With the Elasticsearch keystore, you can add a key and its secret value, then use the key in place of the secret value when you configure your sensitive settings.

There are three types of secrets that you can use:

Single string - Associate a secret value to a setting.
Multiple strings - Associate multiple keys to multiple secret values.
JSON block/file - Associate multiple keys to multiple secret values in JSON format.

Add secret values

edit

Add keys and secret values to the keystore.

Log into the Cloud UI.
On the deployments page, select your deployment.

Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
From your deployment menu, select Security.
Locate Elasticsearch keystore and select Add settings.
On the Create setting window, select the secret Type.
Configure the settings, then select Save.
All the modifications to the non-reloadable keystore take effect only after restarting Elasticsearch. Reloadable keystore changes take effect after issuing a reload_secure_settings API request.

Only some settings are designed to be read from the keystore. However, the keystore has no validation to block unsupported settings. Adding unsupported settings to the keystore causes reload_secure_settings to fail and if not addressed, Elasticsearch will fail to start. To check whether a setting is supported in the keystore, look for a "Secure" qualifier in the setting reference.

Delete secret values

edit

When your keys and secret values are no longer needed, delete them from the keystore.

Log into the Cloud UI.
On the deployments page, select your deployment.

Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
From your deployment menu, select Security.
From the Existing keystores list, use the delete icon next to the Setting Name that you want to delete.
On the Confirm to delete window, select Confirm.
All modifications to the non-reloadable keystore take effect only after restarting Elasticsearch. Reloadable keystore changes take effect after issuing a reload_secure_settings API request.

« Reset the password for the elastic user Secure your clusters with LDAP »