High security of Alibaba Cloud Elasticsearch - Elasticsearch

Alibaba Cloud Elasticsearch clusters are deployed in logically isolated virtual private clouds (VPCs). In addition, access control, authentication and authorization, encryption, and the advanced security features provided by X-Pack are used for the clusters. All the preceding features ensure the high security of Alibaba Cloud Elasticsearch clusters. This topic describes the features.

Background information

Open source software is often the first target of attacks. MongoDB ransomware attacks are an example. Elasticsearch has also become the target of attacks. Attackers may attack self-managed Elasticsearch clusters that do not have professional security protection, delete important data, or interfere with business systems.

Alibaba Cloud Security Center released a warning about the security risks associated with Elasticsearch and provided an array of security hardening strategies and solutions. Alibaba Cloud Elasticsearch provides solutions that are more reliable and professional for data and service security than those provided by open source Elasticsearch.

Security features

Since the launch of the fully managed service in November 2017, Alibaba Cloud Elasticsearch has implemented various security measures to mitigate potential cluster risks.

The following table compares the security protection of an Alibaba Cloud Elasticsearch cluster with that of a self-managed Elasticsearch cluster.

Security aspect	Default capabilities	Self-managed configuration
Access control	Clusters are deployed in a VPC for network isolation at the data link layer. Both Elasticsearch and Kibana support IP address whitelists, which can contain single IP addresses, IP address ranges, and IPv6 addresses. By default, public endpoints deny access from all IP addresses. You must configure an IP address whitelist for a public endpoint before you can access it. For more information, see Configure a public or private IP address whitelist for an instance. Users cannot log on to the servers that host cluster nodes. Only ports 9200 and 9300 are open on the public and internal endpoints.	Use cloud security products such as security groups and Cloud Firewall to control and isolate inbound IP addresses. Avoid exposing port 9200 to the internet. Bind to specific source IP addresses. Change the default ports.
Authentication and authorization	Provides cluster-level access policies through Resource Access Management (RAM), such as ReadOnlyAccess and FullAccess. Provides fine-grained permission control through RAM for resources such as instances and accounts, and for operations such as GET, POST, and PUT. Provides role-based access control (RBAC) with field-level security using the X-Pack security plug-in. Supports single sign-on (SSO) through Active Directory, LDAP, or native Elasticsearch realms using the X-Pack security plug-in.	Install third-party security plug-ins such as Search Guard or Shield.
Encryption	Supports the HTTPS protocol for access. Supports encryption at rest using Key Management Service (KMS). Provides SSL/TLS encryption for data in transit between nodes using the X-Pack security plug-in.	Use storage media that supports encryption at rest. Disable HTTP access in the YML configuration file.
Monitoring and auditing	Provides audit logging for operations using the X-Pack security plug-in. Monitors comprehensive metrics such as cluster load using CloudMonitor.	Purchase a commercial Elastic license (Platinum or Enterprise level) to enable the audit logging feature of the X-Pack security plug-in. Use third-party tools such as Filebeat and Fluentd to monitor cluster status.
Disaster recovery	Provides scheduled snapshots for data backup. Provides high availability for a single cluster across multiple zones in the same region.	Purchase a file system for regular backups. Maintain multiple clusters for disaster recovery.

Access control

Alibaba Cloud Elasticsearch uses the following methods to control access:

VPC access

You can access your Alibaba Cloud Elasticsearch instance in a VPC by using its internal endpoint. If your application requires a highly secure access environment, you can purchase an ECS instance in the same region, zone, and VPC as your Alibaba Cloud Elasticsearch instance. Deploy your application on the ECS instance, and then access the Elasticsearch instance from it by using the internal endpoint.

Note
A VPC is a private network on the cloud that is isolated from the public internet, providing a more secure access environment.
Whitelist-based access control

Internal endpoints support system whitelist configuration. Only devices whose IP addresses are in the internal whitelist can access the instance. For more information, see Configure a public or internal whitelist for an instance.

Public endpoints support allowlist configurations for public access. Only devices with IP addresses that are included in the public allowlist can access the instance. For more information, see Configure a public or private allowlist for an instance.

Authentication and authorization

RAM-based access control

Resource Access Management (RAM) policies are supported to implement resource isolation between RAM accounts. Each account can view and manage only its own Elasticsearch instances. For more information, see Permission policy evaluation process.
Role-based access control (RBAC) with X-Pack

The X-Pack commercial plugin is available. X-Pack is a commercial extension pack for Elasticsearch that bundles security, alerting, monitoring, graphing, and reporting features into a single, easy-to-install package. X-Pack is integrated with Kibana and provides capabilities such as authentication, role-based access control, real-time monitoring, visual reporting, and machine learning. You can use the role-based access control feature of X-Pack to implement index-level access control. For more information, see Manage user permissions by using Elasticsearch X-Pack roles and official Security APIs.