Alibaba Cloud Elasticsearch clusters run in logically isolated virtual private clouds (VPCs) and are protected by multiple security layers: network access control, authentication, authorization, encryption, and X-Pack advanced security features.
Security layers
Access control operates in three layers:
-
Network layer -- IP address whitelists control which hosts can reach the cluster or Kibana endpoint.
-
Authentication layer -- The
elasticuser password verifies identity when connecting through a client or Kibana. -
Authorization layer -- Role-based access control (RBAC) through X-Pack grants granular permissions on objects such as clusters, indexes, and fields.
The following table summarizes the default state and required action for each method.
| Method | Scope | Default state | Action required |
|---|---|---|---|
| Cluster access password | Cluster and Kibana authentication | Set during cluster creation | Specify a password for the elastic user |
| Public IP address whitelist (cluster) | Cluster network access | Public Network Access is disabled | Enable Public Network Access and add IP addresses |
| Private IP address whitelist (cluster) | Cluster network access | Internal network access is allowed | Add IP addresses to the private whitelist |
| Public IP address whitelist (Kibana) | Kibana network access | Public Network Access is enabled; default whitelist is 127.0.0.1,::1 (blocks all traffic) |
Add your IP address to the Kibana public whitelist |
| Private IP address whitelist (Kibana) | Kibana network access | Private Network Access is disabled | Enable Private Network Access and add IP addresses |
| X-Pack RBAC | Authorization (clusters, indexes, fields) | Available after cluster creation | Create custom roles and assign them to users in the Kibana console |
Network access control
Cluster IP address whitelists
Public IP address whitelist
Public Network Access is disabled for Elasticsearch clusters by default. To access your cluster over the Internet, enable Public Network Access and add the IP address of your host to a public IP address whitelist.
For more information, see Configure a public or private IP address whitelist for an Elasticsearch cluster.
Private IP address whitelist
By default, Elasticsearch allows access to your cluster over an internal network. To restrict access to specific hosts, add their IP addresses to a private IP address whitelist.
For more information, see Configure a public or private IP address whitelist for an Elasticsearch cluster.
Kibana IP address whitelists
Public IP address whitelist
Public Network Access is enabled for Kibana by default. However, the default public IP address whitelist contains 127.0.0.1,::1, which denies all IPv4 and IPv6 requests. On your first logon to the Kibana console, the system prompts you to configure a public IP address whitelist. Add the IP address of your host before you log on.
For more information, see Configure a public or private IP address whitelist for Kibana.
The configuration page shows that Kibana Public Network Access is enabled, Kibana Public Network Address is https://es-cn-n6w***l.kibana.elasticsearch.aliyuncs.com, Kibana Public Network Port is 5601, with a Modify whitelist entry on the right; Kibana Private Network Access is disabled by default.
Private IP address whitelist
Private Network Access is disabled for Kibana by default. To log on to the Kibana console from a host over an internal network, enable Private Network Access and add the IP address of the host to a private IP address whitelist.
For more information, see Configure a public or private IP address whitelist for Kibana.
Authentication
Cluster access password
When you create an Elasticsearch cluster, you must specify a password for the elastic default user. This password is required to access the cluster through a client or log on to the Kibana console.
For more information, see Parameters on the buy page.
The password must meet complexity requirements: at least three of the following character types must be present: uppercase letters, lowercase letters, digits, and special characters. The length must be 8–32 characters. Supported special characters include !@#$%&*()_+-=. For the exact set of accepted characters, refer to the prompt that is displayed on the buy page in the console.
To change the password, reset it on the cluster details page.
For more information, see Reset the access password for an Elasticsearch cluster.
Kibana authentication methods
In addition to the cluster access password, the Kibana console supports RAM-based access. RAM-based access lets RAM users log on to Kibana using their Alibaba Cloud account without entering a separate Kibana password. This is useful when you need to grant team members access to Kibana without sharing the elastic user credentials.
The following table compares the supported Kibana authentication methods.
|
Method |
Description |
|
Password-based access |
Log on to Kibana using the |
|
RAM-based access |
Log on to Kibana using an Alibaba Cloud account (RAM user). Authentication is handled through Alibaba Cloud SSO — no separate Kibana password is required. |
Access Kibana using RAM-based authentication
Prerequisites
-
Your IP address is added to the Kibana public IP address whitelist. For more information, see Configure a public or private IP address whitelist for Kibana.
-
The RAM user has the required permissions to access the Elasticsearch cluster. [TODO: confirm the exact RAM permission policy required for Kibana SSO access — needs Writer verification]
Procedure
-
Log on to the Elasticsearch console.
-
In the left-side navigation pane, click Clusters.
-
On the Clusters page, click the name of the target cluster to go to the cluster details page.
-
On the cluster details page, click [TODO: Writer to verify the exact button or link name used to open Kibana] to open the Kibana console.
Kibana authenticates your identity using your Alibaba Cloud account via SSO. You do not need to enter a password.
Authorization
X-Pack RBAC
To assign granular permissions on Elasticsearch clusters, indexes, and fields, use the RBAC mechanism provided by the X-Pack plugin. Create custom roles with specific permissions and assign them to users in the Kibana console.
For more information, see Use the RBAC mechanism provided by Elasticsearch X-Pack to implement access control.
On the Create role page in the Kibana console, configure the following:
-
Role name: Enter the role name.
-
Elasticsearch section: Set Cluster privileges, Run As privileges, and Index privileges (including Indices, Privileges, Granted fields, and document-level read permissions).
-
Kibana section: Set Minimum privileges for all spaces and configure higher privileges for specific spaces.
After the configuration is complete, click Create role to create the role.