What are the "Elastic security features" that are referred to in the _cat/indices doc page?

Elastic Stack Elasticsearch
1

cat indices API | Elasticsearch Guide [8.11] | Elastic says

If the Elasticsearch security features are enabled, you must have the monitor or manage cluster privilege to use this API.

... but there is no link to what these "security features" are, either generally or specifically. I can find things like "Basic Security", etc. but not the "elastic security features" that this doc page refers to. What does "elastic security features" mean, specifically?

These are also mentioned in the Exists API page

2

Hi @astanton1978

Its is everything under this section of the documents

Everything from simple basic authentication.... to a fully locked down cluster using SSL, SAML and field level security... All Elastic Stack resources can be / are control by a strong and flexible RBAC (Role Based Access Control) capability.

3

So any single one of those things being turned on/configured will constitute "Elasticsearch security features" as being enabled for the context of the referenced docs pages?

4

Once you enable Authorization (username / password) and Authorization (Role Based Control) that user will need the correct mentioned roles to use certain APIs.

Before you apply the security features your cluster and endpoints are basically unauthenticated and thus wide open... perhaps that is ok to test on your dev station but certainly not recommended for production etc.

5

Thanks for the info.

Docs writers should really link the note in the docs to the section and detail you shared here.

6

We'd end up with tonnes of cross links if we did that every time, so while I can appreciate your confusion here, I am not sure doing that would be any better.

The best approach might be to step back and look at the top level of the set of features - ie Secure the Elastic Stack | Elasticsearch Guide [7.15] | Elastic as @stephenb linked - to get an idea of the context of that set of features/configuration that is being worked on?

7

The point was that the API pages were vaguely referring to "Elasticsearch security features enabled", and that phrase/text does not specifically identify or match a specific page or section anywhere else in the rest of the documentation.

Besides, the web was designed for linking. Why is there any hesitation to using hyperlinks?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.