diff --git a/deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md b/deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md index 0ae46cac5b..6aa5399465 100644 --- a/deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md +++ b/deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md @@ -108,6 +108,7 @@ $$$ec-restrictions-network-security-kibana-sso$$$ ``` ```{include} /deploy-manage/security/_snippets/aws-privatelink-cloud-id-limitation.md ``` +* **Remote clusters with API key authentication over GCP Private Service Connect:** Remote cluster connections that use the API key based security model are not yet supported over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Only the TLS certificate based security model (port `9400`) is currently supported for remote cluster traffic over GCP PSC. ## PDF report generation using Alerts or Watcher webhooks [ec-restrictions-network-security-watcher] diff --git a/deploy-manage/security/_snippets/private-url-struct.md b/deploy-manage/security/_snippets/private-url-struct.md index c7c3b788e9..a3eebe2751 100644 --- a/deploy-manage/security/_snippets/private-url-struct.md +++ b/deploy-manage/security/_snippets/private-url-struct.md @@ -18,7 +18,5 @@ Use the following URL structure. Take the alias and product from your Elastic en :::{tip} -{{ech}} supports ports 443 and 9243. - You can also connect to the cluster using the {{es}} cluster ID, for example, https://6b111580caaa4a9e84b18ec7c600155e.{{example-phz-dn}}. ::: diff --git a/deploy-manage/security/private-connectivity-aws.md b/deploy-manage/security/private-connectivity-aws.md index c1f4769209..48d4411574 100644 --- a/deploy-manage/security/private-connectivity-aws.md +++ b/deploy-manage/security/private-connectivity-aws.md @@ -202,7 +202,7 @@ This limitation does not apply to [cross-region PrivateLink connections](#ec-aws :screenshot: ::: - The security group for the endpoint should, at minimum, allow for inbound connectivity from your instances' CIDR range on ports 443 and 9243. Security groups for the instances should allow for outbound connectivity to the endpoint on ports 443 and 9243. + The security group for the endpoint should, at minimum, allow for inbound connectivity from your instances' CIDR range on ports 443 and 9243. Security groups for the instances should allow for outbound connectivity to the endpoint on ports 443 and 9243. If you use this endpoint for remote cluster traffic to an {{ech}} deployment, also allow port `9443` or `9400`, depending on the security model you configure. @@ -249,6 +249,8 @@ After you create your VPC endpoint and DNS entries, check that you are able to r ::::{applies-item} ess: ga :::{include} _snippets/private-url-struct.md ::: + +{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations. :::: ::::{applies-item} serverless: ga :::{include} _snippets/private-url-struct-serverless.md @@ -437,6 +439,8 @@ Use the alias you’ve set up as CNAME DNS record to access your resource. ::::{applies-item} ess: ga :::{include} _snippets/private-url-struct.md ::: + +{{ech}} supports ports `443` and `9243` for Elasticsearch and Kibana traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations. :::: ::::{applies-item} serverless: ga :::{include} _snippets/private-url-struct-serverless.md diff --git a/deploy-manage/security/private-connectivity-azure.md b/deploy-manage/security/private-connectivity-azure.md index ed2ee599d2..c2ba1f7d30 100644 --- a/deploy-manage/security/private-connectivity-azure.md +++ b/deploy-manage/security/private-connectivity-azure.md @@ -267,6 +267,8 @@ After you create your private connection, you can check that you're able to reac ::::{applies-item} ess: ga :::{include} _snippets/private-url-struct.md ::: + +{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations. :::: ::::{applies-item} serverless: ga :::{include} _snippets/private-url-struct-serverless.md @@ -443,6 +445,8 @@ Use the alias you've set up as an A record to access your resource. ::::{applies-item} ess: ga :::{include} _snippets/private-url-struct.md ::: + +{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations. :::: ::::{applies-item} serverless: ga :::{include} _snippets/private-url-struct-serverless.md diff --git a/deploy-manage/security/private-connectivity-gcp.md b/deploy-manage/security/private-connectivity-gcp.md index 72ebd10b83..ee17c2d823 100644 --- a/deploy-manage/security/private-connectivity-gcp.md +++ b/deploy-manage/security/private-connectivity-gcp.md @@ -47,6 +47,8 @@ When using GCP Private Service Connect, the following limitations apply: ```{include} _snippets/private-connectivity-limitations-ech.md ``` +* **Remote clusters with API key authentication:** Remote cluster connections that use the API key based security model are not yet supported over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Only the TLS certificate based security model (port `9400`) is currently supported for remote cluster traffic. + ## Private Service Connect URIs [ec-private-service-connect-uris] Service Attachments are set up by Elastic in all supported GCP regions under the following URIs: @@ -256,6 +258,8 @@ Use the alias you’ve set up as CNAME A record to access your deployment. :::{include} _snippets/private-url-struct.md ::: +{{ech}} supports ports `443` and `9243` for Elasticsearch and Kibana traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication is supported with the TLS certificate based security model (port `9400`). The API key based security model is not yet available over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for more information. + To access the deployment: 1. If needed, find the endpoint of an application in your deployment: