Add remote cluster ports to Azure, AWS, and GCP private connectivity pages

deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md

@@ -108,6 +108,7 @@ $$$ec-restrictions-network-security-kibana-sso$$$
 ```
 ```{include} /deploy-manage/security/_snippets/aws-privatelink-cloud-id-limitation.md
 ```
+* **Remote clusters with API key authentication over GCP Private Service Connect:** Remote cluster connections that use the API key based security model are not yet supported over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Only the TLS certificate based security model (port `9400`) is currently supported for remote cluster traffic over GCP PSC.
 
 ## PDF report generation using Alerts or Watcher webhooks [ec-restrictions-network-security-watcher]
 

deploy-manage/security/_snippets/private-url-struct.md

@@ -18,7 +18,5 @@ Use the following URL structure. Take the alias and product from your Elastic en
 
 
 :::{tip}
-{{ech}} supports ports 443 and 9243.
-
 You can also connect to the cluster using the {{es}} cluster ID, for example, https://6b111580caaa4a9e84b18ec7c600155e.{{example-phz-dn}}.
 :::

deploy-manage/security/private-connectivity-aws.md

@@ -202,7 +202,7 @@ This limitation does not apply to [cross-region PrivateLink connections](#ec-aws
     :screenshot:
     :::
 
-    The security group for the endpoint should, at minimum, allow for inbound connectivity from your instances' CIDR range on ports 443 and 9243. Security groups for the instances should allow for outbound connectivity to the endpoint on ports 443 and 9243.
+    The security group for the endpoint should, at minimum, allow for inbound connectivity from your instances' CIDR range on ports 443 and 9243. Security groups for the instances should allow for outbound connectivity to the endpoint on ports 443 and 9243. If you use this endpoint for remote cluster traffic to an {{ech}} deployment, also allow port `9443` or `9400`, depending on the security model you configure.
 
     <!--need to verify this for serverless-->
 
@@ -249,6 +249,8 @@ After you create your VPC endpoint and DNS entries, check that you are able to r
 ::::{applies-item} ess: ga
 :::{include} _snippets/private-url-struct.md
 :::
+
+{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations.
 ::::
 ::::{applies-item} serverless: ga
 :::{include} _snippets/private-url-struct-serverless.md
@@ -437,6 +439,8 @@ Use the alias you’ve set up as CNAME DNS record to access your resource.
 ::::{applies-item} ess: ga
 :::{include} _snippets/private-url-struct.md
 :::
+
+{{ech}} supports ports `443` and `9243` for Elasticsearch and Kibana traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations.
 ::::
 ::::{applies-item} serverless: ga
 :::{include} _snippets/private-url-struct-serverless.md

deploy-manage/security/private-connectivity-azure.md

@@ -267,6 +267,8 @@ After you create your private connection, you can check that you're able to reac
 ::::{applies-item} ess: ga
 :::{include} _snippets/private-url-struct.md
 :::
+
+{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations.
 ::::
 ::::{applies-item} serverless: ga
 :::{include} _snippets/private-url-struct-serverless.md
@@ -443,6 +445,8 @@ Use the alias you've set up as an A record to access your resource.
 ::::{applies-item} ess: ga
 :::{include} _snippets/private-url-struct.md
 :::
+
+{{ech}} supports ports `443` and `9243` for {{es}} and {{kib}} traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication uses port `9400` with the TLS certificate based security model, or `9443` with the API key based model. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for the supported combinations.
 ::::
 ::::{applies-item} serverless: ga
 :::{include} _snippets/private-url-struct-serverless.md

deploy-manage/security/private-connectivity-gcp.md

@@ -47,6 +47,8 @@ When using GCP Private Service Connect, the following limitations apply:
 ```{include} _snippets/private-connectivity-limitations-ech.md
 ```
 
+* **Remote clusters with API key authentication:** Remote cluster connections that use the API key based security model are not yet supported over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Only the TLS certificate based security model (port `9400`) is currently supported for remote cluster traffic.
+
 ## Private Service Connect URIs [ec-private-service-connect-uris]
 
 Service Attachments are set up by Elastic in all supported GCP regions under the following URIs:
@@ -256,6 +258,8 @@ Use the alias you’ve set up as CNAME A record to access your deployment.
 :::{include} _snippets/private-url-struct.md
 :::
 
+{{ech}} supports ports `443` and `9243` for Elasticsearch and Kibana traffic. Remote cluster traffic for cross-cluster search and cross-cluster replication is supported with the TLS certificate based security model (port `9400`). The API key based security model is not yet available over GCP Private Service Connect because traffic on port `9443` is not currently allowed. Refer to [Connection paths and private connectivity](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths) for more information.
+
 To access the deployment:
 
 1. If needed, find the endpoint of an application in your deployment: