From 7f4e51614d47ad24d7232d799dea1dc1b79f8731 Mon Sep 17 00:00:00 2001 From: wajihaparvez Date: Fri, 4 Sep 2026 19:21:18 -0400 Subject: [PATCH] initial pass of new security paths --- deploy-manage/remote-clusters.md | 2 +- .../apikeys-local-ece-remote-private.md | 6 +++--- .../apikeys-local-ece-remote-public.md | 4 ++-- .../apikeys-local-ech-remote-private.md | 6 +++--- .../apikeys-local-ech-remote-public.md | 4 ++-- .../_snippets/configure-trust-download-ca.md | 2 +- .../_snippets/configure-trust-ecloud-self.md | 4 ++-- .../eck_rcs_external_endpoint_switch.md | 4 ++-- .../rcs-elasticsearch-api-snippet.md | 4 ++-- .../_snippets/rcs-kibana-api-snippet.md | 4 ++-- .../trusted-environment-change-api-key.md | 2 +- .../_snippets/trusted-environment-manage.md | 2 +- .../trusted-environment-remove-cert.md | 2 +- .../trusted-environment-update-cert.md | 2 +- .../remote-clusters/ec-enable-ccs-for-eck.md | 15 ++++++------- .../remote-clusters/ec-enable-ccs.md | 2 +- .../remote-clusters/ec-remote-cluster-ece.md | 21 +++++++++++-------- .../ec-remote-cluster-other-ess.md | 18 +++++++++------- .../ec-remote-cluster-same-ess.md | 4 ++-- .../ec-remote-cluster-strong-identity.md | 2 +- .../remote-clusters/ece-enable-ccs-for-eck.md | 2 +- .../remote-clusters/ece-enable-ccs.md | 2 +- .../ece-remote-cluster-ece-ess.md | 11 +++++----- .../ece-remote-cluster-other-ece.md | 4 ++-- .../ece-remote-cluster-same-ece.md | 2 +- .../security/_snippets/associate-filter.md | 5 +++-- ...nt-with-customer-managed-encryption-key.md | 6 +++--- deploy-manage/security/ip-filtering-cloud.md | 10 ++++----- .../security/network-security-policies.md | 4 ++-- .../security/private-connectivity-aws.md | 7 ++++--- .../security/private-connectivity-azure.md | 7 ++++--- .../security/private-connectivity-gcp.md | 7 ++++--- .../security/remote-cluster-filtering.md | 8 +++---- deploy-manage/security/secure-settings.md | 8 +++---- .../ec-aws-custom-repository.md | 4 ++-- .../ec-azure-snapshotting.md | 4 ++-- .../ec-gcs-snapshotting.md | 4 ++-- troubleshoot/monitoring/node-bootlooping.md | 4 ++-- 38 files changed, 111 insertions(+), 98 deletions(-) diff --git a/deploy-manage/remote-clusters.md b/deploy-manage/remote-clusters.md index d3fc779b69..a810fd4de7 100644 --- a/deploy-manage/remote-clusters.md +++ b/deploy-manage/remote-clusters.md @@ -120,7 +120,7 @@ The following table summarizes the supported connection paths: | {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't create private endpoints for customer networks. | ::::{warning} -Don't use a private connection hostname (for example, `*.vpce.{region}.aws.elastic-cloud.com` or your Azure private hosted zone domain) as the `proxy_address` for a remote cluster connection between two {{ech}} deployments. The connection fails with a DNS resolution error (for example, `unknown host` or `UnknownHostException` in the {{es}} logs) because the hostname is not resolvable from Elastic-managed networks. Use the public proxy address from the remote deployment's **Security** page instead. +Don't use a private connection hostname (for example, `*.vpce.{region}.aws.elastic-cloud.com` or your Azure private hosted zone domain) as the `proxy_address` for a remote cluster connection between two {{ech}} deployments. The connection fails with a DNS resolution error (for example, `unknown host` or `UnknownHostException` in the {{es}} logs) because the hostname is not resolvable from Elastic-managed networks. Use the public proxy address from the remote deployment's **Remote connections** page instead. :::: ::::{tip} diff --git a/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-private.md b/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-private.md index 7c27936335..7ecc6ed5c8 100644 --- a/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-private.md +++ b/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-private.md @@ -11,8 +11,8 @@ It requires remote_type substitution to be defined Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters. -3. From the navigation menu, select **Security**. -4. Select **Remote Connections > Add trusted environment** and choose **{{remote_type}}**. Then click **Next**. +3. From the navigation menu, select **Remote connections**. +4. Select **Add trusted environment** and choose **{{remote_type}}**. Then click **Next**. 5. Select **API keys** as authentication mechanism and click **Next**. 6. When asked whether the Certificate Authority (CA) of the remote environment’s proxy or load-balancing infrastructure is public, select **No, it is private**. 7. Add the API key: @@ -26,7 +26,7 @@ It requires remote_type substitution to be defined 3. Repeat these steps for each API key you want to add. For example, if you want to use several clusters of the remote environment for CCR or CCS. 8. Add the CA certificate of the remote environment. -9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Security** page. +9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Remote connections** page. 10. Select **Create trust** to complete the configuration. 11. Restart the local deployment to reload the new settings. To do that, go to the deployment's main page, locate the **Actions** menu, and select **Restart {{es}}**. diff --git a/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-public.md b/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-public.md index 4ffc88b42c..011478d63a 100644 --- a/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-public.md +++ b/deploy-manage/remote-clusters/_snippets/apikeys-local-ece-remote-public.md @@ -11,8 +11,8 @@ This snippet is in use in the following locations: Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters. -3. From the navigation menu, select **Security**. -4. Locate **Remote Connections > Trust management > Connections using API keys** and select **Add API key**. +3. From the navigation menu, select **Remote connections**. +4. Locate **Trust management** > **Connections using API keys** and select **Add API key**. 1. Fill both fields. diff --git a/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-private.md b/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-private.md index fb83a71f49..34e38160fb 100644 --- a/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-private.md +++ b/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-private.md @@ -10,8 +10,8 @@ It requires remote_type substitution to be defined 2. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -3. From the navigation menu, select **Access and Security** > **Security**. -4. Select **Remote Connections > Add trusted environment** and choose **{{remote_type}}**. Then click **Next**. +3. From the navigation menu, select **Remote connections**. +4. Select **Add trusted environment** and choose **{{remote_type}}**. Then click **Next**. 5. Select **API keys** as authentication mechanism and click **Next**. 6. When asked whether the Certificate Authority (CA) of the remote environment’s proxy or load-balancing infrastructure is public, select **No, it is private**. 7. Add the API key: @@ -25,7 +25,7 @@ It requires remote_type substitution to be defined 3. Repeat these steps for each API key you want to add. For example, if you want to use several clusters of the remote environment for CCR or CCS. 8. Add the CA certificate of the remote environment. -9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Security** page. +9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Remote connections** page. 10. Select **Create trust** to complete the configuration. 11. Restart the local deployment to reload the new settings. To do that, go to the deployment's main page, locate the **Actions** menu, and select **Restart {{es}}**. diff --git a/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-public.md b/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-public.md index 006e1eda8f..04c0936f89 100644 --- a/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-public.md +++ b/deploy-manage/remote-clusters/_snippets/apikeys-local-ech-remote-public.md @@ -11,8 +11,8 @@ This snippet is in use in the following locations: 2. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -3. From the navigation menu, select **Access and Security** > **Security**. -4. Locate **Remote Connections > Trust management > Connections using API keys** and select **Add API key**. +3. From the navigation menu, select **Remote connections**. +4. Locate **Trust management** > **Connections using API keys** and select **Add API key**. 1. Fill both fields. diff --git a/deploy-manage/remote-clusters/_snippets/configure-trust-download-ca.md b/deploy-manage/remote-clusters/_snippets/configure-trust-download-ca.md index ae990c2f55..22fc4a64db 100644 --- a/deploy-manage/remote-clusters/_snippets/configure-trust-download-ca.md +++ b/deploy-manage/remote-clusters/_snippets/configure-trust-download-ca.md @@ -1,6 +1,6 @@ 1. Download the transport CA certificate associated with your deployment. This CA is required by the self-managed cluster to establish trust with the deployment. - 1. Open your deployment management page in the {{ecloud}} UI and go to **Security**. + 1. Open your deployment management page in the {{ecloud}} UI and go to **Remote connections**. 2. Under **CA certificates**, select the download icon to save the CA into a local file. 2. Obtain the CA certificate of the self-managed cluster (the CA used to sign all transport certificates of your cluster). The CA needs to be in PEM format and should not contain the private key. If you only have the CA with the key in p12 format, then you can create the necessary file with the following command: diff --git a/deploy-manage/remote-clusters/_snippets/configure-trust-ecloud-self.md b/deploy-manage/remote-clusters/_snippets/configure-trust-ecloud-self.md index 3b436bcbf2..17007b2557 100644 --- a/deploy-manage/remote-clusters/_snippets/configure-trust-ecloud-self.md +++ b/deploy-manage/remote-clusters/_snippets/configure-trust-ecloud-self.md @@ -1,6 +1,6 @@ A deployment can be configured to trust all or specific deployments in any environment: -1. From the **Security** page, select **Remote Connections > Add trusted environment** and choose **Self-managed**. Then click **Next**. +1. From the deployment's navigation menu, go to **Remote connections**. Select **Add trusted environment** and choose **Self-managed**. Then click **Next**. 2. Select **Certificates** as authentication mechanism and click **Next**. @@ -22,7 +22,7 @@ A deployment can be configured to trust all or specific deployments in any envir If your self-managed cluster certificates do not include `otherName`, you must reissue them. To generate compatible certificates, refer to [Optional: reissue self-managed node certificates](#self-reissue-certs). :::: -5. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page. +5. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page. 6. Select **Create trust** to complete the configuration. diff --git a/deploy-manage/remote-clusters/_snippets/eck_rcs_external_endpoint_switch.md b/deploy-manage/remote-clusters/_snippets/eck_rcs_external_endpoint_switch.md index 4b657dc31a..6b484c9c99 100644 --- a/deploy-manage/remote-clusters/_snippets/eck_rcs_external_endpoint_switch.md +++ b/deploy-manage/remote-clusters/_snippets/eck_rcs_external_endpoint_switch.md @@ -6,11 +6,11 @@ This snippet is in use in the following locations: :::::::{applies-switch} ::::::{applies-item} ess: -Obtain the endpoint from the **Security** page of the ECH deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section, and replace its port with `9443`, which is the port used by the remote cluster server interface. +Obtain the endpoint from the **Remote connections** page of the ECH deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section, and replace its port with `9443`, which is the port used by the remote cluster server interface. :::::: ::::::{applies-item} ece: -Obtain the endpoint from the **Security** page of the ECE deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters**, and replace its port with `9443`, which is the port used by the remote cluster server interface. +Obtain the endpoint from the **Remote connections** page of the ECE deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters**, and replace its port with `9443`, which is the port used by the remote cluster server interface. :::::: ::::::{applies-item} self: diff --git a/deploy-manage/remote-clusters/_snippets/rcs-elasticsearch-api-snippet.md b/deploy-manage/remote-clusters/_snippets/rcs-elasticsearch-api-snippet.md index 937309646e..2f04083c66 100644 --- a/deploy-manage/remote-clusters/_snippets/rcs-elasticsearch-api-snippet.md +++ b/deploy-manage/remote-clusters/_snippets/rcs-elasticsearch-api-snippet.md @@ -13,7 +13,7 @@ To add a remote cluster, use the [cluster update settings API]({{es-apis}}operat * **Remote cluster alias**: When using API key authentication, the cluster alias must match the one you configured when [adding the API key](#configure-local-cluster) in the Cloud UI as **Remote cluster name**. * **mode**: `proxy` -* **proxy_address**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section. +* **proxy_address**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section. Using the API, this value can be obtained from the {{es}} resource info, concatenating the field `metadata.endpoint` and port `9400` using a semicolon. @@ -21,7 +21,7 @@ To add a remote cluster, use the [cluster update settings API]({{es-apis}}operat If you’re using API keys as security model, change the port to `9443`. :::: -* **server_name**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section. +* **server_name**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section. Using the API, this can be obtained from the {{es}} resource info field `metadata.endpoint`. diff --git a/deploy-manage/remote-clusters/_snippets/rcs-kibana-api-snippet.md b/deploy-manage/remote-clusters/_snippets/rcs-kibana-api-snippet.md index 194783110a..6dc7e6395f 100644 --- a/deploy-manage/remote-clusters/_snippets/rcs-kibana-api-snippet.md +++ b/deploy-manage/remote-clusters/_snippets/rcs-kibana-api-snippet.md @@ -20,7 +20,7 @@ To add a remote cluster in {{kib}}: When using API key authentication, this alias must match the **Remote cluster name** you configured when [adding the API key](#configure-local-cluster) in the Cloud UI. - * **Remote address**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section. + * **Remote address**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section. ::::{note} If you’re using API keys as security model, change the port to `9443`. @@ -29,7 +29,7 @@ To add a remote cluster in {{kib}}: * **Configure advanced options** (optional): Expand this section if you need to customize additional settings. * **TLS server name**: Specify a value if the certificate presented by the remote cluster is signed for a different name than the remote address. - This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section. + This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section. * **Socket connections**: Define the number of connections to open with the remote cluster. diff --git a/deploy-manage/remote-clusters/_snippets/trusted-environment-change-api-key.md b/deploy-manage/remote-clusters/_snippets/trusted-environment-change-api-key.md index 15545e0e6e..e9212ddfae 100644 --- a/deploy-manage/remote-clusters/_snippets/trusted-environment-change-api-key.md +++ b/deploy-manage/remote-clusters/_snippets/trusted-environment-change-api-key.md @@ -7,7 +7,7 @@ If you need to update the permissions granted by a cross-cluster API key for a r 1. On the deployment you will use as remote, use the [{{es}} API]({{es-apis}}operation/operation-security-create-cross-cluster-api-key) or [{{kib}}](/deploy-manage/api-keys/elasticsearch-api-keys.md) to create a cross-cluster API key with the appropriate permissions. Configure it with access to the indices you want to use for {{ccs}} or {{ccr}}. 2. Copy the encoded key (`encoded` in the response) to a safe location. You will need it in the next steps. -3. From the navigation menu of your local deployment, select **Security** and locate the **Remote connections** section. +3. Click **Manage** on your local deployment and from the navigation menu, go to **Remote connections**. 4. Locate the API key currently used for connecting to the remote cluster, copy its current alias, and delete it. 5. Add the new API key by selecting **Add API key**. diff --git a/deploy-manage/remote-clusters/_snippets/trusted-environment-manage.md b/deploy-manage/remote-clusters/_snippets/trusted-environment-manage.md index 7bd95a7fbe..3e86201f4c 100644 --- a/deploy-manage/remote-clusters/_snippets/trusted-environment-manage.md +++ b/deploy-manage/remote-clusters/_snippets/trusted-environment-manage.md @@ -1,4 +1,4 @@ -From a deployment's **Security** page, you can manage trusted environments that were created previously. This can happen when: +From a deployment's **Remote connections** page, you can manage trusted environments that were created previously. This can happen when: * You no longer need a trusted environment and want to remove it. * You want to refresh the certificate, or add or remove trusted deployments of an existing trusted environment relying on certificates as a security model. diff --git a/deploy-manage/remote-clusters/_snippets/trusted-environment-remove-cert.md b/deploy-manage/remote-clusters/_snippets/trusted-environment-remove-cert.md index d6df3a98a6..9623185a40 100644 --- a/deploy-manage/remote-clusters/_snippets/trusted-environment-remove-cert.md +++ b/deploy-manage/remote-clusters/_snippets/trusted-environment-remove-cert.md @@ -4,7 +4,7 @@ By removing a trusted environment, this deployment will no longer be able to est With this method, you can only remove trusted environments relying exclusively on certificates. To remove remote connections that use API keys for authentication, refer to [Change a cross-cluster API key used for a remote connection](#edit-remove-trusted-environment-api-key). :::: -1. Go to the deployment's **Security** page. +1. Click **Manage** on the deployment and from the navigation menu, go to **Remote connections**. 2. In the list of trusted environments, locate the one you want to remove. 3. Remove it using the corresponding `delete` icon. diff --git a/deploy-manage/remote-clusters/_snippets/trusted-environment-update-cert.md b/deploy-manage/remote-clusters/_snippets/trusted-environment-update-cert.md index fe53ce133b..4a5b09486e 100644 --- a/deploy-manage/remote-clusters/_snippets/trusted-environment-update-cert.md +++ b/deploy-manage/remote-clusters/_snippets/trusted-environment-update-cert.md @@ -1,4 +1,4 @@ -1. Go to the deployment's **Security** page. +1. Click **Manage** on the deployment and from the navigation menu, go to **Remote connections**. 2. In the list of trusted environments, locate the one you want to edit. 3. Open its details by selecting the `Edit` icon. diff --git a/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md b/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md index e8e17580eb..4abd17fce7 100644 --- a/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md +++ b/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md @@ -104,22 +104,23 @@ To configure trust in the ECH deployment: 2. Update the trust settings for the {{ech}} deployment: - 1. From the **Security** menu, select **Remote Connections > Add trusted environment**, choose **Self-managed**, and click **Next**. + 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. + 2. From the navigation menu, select **Remote connections**. Select **Add trusted environment**, choose **Self-managed**, and click **Next**. - 2. Select **Certificates** as the authentication mechanism and click **Next**. + 3. Select **Certificates** as the authentication mechanism and click **Next**. - 3. In **Add trusted CA certificate**, upload the `eck-ca.crt` file retrieved in the previous step. + 4. In **Add trusted CA certificate**, upload the `eck-ca.crt` file retrieved in the previous step. - 4. In **Select trusted clusters**, configure the following: + 5. In **Select trusted clusters**, configure the following: * Select **Trust clusters whose Common Name follows the Elastic pattern**. * For **Scope ID**, enter `.es.local`, replacing `` with the namespace of your ECK cluster. * In **Trust**, select **All deployments**. - 5. In **Name the environment**, enter a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page. + 6. In **Name the environment**, enter a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page. - 6. Select **Create trust** to complete the configuration. + 7. Select **Create trust** to complete the configuration. - 7. On the confirmation screen, when prompted **Have you already set up trust from the other environment?**, select **No, I have NOT set up trust from the other environment yet**. Download both the ECH deployment CA certificate and the `trust.yml` file. These files can also be retrieved from the **Security** page of the deployment. You’ll use these files to configure trust in the ECK deployment. + 8. On the confirmation screen, when prompted **Have you already set up trust from the other environment?**, select **No, I have NOT set up trust from the other environment yet**. Download both the ECH deployment CA certificate and the `trust.yml` file. These files can also be retrieved from **Security** > **Remote connections** on the deployment. You’ll use these files to configure trust in the ECK deployment. #### Update the downloaded `trust.yml` file for ECK compatibility diff --git a/deploy-manage/remote-clusters/ec-enable-ccs.md b/deploy-manage/remote-clusters/ec-enable-ccs.md index 265b196620..d3f4913ddd 100644 --- a/deploy-manage/remote-clusters/ec-enable-ccs.md +++ b/deploy-manage/remote-clusters/ec-enable-ccs.md @@ -33,7 +33,7 @@ To use CCS or CCR, your deployments must meet the following criteria: :::{include} _snippets/remote-cluster-certificate-compatibility.md ::: -* If your deployment was created before February 2021, the **Remote clusters** page in {{kib}} must be enabled manually from the **Security** page of your deployment, by selecting **Enable CCR** under **Trust management**. +* If your deployment was created before February 2021, the **Remote clusters** page in {{kib}} must be enabled manually from **Security** > **Remote connections** on your deployment, by selecting **Enable CCR** under **Trust management**. ## Set up remote clusters with {{ech}} diff --git a/deploy-manage/remote-clusters/ec-remote-cluster-ece.md b/deploy-manage/remote-clusters/ec-remote-cluster-ece.md index d458f8fa53..c906ec0247 100644 --- a/deploy-manage/remote-clusters/ec-remote-cluster-ece.md +++ b/deploy-manage/remote-clusters/ec-remote-cluster-ece.md @@ -79,19 +79,22 @@ The steps to follow depend on whether the Certificate Authority (CA) of the remo A deployment can be configured to trust all or specific deployments in a remote ECE environment: -1. Access the **Security** page of the deployment you want to use for cross-cluster operations. -2. Select **Remote Connections > Add trusted environment** and choose **{{ece}}**. Then click **Next**. -3. Select **Certificates** as authentication mechanism and click **Next**. -4. Enter the environment ID of the ECE environment. You can find it under Platform > Trust Management in your ECE administration UI. -5. Upload the Certificate Authority of the ECE environment. You can download it from Platform > Trust Management in your ECE administration UI. -6. Choose one of following options to configure the level of trust with the ECE environment: +1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. + + On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. +2. From the navigation menu, select **Remote connections**. +3. Select **Add trusted environment** and choose **{{ece}}**. Then click **Next**. +4. Select **Certificates** as authentication mechanism and click **Next**. +5. Enter the environment ID of the ECE environment. You can find it under Platform > Trust Management in your ECE administration UI. +6. Upload the Certificate Authority of the ECE environment. You can download it from Platform > Trust Management in your ECE administration UI. +7. Choose one of following options to configure the level of trust with the ECE environment: * **All deployments** - This deployment trusts all deployments in the ECE environment, including new deployments when they are created. * **Specific deployments** - Specify which of the existing deployments you want to trust in the ECE environment. The full {{es}} cluster ID must be entered for each remote cluster. The {{es}} `Cluster ID` can be found in the deployment overview page under **Applications**. -7. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page. -8. Select **Create trust** to complete the configuration. -9. Configure the corresponding deployments of the ECE environment to [trust this deployment](/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md#ece-trust-ec). You will only be able to connect two deployments successfully when both of them trust each other. +8. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page. +9. Select **Create trust** to complete the configuration. +10. Configure the corresponding deployments of the ECE environment to [trust this deployment](/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md#ece-trust-ec). You will only be able to connect two deployments successfully when both of them trust each other. ::::{note} The environment ID and cluster IDs must be entered fully and correctly. For security reasons, verification of the IDs is not possible. If cross-environment trust does not appear to be working, double-checking the IDs is a good place to start. diff --git a/deploy-manage/remote-clusters/ec-remote-cluster-other-ess.md b/deploy-manage/remote-clusters/ec-remote-cluster-other-ess.md index 36b1c01136..1574a39282 100644 --- a/deploy-manage/remote-clusters/ec-remote-cluster-other-ess.md +++ b/deploy-manage/remote-clusters/ec-remote-cluster-other-ess.md @@ -66,17 +66,21 @@ To configure strong identity verification together with API key authentication f A deployment can be configured to trust all or specific deployments in another {{ech}} [organization](../users-roles/cloud-organization.md). To add cross-organization trust: -1. From the **Security** page, select **Remote Connections > Add trusted environment** and select **{{ecloud}}**. Then click **Next**. -2. Select **Certificates** as authentication mechanism and click **Next**. -3. Enter the ID of the deployment’s organization which you want to establish trust with. You can find that ID on the **Organization** page. It is usually made of 10 digits. -4. Choose one of following options to configure the level of trust with the other organization: +1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. + + On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. +2. From the navigation menu, select **Remote connections**. +3. Select **Add trusted environment** and select **{{ecloud}}**. Then click **Next**. +4. Select **Certificates** as authentication mechanism and click **Next**. +5. Enter the ID of the deployment’s organization which you want to establish trust with. You can find that ID on the **Organization** page. It is usually made of 10 digits. +6. Choose one of following options to configure the level of trust with the other organization: * **All deployments** - This deployment trusts all deployments in the other organization, including new deployments when they are created. * **Specific deployments** - Specify which of the existing deployments you want to trust in the other organization. The full {{es}} cluster ID must be entered for each remote cluster. The {{es}} `Cluster ID` can be found in the deployment overview page under **Applications**. -5. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page. -6. Select **Create trust** to complete the configuration. -7. Repeat these steps from each of the deployments you want to use for CCS or CCR in both organizations. You will only be able to connect two deployments successfully when both of them trust each other. +7. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page. +8. Select **Create trust** to complete the configuration. +9. Repeat these steps from each of the deployments you want to use for CCS or CCR in both organizations. You will only be able to connect two deployments successfully when both of them trust each other. ::::{note} The organization ID and cluster IDs must be entered fully and correctly. For security reasons, verification of the IDs is not possible. If cross-organization trust does not appear to be working, double-checking the IDs is a good place to start. diff --git a/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md b/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md index 7cf0124741..4f074c9d14 100644 --- a/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md +++ b/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md @@ -64,7 +64,7 @@ To configure strong identity verification together with API key authentication f ::::::{tab-item} TLS certificate (deprecated) ### Set the default trust with other clusters in the same {{ecloud}} organization [ec_set_the_default_trust_with_other_clusters_in_the_same_elasticsearch_service_organization] -To configure this behavior in [{{ecloud}}](https://cloud.elastic.co?page=docs&placement=docs-body), go to **Security** > **Trust management** from the navigation menu. The **Trust all deployments** option is switched on by default. You can keep it switched on or switch it off. +To configure this behavior in [{{ecloud}}](https://cloud.elastic.co?page=docs&placement=docs-body), go to **Remote connections** > **Trust management** from the navigation menu. The **Trust all deployments** option is switched on by default. You can keep it switched on or switch it off. * When **Trust all deployments** is switched on - All deployments trust all other deployments in the same organization, including new deployments when they are created. If you keep this setting switched on, you can jump to [Connect to the remote cluster](/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md#ec_connect_to_the_remote_cluster) to finalize the CCS or CCR configuration. * When **Trust all deployments** is switched off - New deployments won’t trust any other deployments. Instead, you can configure trust for each of them in their security settings, as described in the next section. @@ -84,7 +84,7 @@ If your organization’s deployments already trust each other by default, you ca 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. From the navigation menu, select **Access and Security** > **Security**. +2. From the navigation menu, select **Remote connections**. 3. Under **Trusted environments**, edit the one labeled as your organization. 3. Choose one of following options to configure the level of trust on each of your deployments: diff --git a/deploy-manage/remote-clusters/ec-remote-cluster-strong-identity.md b/deploy-manage/remote-clusters/ec-remote-cluster-strong-identity.md index 4c90362735..0e4ab94167 100644 --- a/deploy-manage/remote-clusters/ec-remote-cluster-strong-identity.md +++ b/deploy-manage/remote-clusters/ec-remote-cluster-strong-identity.md @@ -63,7 +63,7 @@ The certificate and key used by the local cluster to sign cross-cluster requests * If the local cluster uses the default transport certificates, and both the local and remote clusters belong to the same cloud provided and region on {{ecloud}}, you can use the `internal_tls_ca.crt` file that already exist in your cluster. No additional upload is required. * If the local cluster uses the default transport certificates, but the remote cluster belongs to a different {{ecloud}} provider or region, you must download the local cluster transport CA and upload it to the remote deployment as a bundle. To do that: - 1. Open your deployment management page in the Elastic Cloud UI and go to **Security**. + 1. Open your deployment management page in the Elastic Cloud UI and go to **Remote connections**. 1. Under **CA certificates**, select the download icon to save the CA into a local file. 1. Add the CA certificate [as a ZIP bundle](/deploy-manage/deploy/elastic-cloud/upload-custom-plugins-bundles.md) in your remote deployment, and reference the file in the `cluster.remote.signing.certificate_authorities` setting. diff --git a/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md b/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md index 36c8447baf..e3e14003aa 100644 --- a/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md +++ b/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md @@ -104,7 +104,7 @@ When using TLS certificates-based authentication, the first step is to establish * Use the certificate file saved in the first step. * Select the {{ecloud}} pattern and enter `default.es.local` for the `Scope ID`. -2. Select `Save` and then download the CA Certificate and `trust.yml` file. These files can also be retrieved in the `Security` page of the deployment. You will use these files in the next set of steps. +2. Select `Save` and then download the CA Certificate and `trust.yml` file. These files can also be retrieved from the **Remote connections** page on the deployment. You will use these files in the next set of steps. #### Establish trust in the ECK cluster [ece_establish_trust_in_the_eck_cluster] diff --git a/deploy-manage/remote-clusters/ece-enable-ccs.md b/deploy-manage/remote-clusters/ece-enable-ccs.md index fcf7cf87a1..40a654613c 100644 --- a/deploy-manage/remote-clusters/ece-enable-ccs.md +++ b/deploy-manage/remote-clusters/ece-enable-ccs.md @@ -44,7 +44,7 @@ To use CCS or CCR, your environment must meet the following criteria: For configuration details, refer to the [ECE load balancer requirements](../deploy/cloud-enterprise/ece-load-balancers.md). -* If your deployment was created before ECE version `2.9.0`, the Remote clusters page in {{kib}} must be enabled manually from the **Security** page of your deployment, by selecting **Enable CCR** under **Trust management**. +* If your deployment was created before ECE version `2.9.0`, the Remote clusters page in {{kib}} must be enabled manually from the **Remote connections** page on your deployment, by selecting **Enable CCR** under **Trust management**. ::::{note} System deployments cannot be used as remote clusters or have remote clusters. diff --git a/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md b/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md index 25cc76507b..d98550d10e 100644 --- a/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md +++ b/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess.md @@ -63,15 +63,16 @@ If network security filters are applied to the remote cluster on {{ecloud}}, the A deployment can be configured to trust all or specific deployments from an organization in [{{ecloud}}](/deploy-manage/deploy/elastic-cloud/cloud-hosted.md): -1. From the **Security** menu, select **Remote Connections > Add trusted environment** and select **{{ecloud}} Organization**. -2. Enter the organization ID (which can be found near the organization name). -3. Upload the Certificate Authorities of the deployments you want to trust. These can be downloaded from the **Security** page of each deployment (not only the current CA, but also future certificates in case they are expiring soon since they are periodically rotated). Deployments from the same region are signed by the same CA, so you will only need to upload one for each region. -4. Choose one of following options to configure the level of trust with the Organization: +1. Go to **Security** > **Remote connections** on the deployment. +2. Select **Add trusted environment** and select **{{ecloud}} Organization**. +3. Enter the organization ID (which can be found near the organization name). +4. Upload the Certificate Authorities of the deployments you want to trust. These can be downloaded from the **Remote connections** page of each deployment (not only the current CA, but also future certificates in case they are expiring soon since they are periodically rotated). Deployments from the same region are signed by the same CA, so you will only need to upload one for each region. +5. Choose one of following options to configure the level of trust with the Organization: * All deployments - This deployment trusts all deployments in the organization in the regions whose certificate authorities have been uploaded, including new deployments when they are created. * Specific deployments - Specify which of the existing deployments you want to trust from this organization. The full {{es}} cluster ID must be entered for each remote cluster. The {{es}} `Cluster ID` can be found in the deployment overview page under **Applications**. -5. Configure the deployment in {{ecloud}} to [trust this deployment](/deploy-manage/remote-clusters/ec-remote-cluster-ece.md#ec-trust-ece), so that both deployments are configured to trust each other. +6. Configure the deployment in {{ecloud}} to [trust this deployment](/deploy-manage/remote-clusters/ec-remote-cluster-ece.md#ec-trust-ece), so that both deployments are configured to trust each other. Note that the organization ID and cluster IDs must be entered fully and correctly. For security reasons, no verification of the IDs is possible. If cross-environment trust does not appear to be working, double-checking the IDs is a good place to start. diff --git a/deploy-manage/remote-clusters/ece-remote-cluster-other-ece.md b/deploy-manage/remote-clusters/ece-remote-cluster-other-ece.md index e4a5858e29..335b552748 100644 --- a/deploy-manage/remote-clusters/ece-remote-cluster-other-ece.md +++ b/deploy-manage/remote-clusters/ece-remote-cluster-other-ece.md @@ -87,8 +87,8 @@ Now, deployments in those environments will be able to configure trust with depl ### Configuring trust with clusters of an {{ece}} environment [ece-trust-ece] -1. Access the **Security** page of the deployment you want to use for cross-cluster operations. -2. Select **Remote Connections > Add trusted environment** and choose **{{ece}}**. Then click **Next**. +1. Select **Manage** on the deployment you want to use for cross-cluster operations and from the navigation menu, go to **Remote connections**. +2. Select **Add trusted environment** and choose **{{ece}}**. Then click **Next**. 3. Select **Certificates** as authentication mechanism and click **Next**. 4. From the dropdown, select one of the environments configured in [Configuring platform level trust](#ece-trust-remote-environments). 5. Choose one of following options to configure the level of trust with the ECE environment: diff --git a/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md b/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md index 7aec8165a7..2c10fc75b0 100644 --- a/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md +++ b/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md @@ -82,7 +82,7 @@ By default, any deployment that you or your users create trusts all other deploy If your organization’s deployments already trust each other by default, you can skip this section. If that’s not the case, follow these steps to configure which are the specific deployments that should be trusted. -1. Go to the **Security** page of your deployment. +1. Select **Manage** on your deployment and from the navigation menu, go to **Remote connections**. 2. From the list of existing trust configurations, edit the one labeled as your organization. 3. Choose one of following options to configure the level of trust on each of your deployments: diff --git a/deploy-manage/security/_snippets/associate-filter.md b/deploy-manage/security/_snippets/associate-filter.md index 4a3842abc0..a7e91f0a1e 100644 --- a/deploy-manage/security/_snippets/associate-filter.md +++ b/deploy-manage/security/_snippets/associate-filter.md @@ -1,5 +1,6 @@ 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page, you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. On the **Security** page, under **Network security**, select **Apply policies** > **{{policy-type}}**. -3. Choose the policy you want to apply and select **Apply**. +2. From the navigation menu, select **Network security**. +3. Select **Apply policies** > **{{policy-type}}**. +4. Choose the policy you want to apply and select **Apply**. diff --git a/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md b/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md index 92a045995e..b2f623322d 100644 --- a/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md +++ b/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md @@ -454,8 +454,8 @@ The deployment is now created and encrypted using the specified key. Future snap ### Encrypt an existing deployment with your key [ec_encrypt_an_existing_deployment_with_a_customer_managed_key] -1. Go to your deployment's **Security** page. -2. Under **Encryption at rest**, select **Manage encryption key**. +1. From your deployment's navigation menu, go to **Encryption at rest**. +2. Select **Manage customer key**. 3. Enter your key identifier (the ARN for {{aws}}, the key identifier for Azure, or the resource ID for Google Cloud) and save your changes. {{ecloud}} then applies a plan change to encrypt your deployment's data and snapshots with your key. This plan change happens without downtime. @@ -476,7 +476,7 @@ Keep these considerations in mind when adding a customer-managed key to an exist ## Verify your deployment encryption -You can check that your hosted deployment is correctly encrypted with the key you specified. To do that, go to the deployment’s **Security** page and select **Manage encryption key** in **Encryption at rest**. +You can check that your hosted deployment is correctly encrypted with the key you specified. To do that, select **Manage** on your deployment and go to **Encryption at rest** > **Manage customer key**. ## Rotate a customer-managed key [rotate-a-customer-managed-key] diff --git a/deploy-manage/security/ip-filtering-cloud.md b/deploy-manage/security/ip-filtering-cloud.md index 05cd4175a6..208927e63d 100644 --- a/deploy-manage/security/ip-filtering-cloud.md +++ b/deploy-manage/security/ip-filtering-cloud.md @@ -108,8 +108,8 @@ You can apply multiple policies to a single deployment or project. For {{ech}} d 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. From the navigation menu, select **Access and Security** > **Security**. -3. Under **Network security**, select **Apply policies** > **IP filter**. +2. From the navigation menu, select **Network security**. +3. Select **Apply policies** > **IP filter**. 4. Choose the IP filter you want to apply and select **Apply**. ::: :::: @@ -143,8 +143,8 @@ If you want to a specific IP filter from a deployment or project, or delete the 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. From the navigation menu, select **Access and Security** > **Security**. -3. Under **Network security**, find the IP filter that you want to disconnect. +2. From the navigation menu, select **Network security**. +3. Find the IP filter that you want to disconnect. 4. Under **Actions**, click the **Delete** icon. ::: :::: @@ -167,7 +167,7 @@ You can edit an IP filter's name or description, change the allowed traffic sour 4. Click **Update** to save your changes. :::{tip} -You can also edit IP filters from your deployment's **Security** page or your project's **Network security** page. +You can also edit IP filters from the **Network security** page in your deployment or cluster. ::: ## Delete an IP filter diff --git a/deploy-manage/security/network-security-policies.md b/deploy-manage/security/network-security-policies.md index 66e05fdb10..1260fb115b 100644 --- a/deploy-manage/security/network-security-policies.md +++ b/deploy-manage/security/network-security-policies.md @@ -72,9 +72,9 @@ Network security policies are listed on the page. From this page, you can view a :::{applies-item} ess: 1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body). 2. On the **Hosted deployments** page, select your deployment. -3. Select the **Security** tab on the left-hand side menu bar. +3. From the navigation menu, select **Network security**. -Network security policies are listed under **Network security**. From this section, you can view and remove existing policies and attach new policies. +Network security policies are listed on the page. From this page, you can view and remove existing policies and attach new policies. ::: :::: diff --git a/deploy-manage/security/private-connectivity-aws.md b/deploy-manage/security/private-connectivity-aws.md index b5a4b7f37f..45b73bd8b3 100644 --- a/deploy-manage/security/private-connectivity-aws.md +++ b/deploy-manage/security/private-connectivity-aws.md @@ -566,7 +566,7 @@ You can edit a policy's name, description, VPC endpoint ID, and more. 4. Click **Update** to save your changes. :::{tip} -You can also edit private connection policies from your deployment or project's **Security** page or your project's **Network security** page. +You can also edit private connection policies from the **Network security** page in your deployment or project. ::: ### Remove a private connection policy from your deployment or project [remove-private-connection-policy] @@ -580,8 +580,9 @@ If you want to remove a specific policy from a deployment or project, or delete 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. On the **Security** page, under **Network security**, find the policy that you want to disconnect. -3. Under **Actions**, click the **Delete** icon. +2. From the navigation menu, select **Network security**. +3. Find the policy that you want to disconnect. +4. Under **Actions**, click the **Delete** icon. ::: :::{applies-item} serverless: ga 1. Find your project on the home page or on the **Serverless projects** page, then select **Manage** to access its settings menus. diff --git a/deploy-manage/security/private-connectivity-azure.md b/deploy-manage/security/private-connectivity-azure.md index 58b0fab9b8..7515616672 100644 --- a/deploy-manage/security/private-connectivity-azure.md +++ b/deploy-manage/security/private-connectivity-azure.md @@ -562,7 +562,7 @@ You can edit a policy's name, description, resource name, Private Endpoint filte 4. Click **Update** to save your changes. :::{tip} -You can also edit private connection policies from your deployment or project's **Security** page or your project's **Network security** page. +You can also edit private connection policies from the **Network security** page in your deployment or project. ::: ### Remove a private connection policy from your deployment or project [remove-private-connection-policy] @@ -576,8 +576,9 @@ If you want to remove a specific policy from a deployment or project, or delete 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. On the **Security** page, under **Network security**, find the policy that you want to disconnect. -3. Under **Actions**, click the **Delete** icon. +2. From the navigation menu, select **Network security**. +3. Find the policy that you want to disconnect. +4. Under **Actions**, click the **Delete** icon. ::: :::{applies-item} serverless: ga 1. Find your project on the home page or on the **Serverless projects** page, then select **Manage** to access its settings menus. diff --git a/deploy-manage/security/private-connectivity-gcp.md b/deploy-manage/security/private-connectivity-gcp.md index 8d138154a8..b22e997ffb 100644 --- a/deploy-manage/security/private-connectivity-gcp.md +++ b/deploy-manage/security/private-connectivity-gcp.md @@ -302,7 +302,7 @@ You can edit a policy's name, description, VPC endpoint ID, and more. 4. Click **Update** to save your changes. :::{tip} -You can also edit network security policies from your deployment's **Security** page or your project's **Network security** page. +You can also edit network security policies from the **Network security** page in your deployment or project. ::: @@ -315,8 +315,9 @@ If you want to remove a specific policy from a deployment, or delete the policy, 1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus. On the **Hosted deployments** page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -2. On the **Security** page, under **Network security**, find the policy that you want to disconnect. -3. Under **Actions**, click the **Delete** icon. +2. From the navigation menu, select **Network security**. +3. Find the policy that you want to disconnect. +4. Under **Actions**, click the **Delete** icon. #### From the policy settings diff --git a/deploy-manage/security/remote-cluster-filtering.md b/deploy-manage/security/remote-cluster-filtering.md index 756706f275..8172565ae6 100644 --- a/deploy-manage/security/remote-cluster-filtering.md +++ b/deploy-manage/security/remote-cluster-filtering.md @@ -155,13 +155,13 @@ To remove a network security policy or rule set association from your deployment ::::::{applies-item} ess: -You can remove associations from your deployments directly from the policy settings or from the deployment security page. +You can remove associations from your deployments directly from the policy settings or from the deployment **Network security** page. -#### From your deployment security page +#### From your deployment 1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body). 2. On the **Hosted deployments** page, select your deployment. -3. Select the **Security** tab on the left-hand side menu bar. -4. Under **Network security**, find the security policy you want to disconnect. +3. From the navigation menu, select **Network security**. +4. Find the security policy you want to disconnect. 5. Under **Actions**, click the **Delete** icon. #### From the network security policy settings diff --git a/deploy-manage/security/secure-settings.md b/deploy-manage/security/secure-settings.md index b2c303fc12..409b51d68d 100644 --- a/deploy-manage/security/secure-settings.md +++ b/deploy-manage/security/secure-settings.md @@ -64,7 +64,7 @@ The instructions below cover how to manage {{es}} keystore settings for each dep ::::{applies-item} { ess:, ece: } % ### ECE and ECH -You can manage {{es}} secure settings in the **Security > {{es}} keystore** section of your deployment page in the {{ecloud}} Console or ECE Cloud UI. +You can manage {{es}} secure settings on the **Elasticsearch keystore** page in the {{ecloud}} Console or ECE Cloud UI. If a feature requires both standard `elasticsearch.yml` settings and secure settings, configure the secure settings first. Updating standard settings can trigger a cluster rolling restart, and if the required secure settings are not yet in place, the nodes may fail to start. In contrast, adding secure settings does not trigger a restart. @@ -87,8 +87,8 @@ Add settings and secret values to the keystore. On the **Deployments** page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -3. From your deployment menu, select **Security**. -4. Locate **{{es}} keystore** and select **Add settings**. +3. From your deployment menu, select **Elasticsearch keystore**. +4. Select **Add settings**. 5. On the **Create setting** window, select the secret **Type**. 6. Configure the settings, then select **Save**. @@ -105,7 +105,7 @@ When your secure settings are no longer needed, delete them from the keystore. On the **Deployments** page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. -3. From your deployment menu, select **Security**. +3. From your deployment menu, select **Elasticsearch keystore**. 4. From the **Existing keystores** list, use the delete icon next to setting that you want to delete. 5. On the **Confirm to delete** window, select **Confirm**. :::: diff --git a/deploy-manage/tools/snapshot-and-restore/ec-aws-custom-repository.md b/deploy-manage/tools/snapshot-and-restore/ec-aws-custom-repository.md index 206d8c63f3..a23cd841dd 100644 --- a/deploy-manage/tools/snapshot-and-restore/ec-aws-custom-repository.md +++ b/deploy-manage/tools/snapshot-and-restore/ec-aws-custom-repository.md @@ -59,8 +59,8 @@ For a full list of settings that are supported for your S3 bucket, refer to [S3 You can use the {{es}} keystore to store the credentials to access your AWS account. 1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body). -2. Navigate to the **Security** page of the deployment you wish to configure. -3. Locate **{{es}} keystore** and select **Add settings**. +2. Click **Manage** on the deployment you want to configure and from the navigation menu, go to **Elasticsearch keystore**. +3. Select **Add settings**. 4. With **Type** set to **Single string**, add the following keys and their values: * `s3.client.secondary.access_key` diff --git a/deploy-manage/tools/snapshot-and-restore/ec-azure-snapshotting.md b/deploy-manage/tools/snapshot-and-restore/ec-azure-snapshotting.md index 3b3201a82e..731bc422bc 100644 --- a/deploy-manage/tools/snapshot-and-restore/ec-azure-snapshotting.md +++ b/deploy-manage/tools/snapshot-and-restore/ec-azure-snapshotting.md @@ -28,8 +28,8 @@ Follow the Microsoft documentation to [set up an Azure storage account](https:// Create an entry for the Azure client in the {{es}} keystore: 1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body). -2. Navigate to the **Security** page of the deployment you wish to configure. -3. Locate **{{es}} keystore** and select **Add settings**. +2. Click **Manage** on the deployment you want to configure and from the navigation menu, go to **Elasticsearch keystore**. +3. Select **Add settings**. 4. With **Type** set to **Single string**, add the following keys and their values: * `azure.client.secondary.account` diff --git a/deploy-manage/tools/snapshot-and-restore/ec-gcs-snapshotting.md b/deploy-manage/tools/snapshot-and-restore/ec-gcs-snapshotting.md index 7e2a3a0a4c..905f58c92a 100644 --- a/deploy-manage/tools/snapshot-and-restore/ec-gcs-snapshotting.md +++ b/deploy-manage/tools/snapshot-and-restore/ec-gcs-snapshotting.md @@ -41,8 +41,8 @@ Follow the Google Cloud Storage documentation to [create a GCS bucket](https://c Create an entry for the GCS client in the {{es}} keystore: 1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body). -2. Navigate to the **Security** page of the deployment you wish to configure. -3. Locate **{{es}} keystore** and select **Add settings**. +2. Click **Manage** on the deployment you want to configure and from the navigation menu, go to **Elasticsearch keystore**. +3. Select **Add settings**. 4. Enter the **Setting name** `gcs.client.secondary.credentials_file`. 5. With **Type** set to **JSON block / file**, add your [GCS service account key JSON file](#ec-gcs-service-account-key). 6. Select **Save**. diff --git a/troubleshoot/monitoring/node-bootlooping.md b/troubleshoot/monitoring/node-bootlooping.md index f3e2269002..be1a5044c8 100644 --- a/troubleshoot/monitoring/node-bootlooping.md +++ b/troubleshoot/monitoring/node-bootlooping.md @@ -101,8 +101,8 @@ To check the current set of stored settings: * For {{ech}} or {{ece}}: - 1. Open the deployment **Security** page. - 2. In the **{{es}} keystore** section, check the **Security keys** list. The list is shown only if you currently have settings configured in the keystore. + 1. From your deployment's navigation menu, go to **Elasticsearch keystore**. + 2. Check the **Security keys** list. The list is shown only if you currently have settings configured in the keystore. * For {{eck}}, check your [secure settings](/deploy-manage/security/k8s-secure-settings.md).