elastic · wajihaparvez · Sep 4, 2026
@@ -120,7 +120,7 @@ The following table summarizes the supported connection paths:
 | {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't create private endpoints for customer networks. |
 
 ::::{warning}
-Don't use a private connection hostname (for example, `*.vpce.{region}.aws.elastic-cloud.com` or your Azure private hosted zone domain) as the `proxy_address` for a remote cluster connection between two {{ech}} deployments. The connection fails with a DNS resolution error (for example, `unknown host` or `UnknownHostException` in the {{es}} logs) because the hostname is not resolvable from Elastic-managed networks. Use the public proxy address from the remote deployment's **Security** page instead.
+Don't use a private connection hostname (for example, `*.vpce.{region}.aws.elastic-cloud.com` or your Azure private hosted zone domain) as the `proxy_address` for a remote cluster connection between two {{ech}} deployments. The connection fails with a DNS resolution error (for example, `unknown host` or `UnknownHostException` in the {{es}} logs) because the hostname is not resolvable from Elastic-managed networks. Use the public proxy address from the remote deployment's **Remote connections** page instead.
 ::::
 
 ::::{tip}

@@ -11,8 +11,8 @@ It requires remote_type substitution to be defined
 
     Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
 
-3. From the navigation menu, select **Security**.
-4. Select **Remote Connections > Add trusted environment** and choose **{{remote_type}}**. Then click **Next**.
+3. From the navigation menu, select **Remote connections**.
+4. Select **Add trusted environment** and choose **{{remote_type}}**. Then click **Next**.
 5. Select **API keys** as authentication mechanism and click **Next**.
 6. When asked whether the Certificate Authority (CA) of the remote environment’s proxy or load-balancing infrastructure is public, select **No, it is private**.
 7. Add the API key:
@@ -26,7 +26,7 @@ It requires remote_type substitution to be defined
     3. Repeat these steps for each API key you want to add. For example, if you want to use several clusters of the remote environment for CCR or CCS.
 
 8. Add the CA certificate of the remote environment.
-9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Security** page.
+9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Remote connections** page.
 10. Select **Create trust** to complete the configuration.
 11. Restart the local deployment to reload the new settings. To do that, go to the deployment's main page, locate the **Actions** menu, and select **Restart {{es}}**.
 

@@ -11,8 +11,8 @@
 
     Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
 
-3. From the navigation menu, select **Security**.
-4. Locate **Remote Connections > Trust management > Connections using API keys** and select **Add API key**.
+3. From the navigation menu, select **Remote connections**.
+4. Locate **Trust management** > **Connections using API keys** and select **Add API key**.
 
     1. Fill both fields.
 

@@ -10,8 +10,8 @@ It requires remote_type substitution to be defined
 2. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus.
 
     On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
-3. From the navigation menu, select **Access and Security** > **Security**.
-4. Select **Remote Connections > Add trusted environment** and choose **{{remote_type}}**. Then click **Next**.
+3. From the navigation menu, select **Remote connections**.
+4. Select **Add trusted environment** and choose **{{remote_type}}**. Then click **Next**.
 5. Select **API keys** as authentication mechanism and click **Next**.
 6. When asked whether the Certificate Authority (CA) of the remote environment’s proxy or load-balancing infrastructure is public, select **No, it is private**.
 7. Add the API key:
@@ -25,7 +25,7 @@ It requires remote_type substitution to be defined
     3. Repeat these steps for each API key you want to add. For example, if you want to use several clusters of the remote environment for CCR or CCS.
 
 8. Add the CA certificate of the remote environment.
-9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Security** page.
+9. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment's **Remote connections** page.
 10. Select **Create trust** to complete the configuration.
 11. Restart the local deployment to reload the new settings. To do that, go to the deployment's main page, locate the **Actions** menu, and select **Restart {{es}}**.
 

@@ -11,8 +11,8 @@
 2. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus.
 
     On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
-3. From the navigation menu, select **Access and Security** > **Security**.
-4. Locate **Remote Connections > Trust management > Connections using API keys** and select **Add API key**.
+3. From the navigation menu, select **Remote connections**.
+4. Locate **Trust management** > **Connections using API keys** and select **Add API key**.
 
     1. Fill both fields.
 

@@ -1,6 +1,6 @@
 1. Download the transport CA certificate associated with your deployment. This CA is required by the self-managed cluster to establish trust with the deployment.
 
-    1. Open your deployment management page in the {{ecloud}} UI and go to **Security**.
+    1. Open your deployment management page in the {{ecloud}} UI and go to **Remote connections**.
     2. Under **CA certificates**, select the download icon to save the CA into a local file.
 
 2. Obtain the CA certificate of the self-managed cluster (the CA used to sign all transport certificates of your cluster). The CA needs to be in PEM format and should not contain the private key. If you only have the CA with the key in p12 format, then you can create the necessary file with the following command:

@@ -1,6 +1,6 @@
 A deployment can be configured to trust all or specific deployments in any environment:
 
-1. From the **Security** page, select **Remote Connections > Add trusted environment** and choose **Self-managed**. Then click **Next**.
+1. From the deployment's navigation menu, go to **Remote connections**. Select **Add trusted environment** and choose **Self-managed**. Then click **Next**.
 
 2. Select **Certificates** as authentication mechanism and click **Next**.
 
@@ -22,7 +22,7 @@ A deployment can be configured to trust all or specific deployments in any envir
         If your self-managed cluster certificates do not include `otherName`, you must reissue them. To generate compatible certificates, refer to [Optional: reissue self-managed node certificates](#self-reissue-certs).
         ::::
 
-5. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page.
+5. Provide a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page.
 
 6. Select **Create trust** to complete the configuration.
 

@@ -6,11 +6,11 @@ This snippet is in use in the following locations:
 :::::::{applies-switch}
 
 ::::::{applies-item} ess:
-Obtain the endpoint from the **Security** page of the ECH deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section, and replace its port with `9443`, which is the port used by the remote cluster server interface.
+Obtain the endpoint from the **Remote connections** page of the ECH deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section, and replace its port with `9443`, which is the port used by the remote cluster server interface.
 ::::::
 
 ::::::{applies-item} ece:
-Obtain the endpoint from the **Security** page of the ECE deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters**, and replace its port with `9443`, which is the port used by the remote cluster server interface.
+Obtain the endpoint from the **Remote connections** page of the ECE deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters**, and replace its port with `9443`, which is the port used by the remote cluster server interface.
 ::::::
 
 ::::::{applies-item} self:

@@ -13,15 +13,15 @@ To add a remote cluster, use the [cluster update settings API]({{es-apis}}operat
 
 * **Remote cluster alias**: When using API key authentication, the cluster alias must match the one you configured when [adding the API key](#configure-local-cluster) in the Cloud UI as **Remote cluster name**.
 * **mode**: `proxy`
-* **proxy_address**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
+* **proxy_address**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
 
    Using the API, this value can be obtained from the {{es}} resource info, concatenating the field `metadata.endpoint` and port `9400` using a semicolon.
 
   ::::{note}
   If you’re using API keys as security model, change the port to `9443`.
   ::::
 
-* **server_name**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
+* **server_name**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
 
    Using the API, this can be obtained from the {{es}} resource info field `metadata.endpoint`.
 

@@ -20,7 +20,7 @@ To add a remote cluster in {{kib}}:
 
       When using API key authentication, this alias must match the **Remote cluster name** you configured when [adding the API key](#configure-local-cluster) in the Cloud UI.
 
-    * **Remote address**: This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
+    * **Remote address**: This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
 
       ::::{note}
       If you’re using API keys as security model, change the port to `9443`.
@@ -29,7 +29,7 @@ To add a remote cluster in {{kib}}:
     * **Configure advanced options** (optional): Expand this section if you need to customize additional settings.
       * **TLS server name**: Specify a value if the certificate presented by the remote cluster is signed for a different name than the remote address.
 
-        This value can be found on the **Security** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
+        This value can be found on the **Remote connections** page of the {{remote_type}} deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
 
       * **Socket connections**: Define the number of connections to open with the remote cluster.
 

@@ -7,7 +7,7 @@ If you need to update the permissions granted by a cross-cluster API key for a r
 
 1. On the deployment you will use as remote, use the [{{es}} API]({{es-apis}}operation/operation-security-create-cross-cluster-api-key) or [{{kib}}](/deploy-manage/api-keys/elasticsearch-api-keys.md) to create a cross-cluster API key with the appropriate permissions. Configure it with access to the indices you want to use for {{ccs}} or {{ccr}}.
 2. Copy the encoded key (`encoded` in the response) to a safe location. You will need it in the next steps.
-3. From the navigation menu of your local deployment, select **Security** and locate the **Remote connections** section.
+3. Click **Manage** on your local deployment and from the navigation menu, go to **Remote connections**.
 4. Locate the API key currently used for connecting to the remote cluster, copy its current alias, and delete it.
 5. Add the new API key by selecting **Add API key**.
 

@@ -1,4 +1,4 @@
-From a deployment's **Security** page, you can manage trusted environments that were created previously. This can happen when:
+From a deployment's **Remote connections** page, you can manage trusted environments that were created previously. This can happen when:
 
 * You no longer need a trusted environment and want to remove it.
 * You want to refresh the certificate, or add or remove trusted deployments of an existing trusted environment relying on certificates as a security model.

@@ -4,7 +4,7 @@ By removing a trusted environment, this deployment will no longer be able to est
 With this method, you can only remove trusted environments relying exclusively on certificates. To remove remote connections that use API keys for authentication, refer to [Change a cross-cluster API key used for a remote connection](#edit-remove-trusted-environment-api-key).
 ::::
 
-1. Go to the deployment's **Security** page.
+1. Click **Manage** on the deployment and from the navigation menu, go to **Remote connections**.
 2. In the list of trusted environments, locate the one you want to remove.
 3. Remove it using the corresponding `delete` icon.
 

@@ -1,4 +1,4 @@
-1. Go to the deployment's **Security** page.
+1. Click **Manage** on the deployment and from the navigation menu, go to **Remote connections**.
 2. In the list of trusted environments, locate the one you want to edit.
 3. Open its details by selecting the `Edit` icon.
 

@@ -104,22 +104,23 @@ To configure trust in the ECH deployment:
 
 2. Update the trust settings for the {{ech}} deployment:
 
-    1. From the **Security** menu, select **Remote Connections > Add trusted environment**, choose **Self-managed**, and click **Next**.
+    1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus.
+    2. From the navigation menu, select **Remote connections**. Select **Add trusted environment**, choose **Self-managed**, and click **Next**.
 
-    2. Select **Certificates** as the authentication mechanism and click **Next**.
+    3. Select **Certificates** as the authentication mechanism and click **Next**.
 
-    3. In **Add trusted CA certificate**, upload the `eck-ca.crt` file retrieved in the previous step.
+    4. In **Add trusted CA certificate**, upload the `eck-ca.crt` file retrieved in the previous step.
 
-    4. In **Select trusted clusters**, configure the following:
+    5. In **Select trusted clusters**, configure the following:
         * Select **Trust clusters whose Common Name follows the Elastic pattern**.
         * For **Scope ID**, enter `<kubernetes-namespace>.es.local`, replacing `<kubernetes-namespace>` with the namespace of your ECK cluster.
         * In **Trust**, select **All deployments**.
 
-    5. In **Name the environment**, enter a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page.
+    6. In **Name the environment**, enter a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Remote connections** page.
 
-    6. Select **Create trust** to complete the configuration.
+    7. Select **Create trust** to complete the configuration.
 
-    7. On the confirmation screen, when prompted **Have you already set up trust from the other environment?**, select **No, I have NOT set up trust from the other environment yet**. Download both the ECH deployment CA certificate and the `trust.yml` file. These files can also be retrieved from the **Security** page of the deployment. You’ll use these files to configure trust in the ECK deployment.
+    8. On the confirmation screen, when prompted **Have you already set up trust from the other environment?**, select **No, I have NOT set up trust from the other environment yet**. Download both the ECH deployment CA certificate and the `trust.yml` file. These files can also be retrieved from **Security** > **Remote connections** on the deployment. You’ll use these files to configure trust in the ECK deployment.
 
 #### Update the downloaded `trust.yml` file for ECK compatibility
 

@@ -33,7 +33,7 @@ To use CCS or CCR, your deployments must meet the following criteria:
   :::{include} _snippets/remote-cluster-certificate-compatibility.md
   :::
 
-* If your deployment was created before February 2021, the **Remote clusters** page in {{kib}} must be enabled manually from the **Security** page of your deployment, by selecting **Enable CCR** under **Trust management**.
+* If your deployment was created before February 2021, the **Remote clusters** page in {{kib}} must be enabled manually from **Security** > **Remote connections** on your deployment, by selecting **Enable CCR** under **Trust management**.
 
 ## Set up remote clusters with {{ech}}