﻿---
title: Connect Elastic Cloud Enterprise deployments to an Elastic Cloud organization
description: This section explains how to configure an Elastic Cloud Enterprise (ECE) deployment to connect remotely to clusters belonging to an Elastic Cloud organization...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/ece-remote-cluster-ece-ess
products:
  - Elastic Cloud Enterprise
---

# Connect Elastic Cloud Enterprise deployments to an Elastic Cloud organization
This section explains how to configure an Elastic Cloud Enterprise (ECE) deployment to connect remotely to clusters belonging to an Elastic Cloud organization.
<admonition title="Note about terminology">
  In the case of remote clusters, the Elasticsearch cluster or deployment initiating the connection and requests is often referred to as the **local cluster**, while the Elasticsearch cluster or deployment receiving the requests is referred to as the **remote cluster**.
</admonition>

<note>
  If network security filters are applied to the remote cluster on Elastic Cloud, the remote cluster administrator must configure an [IP filter](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/security/ip-filtering-cloud) to allow connections from the IP addresses (or CIDR ranges) of the local ECE allocator hosts. For more information, refer to [Remote clusters and network security](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters#network-security).
</note>


## Allow the remote connection

Before you start, consider the [security model](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/security-models) that you would prefer to use for authenticating remote connections between clusters, and follow the corresponding steps.
<definitions>
  <definition term="API key">
    For deployments based on Elastic Stack 8.14 or later, you can use an API key to authenticate and authorize cross-cluster operations to a remote cluster. This model uses a dedicated service endpoint, on port `9443` by default, and gives administrators fine-grained control over remote access. The API key is created on the remote cluster and defines the permissions available to all cross-cluster requests, while local user roles can further restrict, but not extend, those permissions.
  </definition>
  <definition term="TLS certificate (deprecated in Elastic Stack 9.0.0)">
    This model uses mutual TLS authentication over the Elasticsearch transport interface for cross-cluster operations. User authentication is performed on the local cluster and a user's role names are passed to the remote cluster for authorization. Because a superuser on the local cluster automatically gains full read access to the remote cluster, this model is only suitable for clusters within the same security domain.
  </definition>
</definitions>

<tab-set>
  <tab-item title="API key">
    Follow these steps to configure the [API key security model](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/security-models#api-key) for remote clusters. If you run into any issues, refer to [Troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/troubleshoot/elasticsearch/remote-clusters).

    ### Prerequisites and limitations

    - The local and remote deployments must be on Elastic Stack 8.14 or later.
    - Contrary to the certificate security model, the API key security model does not require that both local and remote clusters trust each other.


    ### Create a cross-cluster API key on the remote deployment

    - On the deployment you will use as remote, use the [Elasticsearch API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-create-cross-cluster-api-key) or [Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/api-keys/elasticsearch-api-keys) to create a cross-cluster API key. Configure it with access to the indices you want to use for cross-cluster search or cross-cluster replication.
    - Copy the encoded key (`encoded` in the response) to a safe location. You will need it in the next step.


    ### Add the cross-cluster API key to the keystore of the local deployment

    The API key created previously will be used by the local deployment to authenticate with the corresponding set of permissions to the remote deployment. For that, you need to add the API key to the local deployment's keystore.
    1. [Log into the Cloud UI](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui).
    2. On the **Deployments** page, select your deployment.
       Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
    3. From the navigation menu, select **Security**.
    4. Locate **Remote Connections > Trust management > Connections using API keys** and select **Add API key**.
       1. Fill both fields.
       - For the **Remote cluster name**, enter the alias of your choice. You will use this alias to connect to the remote cluster later. It must be lowercase and only contain letters, numbers, dashes and underscores.
    - For the **Cross-cluster API key**, paste the encoded cross-cluster API key.
    2. Click **Add** to save the API key.
    5. Restart the local deployment to reload the new setting. To do that, go to the deployment's main page, locate the **Actions** menu, and select **Restart Elasticsearch**.
       <note>
       If the local deployment runs on version 8.14 or greater, you no longer need to perform this step because the keystore is reloaded automatically with the new API keys.
       </note>

    If you need to update the remote connection with different permissions later, refer to [Change a cross-cluster API key used for a remote connection](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/ece-edit-remove-trusted-environment#edit-remove-trusted-environment-api-key).
  </tab-item>

  <tab-item title="TLS certificate (deprecated)">
    ### Configuring trust with clusters in Elastic CloudA deployment can be configured to trust all or specific deployments from an organization in [Elastic Cloud](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/deploy-manage/deploy/elastic-cloud/cloud-hosted):

    1. From the **Security** menu, select **Remote Connections > Add trusted environment** and select **Elastic Cloud Organization**.
    2. Enter the organization ID (which can be found near the organization name).
    3. Upload the Certificate Authorities of the deployments you want to trust. These can be downloaded from the **Security** page of each deployment (not only the current CA, but also future certificates in case they are expiring soon since they are periodically rotated). Deployments from the same region are signed by the same CA, so you will only need to upload one for each region.
    4. Choose one of following options to configure the level of trust with the Organization:
       - All deployments - This deployment trusts all deployments in the organization in the regions whose certificate authorities have been uploaded, including new deployments when they are created.
    - Specific deployments - Specify which of the existing deployments you want to trust from this organization. The full Elasticsearch cluster ID must be entered for each remote cluster. The Elasticsearch `Cluster ID` can be found in the deployment overview page under **Applications**.
    5. Configure the deployment in Elastic Cloud to [trust this deployment](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/ec-remote-cluster-ece#ec-trust-ece), so that both deployments are configured to trust each other.
    Note that the organization ID and cluster IDs must be entered fully and correctly. For security reasons, no verification of the IDs is possible. If cross-environment trust does not appear to be working, double-checking the IDs is a good place to start.
    <dropdown title="Using the API">
      You can update a deployment using the appropriate trust settings for the Elasticsearch payload.In order to trust a deployment with cluster id `cf659f7fe6164d9691b284ae36811be1` (NOTE: use the Elasticsearch cluster ID, not the deployment ID) in an organization with organization ID `803289842`, you need to update the trust settings with an additional direct trust relationship like this:
      ```json
      {
        "trust":{
          "accounts":[
            {
               "account_id":"ec38dd0aa45f4a69909ca5c81c27138a",
               "trust_all":true
            }
          ],
          "direct": [
            {
              "type" : "ESS",
              "name" : "My Organization",
              "scope_id" : "803289842",
              "certificates" : [
                  {
                      "pem" : "-----BEGIN CERTIFICATE-----\nMIIDTzCCA...H0=\n-----END CERTIFICATE-----"
                  }
               ],
               "trust_all":false,
               "trust_allowlist":[
                  "cf659f7fe6164d9691b284ae36811be1"
               ]
             }
          ]
        }
      }
      ```
    </dropdown>
  </tab-item>
</tab-set>

You can now connect remotely to the trusted clusters.

## Connect to the remote cluster

On the local cluster, add the remote cluster using Kibana or the Elasticsearch API.
<note>
  This configuration of remote clusters uses the [Proxy mode](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/remote-clusters-self-managed#proxy-mode) and requires the ECE allocators to be able to connect to the remote address endpoint.
</note>


### Using Kibana

1. Go to the **Remote Clusters** management page in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4251/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select **Add a remote cluster**.
3. In **Select connection type**, choose the authentication mechanism you prepared earlier (**API keys** or **Certificates**), and then click **Next**.
4. In **Add connection information**, fill in the following fields:
   - **Remote cluster name**: This *cluster alias* is a unique identifier that represents the connection to the remote cluster and is used to distinguish local and remote indices.
  When using API key authentication, this alias must match the **Remote cluster name** you configured when adding the API key in the Cloud UI.
- **Remote address**: This value can be found on the **Security** page of the Elastic Cloud Hosted deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
  <note>
  If you’re using API keys as security model, change the port to `9443`.
  </note>
- **Configure advanced options** (optional): Expand this section if you need to customize additional settings.
  - **TLS server name**: Specify a value if the certificate presented by the remote cluster is signed for a different name than the remote address.
  This value can be found on the **Security** page of the Elastic Cloud Hosted deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
- **Socket connections**: Define the number of connections to open with the remote cluster.
   For a full list of available client connection settings, refer to the [remote cluster settings reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/configuration-reference/remote-clusters#remote-cluster-proxy-settings).
5. Click **Next**.
6. In **Confirm setup**, click **Add remote cluster** (you have already established trust in a previous step).


### Using the Elasticsearch API

To configure a deployment as a remote cluster, use the [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). Configure the following fields:
- `Remote cluster alias`: When using API key authentication, the cluster alias must match the one you configured when adding the API key in the Cloud UI as **Remote cluster name**.
- `mode`: `proxy`
- `proxy_address`: This value can be found on the **Security** page of the Elastic Cloud Hosted deployment you want to use as a remote. Copy the **Proxy address** from the **Remote cluster parameters** section.
  Using the API, this value can be obtained from the Elasticsearch resource info, concatenating the field `metadata.endpoint` and port `9400` using a semicolon.
  <note>
  If you’re using API keys as security model, change the port to `9443`.
  </note>
- `server_name`: This value can be found on the **Security** page of the Elastic Cloud Hosted deployment you want to use as a remote. Copy the **Server name** from the **Remote cluster parameters** section.
  Using the API, this can be obtained from the Elasticsearch resource info field `metadata.endpoint`.

This example shows the API call to add or update a remote cluster. The alias `alias-for-my-remote-cluster` must match the remote cluster name used when adding the API key to the deployment:
```json
PUT /_cluster/settings
{
  "persistent": {
    "cluster": {
      "remote": {
        "alias-for-my-remote-cluster": {
          "mode":"proxy",
          "proxy_address": "<REMOTE_CLUSTER_ADDRESS>:9443",
          "server_name": "<REMOTE_CLUSTER_SERVER_NAME>"
        }
      }
    }
  }
}
```

For a full list of available client connection settings in proxy mode, refer to the [remote cluster settings reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/configuration-reference/remote-clusters#remote-cluster-proxy-settings).

## Configure roles and users

If you're using the API key based security model, to use a remote cluster for cross-cluster replication or cross-cluster search, you need to create user roles with [remote indices privileges](/elastic/docs-content/pull/4251/deploy-manage/users-roles/cluster-or-deployment-auth/role-structure#roles-remote-indices-priv) on the local cluster. Refer to [Configure roles and users](/elastic/docs-content/pull/4251/deploy-manage/remote-clusters/remote-clusters-api-key#remote-clusters-privileges-api-key).