﻿---
title: Security
description: An Elastic implementation comprises many moving parts: Elasticsearch nodes forming the cluster, Kibana instances, additional stack components such as...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elasticsearch
  - Kibana
---

# Security
An Elastic implementation comprises many moving parts: Elasticsearch nodes forming the cluster, Kibana instances, additional stack components such as Logstash and Beats, and various clients and integrations, all communicating with your cluster.
To keep your data secured, Elastic offers security features that prevent bad actors from tampering with your data, and encrypt communications to, from, and within your cluster. Regardless of your deployment type, Elastic sets up certain security features for you automatically.
The availability and configurability of security features vary by deployment type. On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model. You can also review a [comparison table](#comparison-table) showing feature availability and configurability by deployment type.
<note>
  As part of your overall security strategy, you can also do the following:
  - Prevent unauthorized access with [password protection and role-based access control](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/users-roles).
  - Control access to dashboards and other saved objects in your UI using [Spaces](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/manage-spaces).
  - Connect a local cluster to a [remote cluster](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/remote-clusters) to enable [cross-cluster replication](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/tools/cross-cluster-replication) and [cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/solutions/search/cross-cluster-search).
  - Manage [API keys](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/api-keys) used for programmatic access to Elastic.
</note>


## Managed security in Elastic Cloud

```yaml
deployment:
  ess: all
serverless: all
```

Elastic Cloud has built-in security. For example, HTTPS communications between Elastic Cloud and the internet, as well as inter-node communications, are secured automatically, and cluster data is encrypted at rest.
In both Elastic Cloud Hosted and Elastic Cloud Serverless, you can also configure [IP filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-cloud) to prevent unauthorized access to your deployments and projects.
In Elastic Cloud Hosted, you can augment these security features in the following ways:
- [Configure private connectivity and apply VPC filtering](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/private-connectivity) to establish a secure connection for your Elastic Cloud deployments to communicate with other cloud services, and restrict traffic to deployments based on those private connections.
- Encrypt your deployment with a [customer-managed encryption key](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key).
- [Secure your settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-settings) using Elasticsearch and Kibana keystores.
- Use the list of [Elastic Cloud static IPs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/elastic-cloud-static-ips) to allow or restrict communications in your infrastructure.

Elastic Cloud Hosted doesn't support custom SSL certificates, which means that a custom CNAME for an Elastic Cloud Hosted endpoint such as *mycluster.mycompanyname.com* also is not supported.
Refer to [Elastic Cloud security](https://www.elastic.co/cloud/security) for more details about Elastic security and privacy programs.
<note>
  Serverless projects are fully managed and secured by Elastic, and do not have any configurable Security features at the project level.
</note>


## Securing your orchestrator

```yaml
deployment:
  ece: all
  eck: all
```

When running Elastic Stack applications on Elastic Cloud Enterprise or Elastic Cloud on Kubernetes, you must also secure the [orchestration layer](/elastic/docs-content/pull/4284/deploy-manage/deploy#who-manages-the-infrastructure) responsible for deploying and managing your Elastic products.
Learn about securing the following components:
- [An Elastic Cloud Enterprise installation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation)
- [An Elastic Cloud on Kubernetes operator](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-your-eck-installation)

<tip>
  Elastic secures your [Elastic Cloud](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/deploy/elastic-cloud) orchestrator for you.
</tip>


## Cluster or deployment security features

```yaml
deployment:
  ece: all
  eck: all
  ess: all
  self: all
```

You can configure the following aspects of your Elastic cluster or deployment to maintain and enhance security:

### Initial security setup

Elasticsearch security features unlock key capabilities such as [authentication and authorization](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/users-roles), TLS encryption, and other security-related functionality described in this section. The first step in securing your deployment is to ensure that the Elasticsearch security features are enabled and properly configured.
For self-managed deployments, security features are automatically configured when possible. To learn about the automatic configuration process, the cases where automatic configuration might be skipped, and how to manually configure security, refer to [Set up security in self-managed deployments](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/self-setup).
<tip>
  If you want to use your own TLS certificates, then you should manually configure security.
</tip>

Deployments managed by Elastic Cloud on Kubernetes, Elastic Cloud Enterprise, Elastic Cloud Hosted, as well as Elastic Cloud Serverless projects, automatically configure security by default. This includes setting the `elastic` user password, generating TLS certificates, and configuring Kibana to connect to Elasticsearch securely. Disabling security is not supported in these deployment types.

### Communication and network security

- [Manage TLS certificates](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-cluster-communications): TLS certificates apply security controls to network communications. Elastic uses TLS certificates to secure communications in two places:
  - **The HTTP layer**: Used for communication between your cluster or deployment and the internet.
- **The transport layer**: Used mainly for inter-node communications, and in certain cases for cluster to cluster communication.
- In self-managed Elasticsearch clusters, you can also [Configure Kibana and Elasticsearch to use mutual TLS](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-es-mutual-tls).
- [Enable cipher suites for stronger encryption](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/enabling-cipher-suites-for-stronger-encryption): The TLS and SSL protocols use a cipher suite that determines the strength of encryption used to protect the data. You may want to enable the use of additional cipher suites, so you can use different cipher suites for your TLS communications or communications with authentication providers.
- [Add network security policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/network-security): Network security allows you to limit how your deployments can be accessed. Add another layer of security to your installation and deployments by restricting inbound traffic to only the sources that you trust. In both Elastic Cloud Hosted deployments and Serverless projects, you can restrict access based on IP addresses or CIDR ranges. In Elastic Cloud Hosted deployments, you can secure connectivity through AWS PrivateLink, Azure Private Link, or GCP Private Service Connect and filter traffic using VPC filters.
- [Allow or deny Elastic Cloud Hosted IP ranges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/elastic-cloud-static-ips): Elastic Cloud publishes a list of IP addresses used by its Elastic Cloud Hosted services for both incoming and outgoing traffic. Users can use these lists to configure their network firewalls as needed to allow or restrict traffic related to Elastic Cloud Hosted services.


### Data security

- [Secure your settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-settings): Some of the settings that you configure in Elastic are sensitive, such as passwords, and relying on file system permissions to protect these settings is insufficient. Learn how to configure secure settings in the Elasticsearch keystore or Kibana keystore.
- [Secure saved objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-saved-objects): Kibana stores entities such as dashboards, visualizations, alerts, actions, and advanced settings as saved objects, which are kept in a dedicated, internal Elasticsearch index. If such an object includes sensitive information, for example a PagerDuty integration key or email server credentials used by the alert action, Kibana encrypts it and makes sure it cannot be accidentally leaked or tampered with. You can configure and rotate the saved object encryption key for additional security.
- [Encrypt data at rest](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/data-security): By default, Elastic Cloud already encrypts your Elastic Cloud Hosted deployment data, Serverless project data, and snapshots at rest. If you’re using ECH, then you can reinforce this mechanism by providing your own encryption key, also known as [Bring Your Own Key (BYOK)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key).
  <note>
  Other deployment types don’t implement encryption at rest out of the box. For self-managed clusters, to implement encryption at rest, the hosts running the cluster must be configured with disk-level encryption, such as `dm-crypt`. In addition, snapshot targets must ensure that data is encrypted at rest as well.Configuring `dm-crypt` or similar technologies is outside the scope of this documentation, and issues related to disk encryption are outside the scope of support.
  </note>


### User session security

[Manage Kibana sessions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-session-management) to control the timeout and lifespan of logged-in sessions to Kibana, as well as the number of concurrent sessions each user can have.

### Security event audit logging

Audit logging is a powerful feature that helps you monitor and track security-related events within the Elastic Stack. By enabling audit logs, you can gain visibility into authentication attempts, authorization decisions, and other system activity.
Audit logging also provides forensic evidence in the event of an attack, and can be enabled independently for Elasticsearch and Kibana.
[Learn how to enable audit logging](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/logging-configuration/security-event-audit-logging).

### Security features by deployment type

Security feature availability varies by deployment type, with each feature having one of the following statuses:

| Status                         | Description                                                                   |
|--------------------------------|-------------------------------------------------------------------------------|
| **Fully managed**Fully managed | Handled automatically by Elastic with no user configuration needed            |
| **Managed**Managed             | Handled automatically by Elastic, but certain configuration allowed           |
| **Configurable**Configurable   | Built-in feature that needs your configuration (like IP filters or passwords) |
| **N/A**N/A                     | Not available for this deployment type                                        |

Select your deployment type below to see what's available and how implementation responsibilities are distributed:
<tab-set>
  <tab-item title="ECH">
    | Category                       | Security feature                       | Status        | Notes                                                                                                                                                                                                                   |
    |--------------------------------|----------------------------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    | **Communication**Communication | TLS (HTTP layer)                       | Fully managed | Automatically configured by Elastic                                                                                                                                                                                     |
    |                                | TLS (Transport layer)                  | Fully managed | Automatically configured by Elastic                                                                                                                                                                                     |
    | **Network**Network             | IP filtering                           | Configurable  | [Configure IP-based access restrictions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-cloud)Configure IP-based access restrictions                            |
    |                                | Private connectivity and VPC filtering | Configurable  | [Establish a secure VPC connection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/private-connectivity)Establish a secure VPC connection                                    |
    |                                | Kubernetes network policies            | N/A           |                                                                                                                                                                                                                         |
    | **Data**Data                   | Encryption at rest                     | Managed       | You can [bring your own encryption key](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key)bring your own encryption key |
    |                                | Secure settings                        | Configurable  | [Configure secure settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-settings)Configure secure settings                                                         |
    |                                | Saved object encryption                | Fully managed | Automatically encrypted by Elastic                                                                                                                                                                                      |
    | **User session**User session   | Kibana sessions                        | Configurable  | [Customize session parameters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-session-management)Customize session parameters                                         |
  </tab-item>

  <tab-item title="Serverless">
    | Category                       | Security feature                       | Status        | Notes                                                                                                                                                                                        |
    |--------------------------------|----------------------------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    | **Communication**Communication | TLS (HTTP layer)                       | Fully managed | Automatically configured by Elastic                                                                                                                                                          |
    |                                | TLS (Transport layer)                  | Fully managed | Automatically configured by Elastic                                                                                                                                                          |
    | **Network**Network             | IP filtering                           | Configurable  | [Configure IP-based access restrictions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-cloud)Configure IP-based access restrictions |
    |                                | Private connectivity and VPC filtering | N/A           |                                                                                                                                                                                              |
    |                                | Kubernetes network policies            | N/A           |                                                                                                                                                                                              |
    | **Data**Data                   | Encryption at rest                     | Fully managed | Automatically encrypted by Elastic                                                                                                                                                           |
    |                                | Secure settings                        | N/A           |                                                                                                                                                                                              |
    |                                | Saved object encryption                | Fully managed | Automatically encrypted by Elastic                                                                                                                                                           |
    | **User session**User session   | Kibana sessions                        | Fully managed | Automatically configured by Elastic                                                                                                                                                          |
  </tab-item>

  <tab-item title="ECE">
    | Category                       | Security feature                       | Status        | Notes                                                                                                                                                                                                                                          |
    |--------------------------------|----------------------------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    | **Communication**Communication | TLS (HTTP layer)                       | Managed       | You can [configure custom certificates](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates)configure custom certificates |
    |                                | TLS (Transport layer)                  | Fully managed | Automatically configured by Elastic                                                                                                                                                                                                            |
    | **Network**Network             | IP filtering                           | Configurable  | [Configure IP-based access restrictions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-cloud)Configure IP-based access restrictions                                                   |
    |                                | Private connectivity and VPC filtering | N/A           |                                                                                                                                                                                                                                                |
    |                                | Kubernetes network policies            | N/A           |                                                                                                                                                                                                                                                |
    | **Data**Data                   | Encryption at rest                     | N/A           |                                                                                                                                                                                                                                                |
    |                                | Secure settings                        | Configurable  | [Configure secure settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-settings)Configure secure settings                                                                                |
    |                                | Saved object encryption                | Configurable  | [Enable encryption for saved objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-saved-objects)Enable encryption for saved objects                                                       |
    | **User session**User session   | Kibana sessions                        | Configurable  | [Customize session parameters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-session-management)Customize session parameters                                                                |
  </tab-item>

  <tab-item title="ECK">
    | Category                       | Security feature                       | Status       | Notes                                                                                                                                                                                        |
    |--------------------------------|----------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    | **Communication**Communication | TLS (HTTP layer)                       | Managed      | [Multiple options](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/k8s-https-settings)Multiple options for customization                           |
    |                                | TLS (Transport layer)                  | Managed      | [Multiple options](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/k8s-transport-settings)Multiple options for customization                       |
    | **Network**Network             | IP filtering                           | Configurable | [Configure IP-based access restrictions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-basic)Configure IP-based access restrictions |
    |                                | Private connectivity and VPC filtering | N/A          |                                                                                                                                                                                              |
    |                                | Kubernetes network policies            | Configurable | [Apply network policies to your Pods](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/k8s-network-policies)Apply network policies to your Pods     |
    | **Data**Data                   | Encryption at rest                     | N/A          |                                                                                                                                                                                              |
    |                                | Secure settings                        | Configurable | [Configure secure settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/k8s-secure-settings)Configure secure settings                          |
    |                                | Saved object encryption                | Configurable | [Enable encryption for saved objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-saved-objects)Enable encryption for saved objects     |
    | **User session**User session   | Kibana sessions                        | Configurable | [Customize session parameters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-session-management)Customize session parameters              |
  </tab-item>

  <tab-item title="Self-managed">
    | Category                       | Security feature                       | Status       | Notes                                                                                                                                                                                                 |
    |--------------------------------|----------------------------------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    | **Communication**Communication | TLS (HTTP layer)                       | Configurable | Can be automatically or manually configured. See [Initial security setup](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/self-setup)Initial security setup |
    |                                | TLS (Transport layer)                  | Configurable | Can be automatically or manually configured. See [Initial security setup](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/self-setup)Initial security setup |
    | **Network**Network             | IP filtering                           | Configurable | [Configure IP-based access restrictions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/ip-filtering-basic)Configure IP-based access restrictions          |
    |                                | Private connectivity and VPC filtering | N/A          |                                                                                                                                                                                                       |
    |                                | Kubernetes network policies            | N/A          |                                                                                                                                                                                                       |
    | **Data**Data                   | Encryption at rest                     | N/A          |                                                                                                                                                                                                       |
    |                                | Keystore security                      | Configurable | [Configure secure settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-settings)Configure secure settings                                       |
    |                                | Saved object encryption                | Configurable | [Enable encryption for saved objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-saved-objects)Enable encryption for saved objects              |
    | **User session**User session   | Kibana sessions                        | Configurable | [Customize session parameters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/kibana-session-management)Customize session parameters                       |
  </tab-item>
</tab-set>


## Securing other Elastic Stack components

The Elasticsearch security features enable you to secure your Elasticsearch cluster. However, for a complete security strategy, you must secure other applications in the Elastic Stack, as well as communications between Elasticsearch and other Elastic Stack components.
[Review security topics for other Elastic Stack components](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/secure-clients-integrations).

## Securing clients and integrations

If you use HTTP clients or integrations to communicate with Elasticsearch, then you also need to [secure communications between the clients or integrations and Elasticsearch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/httprest-clients-security).

## Security limitations

There are security limitations that apply to the usage of some Elasticsearch features or resources. Depending on your organization's security requirements, you might want to restrict, adjust, or find workaround or alternatives for some of these features and resources.
[Review Elasticsearch security limitations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4284/deploy-manage/security/limitations).