It is time to say goodbye: This version of Elastic Cloud Enterprise has reached end-of-life (EOL) and is no longer supported.
The documentation for this version is no longer being maintained. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Configure role-based access control
editConfigure role-based access control
editThis functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
Role-based access control (RBAC) provides a way to add multiple users and restrict their access to specific platform resources. In addition to the system admin and readonly users, you can utilize pre-built roles to control access to platform operations, deployment assets, or API calls.
Implementing RBAC in your environment benefits you in several ways:
- Streamlines the process of assigning or updating privileges for users as a group, instead of painstakingly managing individual users.
- Limits access to just what’s needed for that user’s job function, isolating company assets.
- Assists with compliance to security and data standards or laws.
- Adds multiple users by creating native users locally and integrating with third-party authentication providers like LDAP or SAML.
Before you begin
editTo prepare for RBAC, you should review the Elastic Cloud Enterprise limitations and known issues.
Available roles and permissions
editBeyond the system users, there are several pre-built roles that you can apply to additional users:
- Platform admin
-
Same access as the
adminsystem user. - Platform viewer
-
Same access as the
readonlysystem user, which includes being able to view secret and sensitive settings. - Deployment manager
-
Can create and manage non-system deployments, specify keystore security settings, and establish cross-cluster remote relationships. They can also reset the
elasticpassword. - Deployment viewer
- Can view non-system deployments, including their activity. Can prepare the diagnostic bundle, inspect the files, and download the bundle as a ZIP file.
Create security deployment
editThe security deployment is a system deployment that manages all of the Elastic Cloud Enterprise authentication and permissions.
We strongly recommend using three availability zones with at least 1 GB Elasticsearch nodes. You can scale up if you expect a heavy authentication workload.
- Log into the Cloud UI.
-
Click Create security deployment.
If you are not prompted to create a security deployment, you can go to Platform and then Settings.
- Configure regular snapshots of the deployment. This is critical if you plan to create any native users.
- Optional: Enable monitoring on the security deployment to a dedicated monitoring deployment.
Change the order of provider profiles
editElastic Cloud Enterprise performs authentication checks against the configured providers, in order. When a match is found, the user search stops. The roles specified by that first profile match dictate which permissions the user is granted—regardless of what permissions might be available in another, later profile.
To change the provider order:
- Log into the Cloud UI.
- Go to Users and then Authentication providers.
- Use the carets to update the provider order.
Changing the order is a configuration change and you can’t make changes to other providers until it is complete.
Disable RBAC
editIf you need to disable RBAC for any reason, you can, but be aware that native users and third-party authenticated users won’t be able to access Elastic Cloud Enterprise anymore. Only the original system users can access the platform.
- Log into the Cloud UI.
- Go to Platform and then Settings.
- Click Disable RBAC and confirm.
If you need to enable it again later, you can do so from the same place.