Secure communication with the Elastic Stack

Use role-based access control or API keys to grant APM Server users access to secured resources.

After privileged users have been created, use authentication to connect to a secured Elastic cluster.

For secure communication between APM Server and APM Agents, see With APM agents.

A reference of all available SSL configuration settings is also available.

APM Server exposes an HTTP endpoint, and as with anything that opens ports on your servers, you should be careful about who can connect to it. Firewall rules are recommended to ensure only authorized systems can connect.

You can use role-based access control to grant users access to secured resources. The roles that you set up depend on your organization’s security requirements and the minimum privileges required to use specific features.

Typically, you need to create the following separate roles:

Elasticsearch security features provides built-in roles that grant a subset of the privileges needed by APM users. When possible, assign users the built-in roles to minimize the affect of future changes on your security strategy. If no built-in role is available, you can assign users the privileges needed to accomplish a specific task. In general, there are three types of privileges you’ll work with: