Introduction

Shield is a plugin for Elasticsearch that enables you to easily secure a cluster. With Shield, you can password-protect your data as well as implement more advanced security measures such as encrypting communications, role-based access control, IP filtering, and auditing. This guide describes how to install Shield, configure the security features you need, and interact with your secured cluster.

Shield protects Elasticsearch clusters by:

To prevent unauthorized access to your Elasticsearch cluster, you must have a way to authenticate users. This simply means that you need a way to validate that a user is who they claim to be. For example, you have to make sure only the person named Kelsey Andorra can sign in as the user kandorra. Shield provides a standalone authentication mechanism that enables you to quickly password-protect your cluster. If you’re already using LDAP, Active Directory, or PKI, Shield easily integrates with those systems to perform user authentication.

In many cases, simply authenticating users isn’t enough. You also need a way to control what data users have access to and what tasks they can perform. Shield enables you to authorize users by assigning access privileges to a role, and assigning those roles to users. For example, this role-based access control mechanism enables you to specify that the user kandorra can only perform read operations on the events index and can’t do anything at all with other indices.

Shield also supports IP-based authorization. You can whitelist and blacklist specific IP addresses or subnets to control network-level access to a server.

A critical part of security is keeping confidential data confidential. Elasticsearch has built-in protections against accidental data loss and corruption. However, there’s nothing to stop deliberate tampering or data interception. Shield preserves the integrity of your data by encrypting communications to and from nodes and authenticating messages to verify that they have not been tampered with or corrupted in transit during node-to-node communication. For even greater protection, you can increase the encryption strength and separate client traffic from node-to-node communications.

Keeping a system secure takes vigilance. By using Shield to maintain an audit trail, you can easily see who is accessing your cluster and what they’re doing. By analyzing access patterns and failed attempts to access your cluster, you can gain insights into attempted attacks and data breaches. Keeping an auditable log of the activity in your cluster can also help diagnose operational issues.