Securing Kibana and ElasticSearch without X-Pack-Security plugin

Question

A customer integrated the ELK stack into their application. If they run their own ES cluster, or use the managed service provided by elastic.co, they can lock down access to Kibana and ES using the X-Pack-Security plugin.

They're aware of the approach outlined in https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/, but want to avoid the need to run a proxy to handle authentication between Kibana & ES.

Do we have any alternative suggestion?

Accepted Answer

Rather than use a proxy server that is allowed access via IP which requires you running an extra instance, you can enable IAM access and use the [aws-es-kibana proxy][1] which runs locally on the client and uses the clients IAM credentials to do the SigV4 signing. Here's [another local proxy][2] that supports IAM roles which the first one I mentioned doesn't.

[1]: https://github.com/santthosh/aws-es-kibana
  [2]: https://github.com/abutaha/aws-es-proxy

Securing Kibana and ElasticSearch without X-Pack-Security plugin

Relevant content