Skip to content

Commit ffe0f2b

Browse files
authored
traffic filters > network security: file renames and xlinks (#2047)
1 parent 2a29cb9 commit ffe0f2b

37 files changed

+226
-206
lines changed

deploy-manage/_snippets/ecloud-security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
In both {{ech}} and {{serverless-full}}, you can also configure [IP filters](/deploy-manage/security/ip-filtering-cloud.md) to prevent unauthorized access to your deployments and projects.
44

55
In {{ech}}, you can augment these security features in the following ways:
6-
* [Configure private connectivity and apply VPC filtering](/deploy-manage/security/traffic-filtering.md) to establish a secure connection for your {{ecloud}} deployments to communicate with other cloud services, and restrict traffic to deployments based on those private connections.
6+
* [Configure private connectivity and apply VPC filtering](/deploy-manage/security/private-connectivity.md) to establish a secure connection for your {{ecloud}} deployments to communicate with other cloud services, and restrict traffic to deployments based on those private connections.
77
* Encrypt your deployment with a [customer-managed encryption key](/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md).
88
* [Secure your settings](/deploy-manage/security/secure-settings.md) using {{es}} and {{kib}} keystores.
99
* Use the list of [{{ecloud}} static IPs](/deploy-manage/security/elastic-cloud-static-ips.md) to allow or restrict communications in your infrastructure.

deploy-manage/deploy/cloud-enterprise/working-with-deployments.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ From the deployment main page, you can quickly access the following configuratio
5757
From the **Deployment > Security** view, you can manage security settings, authentication, and access controls. Refer to [Secure your clusters](../../../deploy-manage/users-roles/cluster-or-deployment-auth.md) for more details on security options for your deployments.
5858

5959
* [Reset the `elastic` user password](../../users-roles/cluster-or-deployment-auth/manage-elastic-user-cloud.md)
60-
* [Set up traffic filters](../../security/traffic-filtering.md) to restrict traffic to your deployment
60+
* [Set up IP filters](../../security/ip-filtering-ece.md) to restrict traffic to your deployment
6161
* Configure {{es}} keystore settings, also known as [secure settings](../../security/secure-settings.md)
6262
* Configure trust relationships for [remote clusters](../../remote-clusters/ece-enable-ccs.md)
6363

deploy-manage/deploy/elastic-cloud/azure-native-isv-service.md

Lines changed: 8 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ Check the following sections to learn more about the Azure Native ISV Service:
103103
* **Troubleshooting**
104104

105105
* [I receive an error message about not having required authorization.](#azure-integration-authorization-access)
106-
* [My {{ecloud}} deployment creation failed.](#azure-integration-deployment-failed-traffic-filter)
106+
* [My {{ecloud}} deployment creation failed.](#azure-integration-deployment-failed-network-security)
107107
* [I can’t SSO into my {{ecloud}} deployment.](#azure-integration-failed-sso)
108108
* [I see some deployments in the {{ecloud}} console but not in the Azure Portal.](#azure-integration-cant-see-deployment)
109109
* [My {{ecloud}} Azure Native ISV Service logs are not being ingested.](#azure-integration-logs-not-ingested)
@@ -319,18 +319,7 @@ $$$azure-integration-how-to-access$$$How can I access my {{ecloud}} deployment?
319319

320320

321321
$$$azure-integration-modify-deployment$$$How can I modify my {{ecloud}} deployment?
322-
: Modify your {{ecloud}} deployment in the {{ecloud}} console, which is accessed from the Azure UI through the **Advanced Settings** link on the deployment overview page. In the {{ecloud}} console you can perform a number of actions against your deployment, including:
323-
324-
* [Re-size](ec-customize-deployment-components.md) to increase or decrease the amount of RAM, CPU, and storage available to your deployment, or to add additional availability zones.
325-
* [Upgrade](../../upgrade/deployment-or-cluster.md) your deployment to a new {{stack}} version.
326-
* Enable or disable individual {{stack}} components such as APM and Machine Learning.
327-
* [Update {{stack}} user settings](edit-stack-settings.md) in the component YML files.
328-
* [Add or remove custom plugins](add-plugins-extensions.md).
329-
* [Configure IP filtering](../../security/traffic-filtering.md).
330-
* [Monitor your {{ecloud}} deployment](../../monitor/stack-monitoring/ece-ech-stack-monitoring.md) to ensure it remains healthy.
331-
* Add or remove API keys to use the [REST API](cloud://reference/cloud-hosted/ec-api-restful.md).
332-
* [And more](cloud-hosted.md)
333-
322+
: Modify your {{ecloud}} deployment in the {{ecloud}} console, which is accessed from the Azure UI through the **Advanced Settings** link on the deployment overview page. In the {{ecloud}} console you can perform [a number of actions against your deployment](/deploy-manage/deploy/elastic-cloud/cloud-hosted.md#ec_how_to_operate_elasticsearch_service).
334323

335324
$$$azure-integration-delete-deployment$$$How can I delete my {{ecloud}} deployment?
336325
: Delete the deployment directly from the Azure console. The delete operation performs clean-up activities in the Elastic console to ensure any running components are removed, so that no additional charges occur.
@@ -349,7 +338,7 @@ $$$azure-integration-monitor$$$How do I monitor my existing Azure services?
349338

350339

351340
::::{note}
352-
If you want to send platform logs to a deployment that has [IP or Private Link traffic filters](../../security/traffic-filtering.md) enabled, then you need to contact [the Elastic Support Team](#azure-integration-support) to perform additional configurations. Refer support to the article [Azure++ Resource Logs blocked by Traffic Filters](https://support.elastic.co/knowledge/18603788).
341+
If you want to send platform logs to a deployment that has [network security policies](/deploy-manage/security/network-security.md) applied, then you need to contact [the Elastic Support Team](#azure-integration-support) to perform additional configurations. Refer support to the article [Azure++ Resource Logs blocked by Traffic Filters](https://support.elastic.co/knowledge/18603788).
353342

354343
::::
355344

@@ -462,7 +451,7 @@ $$$azure-integration-authorization-access$$$I receive an error message about not
462451
Elastic is not currently integrated with Azure user management, so sharing deployment resources through the Cloud console with other Azure users is not possible. However, sharing direct access to these resources is possible. For details, check [Is the {{ecloud}} Azure Native ISV Service connected with Azure user management?](#azure-integration-azure-user-management).
463452

464453

465-
$$$azure-integration-deployment-failed-traffic-filter$$$My {{ecloud}} deployment creation failed.
454+
$$$azure-integration-deployment-failed-network-security$$$My {{ecloud}} deployment creation failed.
466455
: When creating a new {{ecloud}} deployment, the deployment creation may fail with a `Your deployment failed` error. The process results with a status message such as:
467456

468457
```txt
@@ -477,20 +466,15 @@ $$$azure-integration-deployment-failed-traffic-filter$$$My {{ecloud}} deployment
477466
]
478467
```
479468

480-
One possible cause of a deployment creation failure is the default traffic filtering rules. Deployments fail to create if a previously created traffic filter has enabled the **Include by default** option. When this option is enabled, traffic to the deployment is blocked, including traffic that is part of the {{ecloud}} Azure Native ISV Service. As a result, some of the integration components are not successfully provisioned and the deployment creation fails.
469+
One possible cause of a deployment creation failure is the default network security policies. Deployments fail to create if a previously created network security policy has enabled the **Include by default** option. When this option is enabled, traffic to the deployment is blocked, including traffic that is part of the {{ecloud}} Azure Native ISV Service. As a result, some of the integration components are not successfully provisioned and the deployment creation fails.
481470

482471
Follow these steps to resolve the problem:
483472

484473
1. Login to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body).
485-
2. Go to the [Traffic filters page](https://cloud.elastic.co/deployment-features/traffic-filters).
474+
2. Go to the [Network security page](https://cloud.elastic.co/deployment-features/traffic-filters).
486475
3. Edit the traffic filter and disable the **Include by default** option.
487-
488-
:::{image} /deploy-manage/images/cloud-ec-marketplace-azure-traffic-filter-option.png
489-
:alt: The Include by default option under Add to Deployments on the Traffic Filter page
490-
:::
491-
492476
4. In Azure, create a new {{ecloud}} deployment.
493-
5. After the deployment has been created successfully, go back to the [Traffic filters page](https://cloud.elastic.co/deployment-features/traffic-filters) in {{ecloud}} and re-enable the **Include by default** option.
477+
5. After the deployment has been created successfully, go back to the [Network security page](https://cloud.elastic.co/deployment-features/traffic-filters) in {{ecloud}} and re-enable the **Include by default** option.
494478

495479

496480
If your deployment still does not create successfully, [contact the Elastic Support Team](#azure-integration-support) for assistance.
@@ -511,7 +495,7 @@ Mimicking this metadata by manually adding tags to an {{ecloud}} deployment will
511495

512496
$$$azure-integration-logs-not-ingested$$$My {{ecloud}} Azure Native ISV Service logs are not being ingested.
513497
: * When you set up monitoring for your Azure services, if your Azure and Elastic resources are in different subscriptions, you need to make sure that the `Microsoft.Elastic` resource provider is registered in the subscription in which the Azure resources exist. Check [How do I monitor my existing Azure services?](#azure-integration-monitor) for details.
514-
* If you are using [IP or Private Link traffic filters](../../security/traffic-filtering.md), reach out to [the Elastic Support Team](#azure-integration-support).
498+
* If you are using [network security policies](/deploy-manage/security/network-security.md), reach out to [the Elastic Support Team](#azure-integration-support).
515499

516500

517501

deploy-manage/deploy/elastic-cloud/ec-customize-deployment-components.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ Refer to [Manage your Integrations Server](manage-integrations-server.md) to lea
129129

130130
## Security [ec_security]
131131

132-
Here, you can configure features that keep your deployment secure: reset the password for the `elastic` user, set up traffic filters, and add settings to the {{es}} keystore. You can also set up remote connections to other deployments.
132+
Here, you can configure features that keep your deployment secure: reset the password for the `elastic` user, set up network security, and add settings to the {{es}} keystore. You can also set up remote connections to other deployments.
133133

134134

135135
## Actions [ec_actions]

deploy-manage/deploy/elastic-cloud/heroku.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ You might want to add more layers of security to your deployment, such as:
8282

8383
* Add more users to the deployment with third-party authentication providers and services like [SAML](../../users-roles/cluster-or-deployment-auth/saml.md), [OpenID Connect](../../users-roles/cluster-or-deployment-auth/openid-connect.md), or [Kerberos](../../users-roles/cluster-or-deployment-auth/kerberos.md).
8484
* Do not use clients that only support HTTP to connect to {{ecloud}}. If you need to do so, you should use a reverse proxy setup.
85-
* Create [traffic filters](../../security/traffic-filtering.md) and apply them to your deployments.
85+
* Create [network security policies](/deploy-manage/security/network-security.md) and apply them to your deployments.
8686
* If needed, you can [reset](../../users-roles/cluster-or-deployment-auth/built-in-users.md) the `elastic` password.
8787

8888
### Scale or adjust your deployment [echscale_or_adjust_your_deployment]

0 commit comments

Comments
 (0)