คีย์เอพีไอและบันทึกการตรวจสอบ

Applications should not authenticate with a human's username and password. Elasticsearch provides API keys: scoped, revocable credentials ideal for services. Pair them with audit logging to track every security-relevant action.

An API key is a credential tied to a set of permissions, with an optional expiration. It can be limited to a subset of the creating user's privileges, following the principle of least privilege.

Use the create API key endpoint. The response includes an id and api_key value shown only once, so store it securely.

Attach role_descriptors to limit what the key can do, even if the creating user has more power. Here the key may only read one index.

Send the base64-encoded id:api_key pair in the Authorization header with the ApiKey scheme.

Compromised or retired keys are invalidated immediately, without changing any user's password. You can revoke by id, by name, or all keys owned by a user.

Audit logs answer the compliance question: who did what, when, and from where. They record authentication attempts, access grants and denials, and configuration changes.

Audit logging is turned on in elasticsearch.yml. It is disabled by default because it generates significant volume.

Tune which events are captured with include/exclude lists to avoid drowning in noise. Common choices keep access_denied and authentication_failed while dropping routine reads.

Audit events are written as structured JSON to a dedicated log file. Each line includes the event type, user, client IP, request path, and outcome, making it easy to ship into Kibana for analysis.

Rotate API keys regularly, scope them tightly, store the audit log on durable storage separate from the cluster, and alert on repeated authentication_failed events that may signal an attack.

Test your understanding of API keys.

You learned to secure access and accountability:

• API keys are scoped, expiring, revocable credentials for applications.
• Use role_descriptors to enforce least privilege.
• Audit logging records who did what, when, and from where.
• Filter audit events to manage volume and alert on failed authentications.