API key management in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an API key in Elasticsearch?

An API key in Elasticsearch is a unique token that allows secure access to the Elasticsearch cluster without using a username and password. It acts like a special password for applications.

beginner

How do you create an API key in Elasticsearch?

You create an API key by sending a POST request to the _security/api_key endpoint with details like the name and permissions. Elasticsearch returns the key ID and the API key string.

intermediate

What is the purpose of API key expiration in Elasticsearch?

API key expiration sets a time limit on how long the key is valid. This helps improve security by automatically disabling keys after a set period, reducing risk if a key is lost or stolen.

intermediate

How can you invalidate an API key in Elasticsearch?

You invalidate an API key by sending a DELETE request to the _security/api_key endpoint with the key ID or name. This immediately revokes the key's access.

beginner

Why is it better to use API keys instead of user passwords for applications?

API keys are better because they can be limited in scope and time, making them safer. They avoid exposing user passwords and can be easily revoked without affecting user accounts.

Which Elasticsearch endpoint is used to create an API key?

A GET /_security/api_key

B POST /_security/api_key

C DELETE /_security/api_key

D PUT /_security/api_key

The POST method to /_security/api_key is used to create a new API key.

What information do you receive after creating an API key?

A Only the API key string

B Username and password

C Only the key ID

D Key ID and API key string

Elasticsearch returns both the key ID and the API key string after creation.

How do you revoke an API key in Elasticsearch?

A Send a DELETE request to /_security/api_key with the key ID

B Send a POST request to /_security/api_key

C Send a GET request to /_security/api_key

D Send a PUT request to /_security/api_key

Revoking an API key requires a DELETE request with the key ID.

Why should API keys have expiration times?

A To limit how long they can be used for better security

B To make them harder to create

C To increase their length

D To allow unlimited access

Expiration limits the key's validity, reducing risk if compromised.

Which of these is NOT a benefit of using API keys?

A They can be scoped to specific permissions

B They can be revoked without affecting user accounts

C They expose user passwords

D They can have expiration times

API keys do NOT expose user passwords; this is a security benefit.

Explain how to create, use, and revoke an API key in Elasticsearch.

Think about the REST endpoints and the lifecycle of an API key.

Describe why API key expiration and revocation are important for security.

Consider what happens if a key is lost or stolen.