API key management in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an API key with a name.

Elasticsearch

POST /_security/api_key
{
  "name": "[1]"
}

Drag options to blanks, or click blank then click option'

Aapi_key

Bkey_name

Cmy-api-key

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using a field name other than 'name' for the API key name.

Leaving the name empty or using invalid characters.

The name field sets the API key's name. Here, my-api-key is a valid name.

2fill in blank

medium

Complete the code to specify the role descriptors for the API key.

Elasticsearch

POST /_security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "[1]": {
      "cluster": ["all"]
    }
  }
}

Drag options to blanks, or click blank then click option'

Arole1

Buser_role

Cdefault_role

Dadmin_role

Attempts:

3 left

💡 Hint

Common Mistakes

Using invalid characters or spaces in the role name.

Omitting the role name key inside role_descriptors.

The role_descriptors object requires a role name key. role1 is a valid role name here.

3fill in blank

hard

Fix the error in the code to delete an API key by its ID.

Elasticsearch

DELETE /_security/api_key/[1]

Drag options to blanks, or click blank then click option'

Aid

BapiKeyId

Capi_key_id

Dkey_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using camelCase, snake_case, or incorrect parameter names in the URL.

Omitting the API key ID in the delete request.

The API key ID must be placed directly in the URL path. id is the correct placeholder here.

4fill in blank

hard

Fill both blanks to create an API key with limited privileges.

Elasticsearch

POST /_security/api_key
{
  "name": "limited-key",
  "role_descriptors": {
    "[1]": {
      "cluster": ["[2]"]
    }
  }
}

Drag options to blanks, or click blank then click option'

Alimited_role

Bmonitor

Cwrite

Dadmin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'admin' privilege when limited access is intended.

Not matching the role name and privilege correctly.

The role name is limited_role and the cluster privilege is monitor to limit access.

5fill in blank

hard

Fill all three blanks to create an API key with a name, role, and expiration.

Elasticsearch

POST /_security/api_key
{
  "name": "[1]",
  "role_descriptors": {
    "[2]": {
      "cluster": ["all"]
    }
  },
  "expiration": "[3]"
}

Drag options to blanks, or click blank then click option'

Atemp-key

Btemp_role

C1d

Dpermanent

Attempts:

3 left

💡 Hint

Common Mistakes

Using invalid expiration formats.

Omitting the expiration field when a temporary key is needed.

The API key is named temp-key, uses role temp_role, and expires after 1d (one day).

Practice

1. What is the primary purpose of an API key in Elasticsearch?

easy

A. To monitor Elasticsearch cluster health

B. To store data inside Elasticsearch indices

C. To allow applications to securely access Elasticsearch with specific permissions

D. To backup Elasticsearch data automatically

Solution

1. Step 1: Understand API key role

   API keys are secret tokens used to authenticate and authorize applications.

2. Step 2: Identify purpose in Elasticsearch

   They grant controlled access to Elasticsearch resources based on assigned roles.

3. Final Answer:

   To allow applications to securely access Elasticsearch with specific permissions -> Option C

4. Quick Check:

   API key = secure app access [OK]

Hint: API keys control app access permissions [OK]

Common Mistakes:

• Confusing API keys with data storage
• Thinking API keys monitor cluster health
• Assuming API keys handle backups

2. Which of the following is the correct Elasticsearch API call to create an API key?

easy

A. DELETE /_security/api_key

B. GET /_security/api_key/create

C. PUT /_security/api_key

D. POST /_security/api_key

Solution

1. Step 1: Recall API key creation syntax

   Elasticsearch uses POST method to create resources like API keys.

2. Step 2: Match correct endpoint

   The correct endpoint for creating an API key is POST /_security/api_key.

3. Final Answer:

   POST /_security/api_key -> Option D

4. Quick Check:

   POST + /_security/api_key = create key [OK]

Hint: Use POST to create API keys in Elasticsearch [OK]

Common Mistakes:

• Using GET or DELETE for creation
• Confusing endpoint paths
• Using PUT instead of POST

3. Given this API key creation request body, what will be the name of the created API key?

{
  "name": "my-app-key",
  "role_descriptors": {
    "my-role": {
      "cluster": ["all"],
      "index": [{"names": ["logs-*"], "privileges": ["read"]}]
    }
  }
}

medium

A. my-app-key

B. my-role

C. logs-*

D. all

Solution

1. Step 1: Identify the API key name field

   The "name" field in the request body sets the API key's name.

2. Step 2: Read the value of the "name" field

   The value is "my-app-key", which becomes the API key's name.

3. Final Answer:

   my-app-key -> Option A

4. Quick Check:

   API key name = "name" field value [OK]

Hint: API key name is in the "name" field [OK]

Common Mistakes:

• Confusing role name with API key name
• Using index pattern as key name
• Mistaking privileges for name

4. You try to delete an API key using this request: DELETE /_security/api_key?id=12345 but get an error. What is the likely cause?

medium

A. API key names cannot be deleted, only IDs

B. API key ID must be passed in the request body, not as a query parameter

C. DELETE method is not supported for API keys

D. You must use GET method to delete API keys

Solution

1. Step 1: Check API key deletion syntax

   Elasticsearch requires the API key ID in the request body JSON, not as a URL query parameter.

2. Step 2: Understand method support

   DELETE method is supported, but parameters must be correctly passed in the body.

3. Final Answer:

   API key ID must be passed in the request body, not as a query parameter -> Option B

4. Quick Check:

   Delete API key ID in body, not URL [OK]

Hint: Pass API key ID in JSON body for deletion [OK]

Common Mistakes:

• Passing ID as URL query parameter
• Using wrong HTTP method
• Confusing API key name with ID

5. You want to create an API key that only allows reading from indices starting with "sales-" and no cluster privileges. Which role descriptor is correct in the request body?

hard

A. { "role_descriptors": { "read_sales": { "cluster": [], "index": [{ "names": ["sales-*"], "privileges": ["read"] }] } } }

B. { "role_descriptors": { "read_sales": { "cluster": ["all"], "index": [{ "names": ["sales-*"], "privileges": ["write"] }] } } }

C. { "role_descriptors": { "read_sales": { "cluster": ["monitor"], "index": [{ "names": ["sales-*"], "privileges": ["all"] }] } } }

D. { "role_descriptors": { "read_sales": { "cluster": ["all"], "index": [{ "names": ["*"], "privileges": ["read"] }] } } }

Solution

1. Step 1: Identify required privileges

   The API key should have no cluster privileges and only read privileges on indices starting with "sales-".

2. Step 2: Match role descriptor to requirements

   { "role_descriptors": { "read_sales": { "cluster": [], "index": [{ "names": ["sales-*"], "privileges": ["read"] }] } } } has empty cluster privileges and read privilege on "sales-*" indices, matching the requirement.

3. Final Answer:

   { "role_descriptors": { "read_sales": { "cluster": [], "index": [{ "names": ["sales-*"], "privileges": ["read"] }] } } } -> Option A

4. Quick Check:

   No cluster + read sales-* = { "role_descriptors": { "read_sales": { "cluster": [], "index": [{ "names": ["sales-*"], "privileges": ["read"] }] } } } [OK]

Hint: Empty cluster array means no cluster privileges [OK]

Common Mistakes:

• Giving cluster all privileges by mistake
• Using write or all privileges instead of read
• Applying privileges to wrong index patterns