Encryption in transit and at rest in Elasticsearch - Mini Project: Build & Apply

Encryption in transit and at rest

📖 Scenario: You are setting up Elasticsearch for a company that needs to keep its data safe. The company wants to make sure that data is encrypted both when it travels over the network (in transit) and when it is saved on disk (at rest).

🎯 Goal: You will configure Elasticsearch to enable encryption in transit using TLS and encryption at rest using the built-in encryption settings.

📋 What You'll Learn

Create a basic Elasticsearch configuration file with network and security settings

Add TLS settings to enable encryption in transit

Add settings to enable encryption at rest

Print the final configuration to verify the encryption settings

💡 Why This Matters

🌍 Real World

Encrypting data in transit and at rest is essential for protecting sensitive information in Elasticsearch clusters used by companies and organizations.

💼 Career

Knowledge of configuring encryption in Elasticsearch is valuable for roles like DevOps engineers, security engineers, and backend developers working with secure data storage and search systems.

1

Create the initial Elasticsearch configuration

Create a dictionary called elasticsearch_config with these exact entries: 'cluster.name': 'secure-cluster', 'node.name': 'node-1', and 'network.host': '0.0.0.0'.

Elasticsearch

# Your code here

Need a hint?

Use a Python dictionary with the exact keys and values given.

2

Add TLS settings for encryption in transit

Add to elasticsearch_config the following TLS settings exactly: 'xpack.security.transport.ssl.enabled': true, 'xpack.security.transport.ssl.verification_mode': 'certificate', and 'xpack.security.transport.ssl.keystore.path': '/path/to/keystore.p12'.

Elasticsearch

elasticsearch_config = {
    'cluster.name': 'secure-cluster',
    'node.name': 'node-1',
    'network.host': '0.0.0.0'
}
# Your code here

Need a hint?

Add the TLS settings as new key-value pairs in the elasticsearch_config dictionary.

3

Add encryption at rest settings

Add to elasticsearch_config the exact setting 'xpack.security.enabled': true to enable encryption at rest.

Elasticsearch

elasticsearch_config = {
    'cluster.name': 'secure-cluster',
    'node.name': 'node-1',
    'network.host': '0.0.0.0',
    'xpack.security.transport.ssl.enabled': True,
    'xpack.security.transport.ssl.verification_mode': 'certificate',
    'xpack.security.transport.ssl.keystore.path': '/path/to/keystore.p12'
}
# Your code here

Need a hint?

Add the encryption at rest setting as a new key-value pair in the dictionary.

4

Print the final Elasticsearch configuration

Write print(elasticsearch_config) to display the complete configuration dictionary.

Elasticsearch

elasticsearch_config = {
    'cluster.name': 'secure-cluster',
    'node.name': 'node-1',
    'network.host': '0.0.0.0',
    'xpack.security.transport.ssl.enabled': True,
    'xpack.security.transport.ssl.verification_mode': 'certificate',
    'xpack.security.transport.ssl.keystore.path': '/path/to/keystore.p12',
    'xpack.security.enabled': True
}
# Your code here

Need a hint?

Use the print function to show the dictionary.