Why security protects sensitive data in Elasticsearch - See It in Action

Why Security Protects Sensitive Data in Elasticsearch

📖 Scenario: You work for a company that stores customer information in Elasticsearch. Some data is sensitive, like passwords and credit card numbers. You want to protect this sensitive data from unauthorized access.

🎯 Goal: Build a simple Elasticsearch setup that shows how to secure sensitive data by enabling security features and restricting access.

📋 What You'll Learn

Create an Elasticsearch index with sample customer data including sensitive fields

Add a configuration variable to enable security features

Apply a role-based access control rule to restrict access to sensitive fields

Output the result of a query showing only allowed fields

💡 Why This Matters

🌍 Real World

Companies store sensitive customer data in Elasticsearch and must protect it from unauthorized access to comply with privacy laws and maintain trust.

💼 Career

Understanding Elasticsearch security is important for roles like DevOps engineers, backend developers, and security specialists who manage data storage and access.

1

Create an Elasticsearch index with sample customer data

Create an index called customers with these exact documents: {"name": "Alice", "email": "[e-mail]", "password": "alice123"} and {"name": "Bob", "email": "[e-mail]", "password": "bob123"}.

Elasticsearch

# Create the customers index with two documents
# Your code here

Hint

Use the PUT method to add documents to the customers index with the exact fields and values.

2

Enable security features in Elasticsearch configuration

Add a configuration setting called xpack.security.enabled and set it to true to enable security features.

Elasticsearch

PUT /customers/_doc/1
{
  "name": "Alice",
  "email": "[e-mail]",
  "password": "alice123"
}

PUT /customers/_doc/2
{
  "name": "Bob",
  "email": "[e-mail]",
  "password": "bob123"
}

# Enable security features below
# Your code here

Hint

Use the PUT /_cluster/settings API to set xpack.security.enabled to true.

3

Create a role to restrict access to sensitive fields

Create a role called read_customers that allows reading the customers index but excludes the password field from search results.

Elasticsearch

PUT /customers/_doc/1
{
  "name": "Alice",
  "email": "[e-mail]",
  "password": "alice123"
}

PUT /customers/_doc/2
{
  "name": "Bob",
  "email": "[e-mail]",
  "password": "bob123"
}

PUT /_cluster/settings
{
  "persistent": {
    "xpack.security.enabled": true
  }
}

# Create the read_customers role below
# Your code here

Hint

Use the POST /_security/role/read_customers API to create a role that grants read access to name and email fields only.

4

Query the customers index showing only allowed fields

Write a search query on the customers index that returns documents but excludes the password field from the results.

Elasticsearch

PUT /customers/_doc/1
{
  "name": "Alice",
  "email": "[e-mail]",
  "password": "alice123"
}

PUT /customers/_doc/2
{
  "name": "Bob",
  "email": "[e-mail]",
  "password": "bob123"
}

PUT /_cluster/settings
{
  "persistent": {
    "xpack.security.enabled": true
  }
}

POST /_security/role/read_customers
{
  "indices": [
    {
      "names": ["customers"],
      "privileges": ["read"],
      "field_security": {
        "grant": ["name", "email"]
      }
    }
  ]
}

# Write a search query excluding the password field
# Your code here

Hint

Use the _source parameter in the search query to include only name and email fields.

Practice

1. Why is security important in Elasticsearch when handling sensitive data?

easy

A. It makes the data load faster.

B. It deletes old data automatically.

C. It controls who can see or change the data to keep it safe.

D. It changes data formats for better display.

Solution

1. Step 1: Understand the purpose of security in data systems

   Security is designed to protect data by limiting access to authorized users only.

2. Step 2: Apply this to Elasticsearch context

   Elasticsearch uses security to control who can view or modify sensitive data, preventing unauthorized access.

3. Final Answer:

   It controls who can see or change the data to keep it safe -> Option C

4. Quick Check:

   Security protects data = It controls who can see or change the data to keep it safe. [OK]

Hint: Security means controlling access to protect data [OK]

Common Mistakes:

• Thinking security speeds up data loading
• Confusing security with data deletion
• Believing security changes data format

2. Which Elasticsearch feature is used to control access to sensitive data?

easy

A. Index templates

B. Snapshot backups

C. Data nodes

D. Roles and users

Solution

1. Step 1: Identify Elasticsearch components related to security

   Elasticsearch uses roles and users to manage who can access or change data.

2. Step 2: Differentiate from other features

   Index templates, snapshot backups, and data nodes serve other purposes like data structure, backup, and storage, not access control.

3. Final Answer:

   Roles and users -> Option D

4. Quick Check:

   Access control = Roles and users [OK]

Hint: Roles and users manage access in Elasticsearch [OK]

Common Mistakes:

• Confusing index templates with security
• Thinking backups control access
• Mixing data nodes with user permissions

3. Given this Elasticsearch role definition snippet, what permission does it grant?

{
  "role": {
    "indices": [
      {
        "names": ["sensitive-data"],
        "privileges": ["read"]
      }
    ]
  }
}

medium

A. Allows reading data from the 'sensitive-data' index only.

B. Allows deleting data from all indices.

C. Allows writing data to the 'sensitive-data' index.

D. Allows managing users and roles.

Solution

1. Step 1: Analyze the role's indices and privileges

   The role grants the 'read' privilege on the 'sensitive-data' index only.

2. Step 2: Understand what 'read' privilege means

   'Read' allows viewing data but not modifying or deleting it.

3. Final Answer:

   Allows reading data from the 'sensitive-data' index only -> Option A

4. Quick Check:

   Privilege 'read' = read access only [OK]

Hint: Read privilege means view only, no changes [OK]

Common Mistakes:

• Confusing read with write or delete privileges
• Assuming permissions apply to all indices
• Mixing role permissions with user management

4. This role definition has an error. What is it?

{
  "role": {
    "indices": [
      {
        "names": "sensitive-data",
        "privileges": ["read", "write"]
      }
    ]
  }
}

medium

A. "privileges" cannot include "write".

B. "names" should be a list, not a string.

C. "role" key is missing.

D. The JSON syntax is invalid.

Solution

1. Step 1: Check the data type of 'names'

   The 'names' field must be a list of index names, but here it is a string.

2. Step 2: Verify other fields

   Privileges including 'write' is valid, 'role' key exists, and JSON syntax is correct.

3. Final Answer:

   "names" should be a list, not a string -> Option B

4. Quick Check:

   Index names must be in a list [OK]

Hint: Index names must be inside square brackets [OK]

Common Mistakes:

• Using a string instead of a list for 'names'
• Thinking 'write' privilege is invalid
• Missing the 'role' key
• Assuming JSON syntax error without checking

5. You want to protect sensitive customer data in Elasticsearch so only users with the 'customer_read' role can view it. Which setup best achieves this?

hard

A. Create a role with 'read' privilege on the customer data index and assign it to users.

B. Create a role with 'write' privilege on all indices and assign it to users.

C. Disable security to allow all users to access data freely.

D. Create a role with 'manage' privilege on the cluster only.

Solution

1. Step 1: Define the goal for data protection

   Only users with 'customer_read' role should view sensitive customer data.

2. Step 2: Choose the correct role setup

   A role with 'read' privilege on the customer data index limits access to viewing only, assigned to authorized users.

3. Step 3: Eliminate incorrect options

   'Write' privilege allows changes, disabling security removes protection, and 'manage' privilege controls cluster, not data access.

4. Final Answer:

   Create a role with 'read' privilege on the customer data index and assign it to users -> Option A

5. Quick Check:

   Read role + assign users = protected data access [OK]

Hint: Assign read role to users for safe data viewing [OK]

Common Mistakes:

• Giving write instead of read privileges
• Disabling security thinking it helps
• Confusing cluster management with data access