• Overview
    • Automated PKI Infrastructure
    • Data Encryption & Tokenization
    • Database Credential Rotation
    • Dynamic Secrets
    • Identity-based Access
    • Key Management
    • Kubernetes Secrets
    • Secrets Management
  • Enterprise
  • Tutorials
  • Docs
  • API
  • Community
GitHubTry Cloud
Download
    • v1.11.x (latest)
    • v1.10.x
    • v1.9.x
    • v1.8.x
    • v1.7.x
    • v1.6.x
    • v1.5.x
    • v1.4.x
  • Overview
  • Client Libraries
  • Related Tools

    • Overview
    • Active Directory
    • AliCloud
    • AWS
    • Azure
    • Cassandra
    • Consul
    • Cubbyhole
      • Overview
      • Cassandra
      • Couchbase
      • Elasticsearch
      • Influxdb
      • HanaDB
      • MongoDB
      • MongoDB Atlas
      • MSSQL
      • MySQL/MariaDB
      • Oracle
      • PostgreSQL
      • Redshift
      • Snowflake
    • Google Cloud
    • Google Cloud KMS
      • Overview
      • Entity
      • Entity Alias
      • Group
      • Group Alias
      • Identity Tokens
      • Lookup
      • OIDC Provider
        • Overview
        • Duo
        • Okta
        • PingID
        • TOTP
        • Login Enforcement
      • Overview
      • Azure Key Vault
      • AWS KMS
      • GCP Cloud KMS
      • Overview
      • K/V Version 1
      • K/V Version 2
    • KMIP ENTERPRISE
    • Kubernetes
    • MongoDB Atlas
    • Nomad
    • OpenLDAP
    • PKI
    • RabbitMQ
    • SSH
    • Terraform Cloud
    • TOTP
    • Transform ENTERPRISE
    • Transit
    • Overview
    • AliCloud
    • AppRole
    • AWS
    • Azure
    • Cloud Foundry
    • GitHub
    • Google Cloud
    • JWT/OIDC
    • Kerberos
    • Kubernetes
    • LDAP
    • OCI
    • Okta
    • RADIUS
    • TLS Certificates
    • Tokens
    • Username & Password
    • App ID DEPRECATED
    • Overview
    • /sys/audit
    • /sys/audit-hash
    • /sys/auth
    • /sys/capabilities
    • /sys/capabilities-accessor
    • /sys/capabilities-self
    • /sys/config/auditing
    • /sys/config/control-group
    • /sys/config/cors
    • /sys/config/reload
    • /sys/config/state
    • /sys/config/ui
    • /sys/control-group
    • /sys/generate-recovery-token
    • /sys/generate-root
    • /sys/health
    • /sys/host-info
    • /sys/in-flight-req
    • /sys/init
    • /sys/internal/counters
    • /sys/internal/specs/openapi
    • /sys/internal/ui/feature-flags
    • /sys/internal/ui/mounts
    • /sys/internal/ui/namespaces
    • /sys/internal/ui/resultant-acl
    • /sys/key-status
    • /sys/ha-status
    • /sys/leader
    • /sys/leases
    • /sys/license/status
    • /sys/managed-keys ENT
    • /sys/metrics
      • Overview
      • /sys/mfa/method/duo
      • /sys/mfa/method/okta
      • /sys/mfa/method/pingid
      • /sys/mfa/method/totp
      • /sys/mfa/validate
    • /sys/monitor
    • /sys/mounts
    • /sys/namespaces
    • /sys/plugins/reload/backend
    • /sys/plugins/catalog
    • /sys/policy
    • /sys/policies
    • /sys/policies/password
    • /sys/pprof
    • /sys/quotas/config
    • /sys/quotas/rate-limit
    • /sys/quotas/lease-count
    • /sys/raw
    • /sys/rekey
    • /sys/rekey-recovery-key
    • /sys/remount
      • Overview
      • /sys/replication/performance
      • /sys/replication/dr
    • /sys/rotate
    • /sys/rotate/config
    • /sys/seal
    • /sys/seal-status
    • /sys/sealwrap/rewrap
    • /sys/step-down
      • Overview
      • /sys/storage/raft
      • /sys/storage/raft/autopilot
      • /sys/storage/raft/snapshot-auto
    • /sys/tools
    • /sys/unseal
    • /sys/version-history
    • /sys/wrapping/lookup
    • /sys/wrapping/rewrap
    • /sys/wrapping/unwrap
    • /sys/wrapping/wrap

The Vault website is being redesigned to help you find what you are looking for more effectively.

Type '/' to Search

»Elasticsearch Database Plugin HTTP API

Note: This engine can use external X.509 certificates as part of TLS or signature validation. Verifying signatures against X.509 certificates that use SHA-1 is deprecated and will no longer be usable without a workaround starting in Vault 1.12. See the deprecation FAQ for more information.

The Elasticsearch database plugin is one of the supported plugins for the database secrets engine. This plugin generates credentials dynamically based on configured roles for Elasticsearch.

»Configure Connection

In addition to the parameters defined by the Database Backend, this plugin has a number of parameters to further configure a connection.

MethodPath
POST/database/config/:name

»Parameters

  • url (string: <required>) - The URL for Elasticsearch's API (http://localhost:9200).
  • username (string: <required>) - The username to be used in the connection URL (vault).
  • password (string: <required>) - The password to be used in the connection URL (pa55w0rd).
  • ca_cert (string: "") - The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity.
  • ca_path (string: "") - The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity.
  • client_cert (string: "") - The path to the certificate for the Elasticsearch client to present for communication.
  • client_key (string: "") - The path to the key for the Elasticsearch client to use for communication.
  • tls_server_name (string: "") - This, if set, is used to set the SNI host when connecting via TLS.
  • insecure (bool: false) - Not recommended. Default to false. Can be set to true to disable certificate verification.
  • username_template (string) - Template describing how dynamic usernames are generated.
  • use_old_xpack (bool: false) - Can be set to true to use the /_xpack/security base API path when managing Elasticsearch. May be required for Elasticsearch server versions prior to 6.

»Sample Payload

{
  "plugin_name": "elasticsearch-database-plugin",
  "allowed_roles": "internally-defined-role,externally-defined-role",
  "url": "http://localhost:9200",
  "username": "vault",
  "password": "myPa55word",
  "ca_cert": "/usr/share/ca-certificates/extra/elastic-stack-ca.crt.pem",
  "client_cert": "$ES_HOME/config/certs/elastic-certificates.crt.pem",
  "client_key": "$ES_HOME/config/certs/elastic-certificates.key.pem"
}
{
  "plugin_name": "elasticsearch-database-plugin",
  "allowed_roles": "internally-defined-role,externally-defined-role",
  "url": "http://localhost:9200",
  "username": "vault",
  "password": "myPa55word",
  "ca_cert": "/usr/share/ca-certificates/extra/elastic-stack-ca.crt.pem",
  "client_cert": "$ES_HOME/config/certs/elastic-certificates.crt.pem",
  "client_key": "$ES_HOME/config/certs/elastic-certificates.key.pem"
}

»Sample Request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/my-elasticsearch-database
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/my-elasticsearch-database

»Statements

Statements are configured during role creation and are used by the plugin to determine what is sent to the database on user creation, renewing, and revocation. For more information on configuring roles see the Role API in the database secrets engine docs.

»Parameters

The following are the statements used by this plugin. If not mentioned in this list the plugin does not support that statement type.

  • creation_statements (string: <required>) – Using JSON, either defines an elasticsearch_role_definition or a group of pre-existing elasticsearch_roles.

    The object specified by the elasticsearch_role_definition is the JSON directly passed through to the Elasticsearch API, so you can pass through anything shown here.

    For elasticsearch_roles, add the names of the roles only. They must pre-exist in Elasticsearch. Defining roles in Vault is more secure than using pre-existing roles because a privilege escalation could be performed by editing the roles used out-of-band in Elasticsearch.

»Sample Creation Statements

{
  "elasticsearch_role_definition": {
    "indices": [
      {
        "names": ["*"],
        "privileges": ["read"]
      }
    ]
  }
}
{
  "elasticsearch_role_definition": {
    "indices": [
      {
        "names": ["*"],
        "privileges": ["read"]
      }
    ]
  }
}
{
  "elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]
}
{
  "elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]
}
github logoEdit this page
DocsAPILearnCommunityPrivacySecurityPress KitConsent Manager