CSS Clusters Have Kibana Public Access Control Enabled

Rule Details

Applicable Scenario

If a CSS cluster has Kibana access control disabled, Kibana is publically accessible by all IP addresses. If Kibana access control is enabled, it is only accessible by whitelisted IP addresses over public networks. For details, see Logging In to an Elasticsearch Cluster Using Kibana.

Solution

You can call the Enabling Kibana Public Access API to whitelist IP addresses that can access Kibana.

Rule Logic

• If a CSS cluster does not have Kibana public access enabled, this cluster is compliant.
• If a CSS cluster has Kibana public access enabled but does not have access control enabled, this cluster is noncompliant.
• If a CSS cluster has both Kibana public access and access control enabled, this cluster is compliant.