Hello Everyone ,
As part of a project I’m working on, I have to put up an Elasticsearch multi-tenant environment, and I might use Search Guard for access control and security. Our objective is to guarantee that access limits are strictly enforced and that individual tenant’s data is safely segregated.
Here are some particulars about our setup, along with some queries:
Elasticsearch Version Compatibility: Elasticsearch version 7.10.2 is what we intend to use. Is there a way to verify whether this version works flawlessly with the most recent Search Guard release? Exist any restrictions or known problems that we ought to become aware of?
Configuration Best Practices: What are the most effective practices for configuring the permissions and roles with Search Guard, considering the multi-tenant aspect of our environment? Any advice on how to effectively oversee permissions and duties as the variety of renters increases?
Performance-based Matters: What effect does Search Guard have on Elasticsearch’s multi-tenant setup performance? Exist any particular setups or modifications that can reduce any possible performance overhead?
Strong audit recording is required in order to monitor changes and access amongst tenants. Is there a way to integrate Search Guard with other logging systems like as Logstash or Kibana, and how well does it manage audit logging?
Community vs Enterprise Version: Would you advise continuing with the community versions of Search Guard for a project this size, or would ultimately it be worthwhile to invest in an enterprise version?
Which of the enterprise version’s main advantages could make the price point worthwhile?
I also checked this https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-devops-Guide/Elasticsearch-Security-Guidelines-Multi-tenant-Deployments but didn’t get a good solution of this.
Thank you in advance.