Stephane: So here is a small lecture
on Amazon ElasticSearch and especially around the security
and its access that can be asked at the six steps exams.
So it may be called Amazon ES in the exam,
and it's a managed version of ElasticSearch
which is an open source project.
It needs to run on servers,
so this is not a serverless offering.
And the use cases for ElasticSearch are Log Analytics,
Real Time application monitoring, Security Analytics,
Full Text Search, Clickstream Analytics, and Indexing.
So the pattern, for example with DynamoDB,
when you want to use ElasticSearch is that you're doing
your create, update and delete in your DynamoDB table.
This goes into DynamoDB Stream, which is
passed on to Lambda Function
and that Lambda function will then insert these elements
into an Amazon ElasticSearch engine.
Now, the cool thing is that Amazon ElasticSearch
provide a search mechanism. So for example,
if you have an application deployed on a load balancer
and an EC2 instance,
that EC2 instance can have some code
to search for some elements on Amazon ElasticSearch, okay?
And then retrieve the DynamoDB IDs of these elements,
and then use the dynamo DB API to retrieve these items
and display it to our users.
So this is a very common pattern.
Now to access ElasticSearch,
you can define what's called an access policy.
So an access policy looks like a resource policy,
just like your S3 bucket policy.
And this one is an IP-based access policy
to only access a specific source IP.
So these IP-based policies allow you to
restrict access to your ElasticSearch domain
from either some IP addresses or a CIDR block.
And this allows unsigned request to your IES domain.
For example, using curl or Kibana.
So if you the VPC, you have multiple options.
So this first one is IP-based policies.
The second one is to use a private subnet
and some EC2 instances.
And then you sign your request using SigV4
to get direct access into Amazon ElasticSearch,
or you can deploy a public proxy server in a public subnet.
And then that combined with an IP based policy.
This would allow clients connected to the proxy
to directly access your Amazon ElasticSearch server.
Now, the last thing you need to know
is around Kibana authentication.
So Kibana does not natively support IAM users and roles.
And so you can control access to Kibana
using HTTP Basic Authentication,
which is going to be an internal user database
stored within your ElasticSearch index.
Or SAML to integrate with third party identity providers.
And then this could be for example,
Active Directory Federation Services, so ADFS
or Auth0 and so on.
Or Cognito, which is very easy.
And Cognito has a direct
Microsoft Active Directory integration.
So you could come up with this architecture
where Cognito User Pools
are connected to your active directory.
And then Kibana has access to
the authentication of Cognito to get actually access
to your active directory.
So that's it. It's just a little bit of details
you need to know for the exam.
But hopefully this question comes up maybe once only,
and I will see you in the next lecture.