Comments (12)
Nice !
Waiting for the feature to be merged to migrate from function beat to elastic-serverless-forwarder 😍
from elastic-serverless-forwarder.
@JeromeSola as I said I'm not discussing your specific use case and infra scenario. but the option to have somehow a lower security standard :)
If not for the complexity of relying on ca_certs
in a Lambda context it would be the primary and immediate choice to add support for self-signed certificates.
I've brought the topic to discussion internally to the team and I will keep you posted
from elastic-serverless-forwarder.
@JeromeSola please, take a look at #173
from elastic-serverless-forwarder.
@Ben00it do you use a self-hosted ES cluster?
The option to expose should be ca_certs
(https://elasticsearch-py.readthedocs.io/en/v7.17.6/transports.html#urllib3httpconnection), but unluckily there is no easy way to provide the proper value on a Lambda deployed from SAR: since it requires to add the cert files to a path accessible from the lambda
from elastic-serverless-forwarder.
The best would be if you are able to generate public certs with letsencrypt or similar
from elastic-serverless-forwarder.
Hello @aspacca,
Thanks for the quick response,
What about the "verify_certs" option ? We were using functionbeat before and it was possible to use the option "verification_mode=none" (https://www.elastic.co/guide/en/beats/functionbeat/current/configuration-ssl.html#client-verification-mode).
It would help us a lot to have this option in this repository.
Thanks for your help
from elastic-serverless-forwarder.
@JeromeSola verify_certs
is prone to open a secure vulnerability I would prefer to consider all the other available options before making a call on that
please, don't consider my question a judgement on your security practice, but what are the limit that would prevents youto generate a valid cert from a certificate authority? :)
Have you looked at https://aws.amazon.com/certificate-manager/? (assuming your cluster is on the aws cloud)
from elastic-serverless-forwarder.
@aspacca i see your point.
However i think it is required to know the full context to admit if their is a security breach or not. Our cluster is well hosted in AWS in a full private network etc...
Moreover it is difficult on our buisiness context to have access to some ressources while it is easy for us to make this simple change on the config file and our network segmentation does not expose critical stuff.
That's why I thought it was a good thing to just add options to your tool then it is client security concern to use or not use the option...
Thanks anyway
from elastic-serverless-forwarder.
@Ben00it please, take a look at #173
from elastic-serverless-forwarder.
Hello, Oh a good news, that's great.
We will migrate that asap once merged and we will let you know.
Thank you @aspacca
from elastic-serverless-forwarder.
Hello @aspacca we were looking to deploy the new version, unfortunatly we use AWS repository to deploy the tool and it seems to still be the old version of the tool.
What is your process to push a new version to AWS repository? Can we expect the new version to be pushed soon ?
Thanks :)
from elastic-serverless-forwarder.
@JeromeSola pushed the new version yesterday after a little while from your messsage :)
from elastic-serverless-forwarder.
Related Issues (20)
- Incorrect Handling of Permissions Can Result in Data Loss
- Provide support for Python 3.12
- [DOCS] Fix outdated link
- CloudWatch log retention for ESF own logs
- Investigate ingestion of files with same IDs HOT 2
- Create pipeline to push zip file with dependencies to an S3 bucket HOT 3
- Misconfigured ESF input results in a warning message, not events sent to replay queue HOT 3
- CMA-CGM ESF Issue HOT 1
- no input defined on cloudwatch-logs trigger HOT 1
- Enable shared outputs and multiple outputs per input
- Investigate number of API calls of ESF due to ec2:describe_regions usage HOT 3
- Issue with region name check in publishing script
- Support SSM (Systems Manager) parameters
- policy size limits - max 44 log groups you can add
- Deployment method using AWS Console doesn't work HOT 5
- ESF incorrectly sets region for VPC flow logs from multi-region S3 bucket
- es_dead_letter_index
- Sercrets manager secrets caching seems not working
- What do I do when I hit the size limits?
- error: Argument 1 to "wrapper" has incompatible type "ProtocolStorageType@__init__"; expected "ProtocolStorageType@json_collector" [arg-type] HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from elastic-serverless-forwarder.