FIPS compliance
Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECK
Generally available
Self-managed
Generally available
The Federal Information Processing Standard (FIPS) Publication 140, titled "Security Requirements for Cryptographic Modules" is a U.S. government computer security standard used to approve cryptographic modules. FIPS 140-2 and its successor FIPS 140-3 define the security requirements that cryptographic modules must meet.
- Elasticsearch can run in a JVM configured with a FIPS-certified security provider, and supports the following FIPS compliant modes:
- FIPS 140-2
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. FIPS 140-3
- Kibana offers FIPS 140-2 and FIPS 140-3 compliant modes, and as such can run in a Node.js environment configured with a FIPS 140-2 or FIPS 140-3 compliant OpenSSL3 provider.
- Some Ingest tools, including Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server, are available as FIPS compatible binaries. Depending on the product and version, these binaries use FIPS 140-2 or FIPS 140-3 validated cryptography. Refer to FIPS mode for Ingest tools for the versions in which each tool supports each standard.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. The self-hosted Elastic Package Registry for air-gapped environments is available as FIPS 140-3 compliant Docker images for Linux.
If you are running Elasticsearch through Elastic Cloud on Kubernetes, you also need a FIPS-compliant ECK operator. Refer to Deploy a FIPS compatible version of ECK for operator installation instructions.
FIPS compliance is not officially supported in Elastic Cloud Enterprise (ECE). While ECE may function on FIPS-enabled systems, this configuration has not been validated through our testing processes and is not recommended for production environments.