Back to production requirements

Private networking (Private Link)

Status: Complete
Audience: Security, platform, networking

Why it matters

Elastic Serverless must be reachable from your application and ops networks without exposing the search plane on the public internet. Private Link (or equivalent private connectivity) is the approved path for production.

Current state

Private networking is approved and ready for production use. This item is no longer a go-live blocker.

What to do

  1. Keep the approved Private Link path documented in the operational runbook.
  2. Restrict access with least-privilege network controls (security groups / NSGs, private DNS).
  3. Use the same private path for related bridges (for example Logstash reading audit data).
  4. Re-validate after any VNet, subscription, or region change.

Acceptance criteria

  • Application and ops traffic to Serverless uses the private endpoint only
  • Runbook includes connect, failover of DNS/endpoint, and break-glass contacts
  • Security review signed off on the approved path

Related

  • Azure Central US region availability (Serverless must live where your primary workloads run)
  • Audit logging bridge (Logstash should use Private Link to Serverless)