elasticsearch-security-troubleshooting

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkDeclared15 observations
• ShellDeclared2 observations
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

exec(`${cmd} "${url}"`);

exec(`${cmd} "${url}"`);

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

config.tls = { rejectUnauthorized: false };

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

config.tls = { rejectUnauthorized: false };

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Cloud control-plane access is authenticated by an **Elastic Cloud API key** (organization scope), stored in a CLI

- Translate a natural-language access request into invite, role, and API key tasks

2. **Load endpoints and credentials.** Fetch the project with `GET cloud:/api/v1/serverless/projects/{type}/{id}` to get

- For granting user access and Cloud API keys, see **cloud-onboarding**; for Elasticsearch data-plane key lifecycle, see

- **Unprompted** — never open on your own connection or credential status. A cluster you cannot reach is not the

"file.name": "beacon.exe",

"file.path": "C:\\ProgramData\\beacon.exe",

"process.name": "beacon.exe",

"process.executable": "C:\\ProgramData\\beacon.exe",

"process.entity_id": eid.beacon,

AI coding agents operate with real credentials, real shell access, and often the full permissions of the user running them. When those agents are pointed at security workflows, the stakes are higher.

2. **Admin is bootstrap-only.** The `admin` user has full privileges and cannot be modified in serverless. Use its

2. **Admin is bootstrap-only.** The `admin` user has full privileges and cannot be modified in serverless. Use its

Audit 0.4.1 · source sha 30fcdedc45a1 · 29 Oct 2026Report an issue or request a re-scan

• Publisherelastic GitHub organizationOwner of the repository this skill is read from
• Source folderelastic/agent-skillsThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict30fcdedc45a1A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default region, then invite users, assign predefined or custom Serverless project roles, and create or revoke…

---
name: cloud-onboarding
description: >
  Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context
  and API key, establish a default region, then invite users, assign predefined or
  custom Serverless project roles, and create or revoke Cloud API keys. Use when setting
  up Cloud authentication or when granting, modifying, or auditing user access to
  an organization and its projects.
compatibility: >
  Requires the `elastic` CLI (>= 0.2) with `cloud` support and network access to the
  Elastic Cloud API (api.elastic-cloud.com). Custom-role operations additionally need
  an Elasticsearch context on the target Serverless project with `manage_security`.
  Targets the Elastic Cloud control plane; not applicable to self-managed clusters.
metadata:
  author: elastic
  version: 0.3.0
  universal: true
---

# Cloud Onboarding

Stand up access to an Elastic Cloud organization end to end: configure the `elastic` CLI so it can operate the control
plane, then manage identity and access — invite users, assign predefined or custom roles to Serverless projects, and
manage Cloud API keys. For creating and operating projects and deployments, use the **cloud-provisioning** skill.

## Environment Configuration

This skill configures the `elastic` CLI itself, so its setup lives here rather than being assumed. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for.

Cloud control-plane access is authenticated by an **Elastic Cloud API key** (organization scope), stored in a CLI
**context**. Register it without ever having the user paste the secret into the chat:

- Only **Organization owners** can create Cloud API keys. Direct the user to generate one at
  [Elastic Cloud API keys](https://cloud.elastic.co/account/keys) with **Project Admin** privileges or higher so it can
  manage serverless projects.
- If the user has no Elastic Cloud account, propose the free
  [Elastic Cloud trial](https://cloud.elastic.co/registration) (14 days, no credit card). Once registered, continue with
  key generation.
- Add the key to a context (the secret is stored in the OS keychain, not echoed):
  `elastic config context add cloud --cloud-url https://api.elastic-cloud.com --cloud-api-key <KEY>`, then make it
  active with `elastic config current-context set cloud`.

Do not guess credentials, bypass the CLI to call the HTTP API directly, or ask the user to reveal the key. This skill
references control-plane operations in HTTP-shorthand form with the `cloud:` prefix (for example,
`GET cloud:/api/v1/organizations`); the [Operations](#operations) table maps each to the equivalent `elastic cloud`
command.

For detailed API schemas (role assignments, Cloud API keys, custom roles), see
[references/api-reference.md](references/api-reference.md). For Elasticsearch-level role management beyond Cloud roles
(native users, role mappings, DLS/FLS) see **elasticsearch-authz**.

## Jobs to be done

- Configure and validate a Cloud context; establish a default region for later project creation
- Invite a user and assign a Serverless project role; list members and their roles; update or remove access
- Create, list, and revoke Cloud API keys, optionally with Elasticsearch/Kibana API access on projects
- Create a custom role in a Serverless project and assign it via the Cloud API's `application_roles`
- Translate a natural-language access request into invite, role, and API key tasks

## Process: validate the environment

1. **Validate the Cloud context.** Confirm the active context can reach the control plane by calling
   `GET cloud:/api/v1/organizations`. A successful response lists the organizations the key belongs to and yields the
   organization ID other steps need. If it returns an authentication error, the context is missing or the key is invalid
   or expired — return to [Environment Configuration](#environment-configuration) and register a valid key. Do not
   proceed until validation succeeds, and never ask the user for the organization ID — discover it here.

2. **Establish a default region (optional).** When the user plans to create projects, list the available regions with
   `GET cloud:/api/v1/serverless/regions` and confirm a default. Default to `gcp-us-central1` unless the user requests
   otherwise; only regions with `project_creation_enabled: true` accept new projects. Region choice is permanent per
   project, so surface it early.

## Permissions

This skill does not pre-check roles; it attempts the operation and lets the API enforce authorization. On a `403`, stop
and ask the user to verify the API key's permissions.

| Operation                          | Required permission                                            |
| ---------------------------------- | -------------------------------------------------------------- |
| Invite / remove members            | Organization owner (`organization-admin`)                      |
| Assign or remove roles             | Organization owner (`organization-admin`)                      |
| Create / revoke Cloud API keys     | Organization owner (`organization-admin`)                      |
| List members, invitations, or keys | Any organization member                                        |
| Create / delete custom roles       | `manage_security` cluster privilege on the project ES endpoint |

## Predefined roles

Prefer predefined roles; only create a custom role when they lack the required granularity.

**Organization:** `organization-admin` (full admin), `billing-admin` (billing only).

**Serverless project roles** (assign at invitation or via role-assignment update):

| Role      | `role_id`                                                              | Available on          |
| --------- | ---------------------------------------------------------------------- | --------------------- |
| Admin     | `admin`                                                                | Search, Obs, 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-29
   ✕BLOCK F 51 / 100

   first audit · source 30fcdedc45a1

Questions about elasticsearch-security-troubleshooting

• github.com/elastic/agent-skills — the audited source at commit 30fcdedc45a1 and every finding aboveObserved · 29 Oct 2026

Spotted something wrong? Report a correction · Methodology