Alerting Service Phase 1 - Secret Service

[njd5475]

Alerting Service Phase 1 - Secret Service

Alerting Service meta issue 24214

PRs
Prereq PR 28722
Phase 1 PR 28894

Describe the feature:
Plugins will be able to store encrypted objects in the kibana index using the saved object service.

Describe a specific use case for the feature:
Action connectors such as slack, smtp, S3, etc will need to store user credentials and allow for those credentials to be accessed across multiple instances of kibana. We do not want to force those connectors to only be configurable via a server configuration file. But in order to allow safe storage and access to those credentials we need an encryption method. So the Secret Service will provide a means of encrypting and securing these objects using the saved object service.

Design details
The secret service will use a private key stored in the keystore. It will create a keystore if none exist as well as a private key if none existed. It will use a dummy saved object to determine if the key that was created or retrieved works. This private key will be used to encrypt an arbitrary object using the Elastic node-crypto package. The saved objects that are used in the secret service will be marked as hidden to the saved object service rendering them undefined to the default saved object repository and the REST api end-points.

Changes to the saved object service will be made in the open source version and will simply restrict saved object type access to the known types by the code. This will in effect reduce the risk of exposure of objects with encrypted details.

In the case that a private key is lost the objects will need to be recreated. No migration or key rotation services are planned at this time or in this phase of the service.

Status

• Use keystore to autogenerate encryption key if not in config.
• Pass encryption keys to plugins
• Initial Secret service for encryption of secrets. [Alerting] Secret Service #28894
• User scoped secret service
• Enhanced audit logging, user and data
• Enhance Keystore as a source separate source for configuration
• Ability to hide saved object types from API [Saved Objects] Add hidden types to savedobjects #28722
• Middleware for SavedObjectService that filters secret saved objects
• Audit logging

[elasticmachine]

Pinging @elastic/kibana-platform

[bleskes]

@njd5475 I presume this is backed by the Task Manager (#23632). Is that correct?

[njd5475]

@bleskes yes sir, that is correct.

[azasypkin]

Handled in 2df3880