Module org.elasticsearch.xcore

Package org.elasticsearch.xpack.core.security.cloud

Interface InternalCloudApiKeyService

All Known Implementing Classes:

InternalCloudApiKeyService.Default

public interface InternalCloudApiKeyService

Service for programmatically granting cloud API keys for ML cross-project search jobs.

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final record	InternalCloudApiKeyService.CloudGrantApiKeyResult
static class	InternalCloudApiKeyService.Default	Default used when no real implementation is loaded.

Method Summary

Modifier and Type	Method	Description
void	grantCloudAuthentication(CloudCredential cloudManagedCredential, String description, ActionListener<InternalCloudApiKeyService.CloudGrantApiKeyResult> listener)	Grants a dedicated cloud API key for an ML job, using the caller's credential to authenticate the grant request.
void	revokeCloudAuthentication(PersistedCloudCredential persistedCredential, ActionListener<Void> listener)

Method Details

grantCloudAuthentication

void grantCloudAuthentication(CloudCredential cloudManagedCredential,
 String description,
 ActionListener<InternalCloudApiKeyService.CloudGrantApiKeyResult> listener)

Grants a dedicated cloud API key for an ML job, using the caller's credential to authenticate the grant request. The granted key is then authenticated to produce an Authentication that the caller can persist alongside the credential.

Parameters:

cloudManagedCredential - the caller credential (extracted from the active request via CloudCredentialManager.extractCloudManagedCredential(org.elasticsearch.common.util.concurrent.ThreadContext))

description - a human-readable description for the granted key, by convention "<resource-kind>:<resource-id>" (for example "transform:my-transform" or "datafeed:my-feed")

listener - receives the granted credential envelope and its corresponding Authentication

revokeCloudAuthentication

void revokeCloudAuthentication(PersistedCloudCredential persistedCredential,
 ActionListener<Void> listener)