Rules and Elastic Cloud API keys in Serverless
In Elastic Cloud Serverless projects, rules authenticate using Elastic Cloud API keys rather than Elasticsearch API keys, which are used in Stack deployments and as a fallback in Serverless when an Elastic Cloud API key isn't available.
Kibana creates an API key when a rule is created or edited, then uses it to authorize execution on every run. Elasticsearch API keys are scoped to a user's privileges, whereas Elastic Cloud API keys are scoped to a snapshot of a user's current roles.
Use this page to understand how Elastic Cloud API keys work for Serverless alerting rules and how role changes affect rule access. If your organization was part of Elastic's migration from Elasticsearch to Elastic Cloud API keys, it also includes a checklist to verify your rules are still running correctly.
Elastic migrated existing alerting rules in Elastic Cloud Serverless projects from Elasticsearch API keys to Elastic Cloud API keys in a controlled, phased rollout. In-product notices were shown when your organization was affected.
The migration was designed not to interrupt rule execution. Rules that couldn't be migrated automatically (for example, rules with a missing owner or incompatible custom role state) surfaced errors or indicators that require an administrator to fix the rule manually.
New and edited rules now use Elastic Cloud API keys by default. Elasticsearch API keys are used as a fallback only when an Elastic Cloud API key isn't available.
If you create or update rules through the public APIs using a personal Elasticsearch API key, those rules won't be automatically migrated to Elastic Cloud API keys. When you interact with those rules through the UI (for example, by editing and saving a rule or using Update API key from the rule's action menu) Kibana may convert them to Elastic Cloud API keys. Follow any prompts the UI shows during the process.
Use the following checklists to confirm your rules are running correctly after the migration.
Right after migration
Check rule execution status: Go to Stack Management > Rules or your app's rules page and review the last run status for all rules. Investigate any rules showing a failed or warning status before moving on. If you use Elastic Security detection rules, also check for gaps caused by the migration. Refer to Fill rule execution gaps for instructions.
Resolve migration errors promptly: If the UI shows an indicator that an Elastic Cloud API key isn't available for a rule, the rule continues to run using an Elasticsearch API key as a fallback. To create a new Elastic Cloud API key for the rule, open the rule's action menu in the UI and select Update API key.
Verify index access: Confirm that migrated rules can still reach the indices they query. A warning status with an index-not-found message means the new key might have narrower access than the previous one. Review and update role assignments if needed.
Within 90 days
Review API key expiration: If a rule was created or updated through the Kibana API using an Elastic Cloud API key with a defined expiration, the rule is bound to that specific key and its expiration date. When the key expires, the rule stops running. To generate a new key for the rule, select Update API key from the rule's action menu.
Check rule tags: On the Stack Management > Rules page, review rule tags. Any rule tagged Missing Elastic Cloud Api Key is still running on an Elasticsearch API key. This typically happens when rules were created or updated through the public APIs using a personal Elasticsearch API key rather than through the UI. Edit the rule in the UI or update its API key to migrate it to an Elastic Cloud API key.
Review rules that use custom roles: If any rules rely on custom roles, confirm those roles still exist and are correctly defined. If a custom role was deleted or changed around the time of migration, affected rules might be silently running with reduced access or might have failed.
Serverless alerting rules use Elastic Cloud API keys in the following ways:
Role assignments are captured when a rule is saved: The key reflects the user's roles at the time the rule is created or edited. Roles assigned to the user afterward aren't picked up until the rule is saved again.
Role definition changes apply to the key's behavior: If a role's definition changes, those updates propagate to the key because privileges are resolved at request time. If a custom role is deleted, rules that depended on it might fail until the rule is updated with a valid role assignment.
Rules continue running when the key owner leaves the organization: Elastic Cloud API keys are not tied to the user's account. If the user who last edited a rule leaves, the key continues to authenticate using their assigned roles.