docs: add supported connection paths for remote clusters (CCS/CCR vs private connectivity) by alxchalkias · Pull Request #7567 · elastic/docs-content

alxchalkias · 2026-07-24T14:00:28Z

Summary

Adds a Supported connection paths subsection to the "Remote clusters and network security" section of deploy-manage/remote-clusters.md, with a table showing which network paths support CCS/CCR depending on where the local cluster runs, a warning against using private connection hostnames as proxy_address between two ECH deployments, and a billing tip (CCS/CCR traffic is metered as Data out on the deployment the data leaves).
Adds a remote clusters limitation note to the shared private connectivity limitations snippet (_snippets/private-connectivity-limitations-ech.md), which renders on the AWS PrivateLink, Azure Private Link, and GCP Private Service Connect pages: deployment-to-deployment remote cluster traffic does not traverse the customer's private endpoint.

Why

Recent support escalation (SDH via #cloud-networking Slack, Jul 17-24): a customer tried to configure CCR between two ECH deployments in Azure (eastus <-> westus2) using the Private Link hostname as proxy_address, which cannot work — PL hostnames only resolve inside the customer's VNet. The existing docs cover which filter type to use when network security is enabled, but not which connection paths are supported, and both support and the customer were confused about:

Whether the PL hostname can be used for ECH-to-ECH remote clusters (no).
Which direction private connectivity supports CCS/CCR (customer network -> ECH only; :9400 is open on the Azure PL LBs — ECPTRAFFIC-1076 — and :9443/RCS 2.0 was addressed in ECPTRAFFIC-1293).
How CCR traffic is billed (Data out on the deployment the data leaves — messaging confirmed with platform-billing, Jul 24).

Test plan

Docs build passes
New subsection renders correctly on deploy-manage/remote-clusters
Snippet note renders on the AWS, Azure, and GCP private connectivity pages
Anchor #remote-clusters-connection-paths resolves from the snippet link

Made with Cursor

cla-checker-service · 2026-07-24T14:00:33Z

💚 CLA has been signed

github-actions · 2026-07-24T14:01:04Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-07-24T14:02:50Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-07-24T14:02:51Z

🔍 Preview links for changed docs

deploy-manage/remote-clusters.md

eedugon

Great addition to the docs, thanks!!

I've shared a few comments, suggesting a small update in the title, because the main focus on our messages are about private connectivity.

There's one sentence that was contradictory with the rest of the PR and I've suggested to change the introductory path of the section (including a link to private connectivity docs, as we didn't have any in the section).

Let me know your thoughts!

Note that I've removed in the intro the message about 9400, 9443, API key, and TLS-based auth methods, as IMO that's out of the scope of this doc and it's explained already in all the setup docs plus the doc about authentication methods for RCS. But if we consider it's useful to add it also here we can find the way.

jakommo

Left a few minor / clarification comment, but LGTM in general.

jakommo · 2026-07-27T13:47:57Z

+::::
+
+::::{tip}
+Traffic sent between deployments for {{ccs}} and {{ccr}} is metered as **Data out** on the deployment the data is replicated or searched from, regardless of destination or path. Refer to [Cloud Hosted deployment billing dimensions](/deploy-manage/cloud-organization/billing/cloud-hosted-deployment-billing-dimensions.md).


or searched from

I think this is ambiguous and might cause confusion. For CCS is this the cluster initiating the search or the one that executes it?

Good catch — reworded. It's the remote deployment being searched (the search results leave that deployment), not the initiating cluster. The tip now spells out both directions: for CCR the deployment you replicate from, for CCS the remote deployment being searched.

jakommo · 2026-07-27T13:52:43Z

+| {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't consume private endpoints in customer networks. |
+
+::::{warning}
+Don't use a private connection hostname (for example, `*.vpce.{region}.aws.elastic-cloud.com` or your Azure private hosted zone domain) as the `proxy_address` for a remote cluster connection between two {{ech}} deployments. The connection will fail because the hostname is not resolvable from Elastic-managed networks. Use the public proxy address from the remote deployment's **Security** page instead.


Is there a specific error for this? Something like "can't resolve" or "host unknown" or so? Would be great to add the symptom/error so users can more easily find the doc.

Added. The symptom is a DNS resolution failure — unknown host / UnknownHostException in the Elasticsearch logs — since the private hostname isn't resolvable from Elastic-managed networks. The warning now includes it for searchability.

shainaraskas · 2026-07-27T18:04:55Z

I think this PR will always fail CI because of the cursoragent commit ... might need to be recreated

alxchalkias · 2026-07-28T09:38:48Z

Addressed all open review items and rebuilt the branch per @shainaraskas' CLA note:

Recreated as a single commit authored by me, without the cursoragent co-author trailer that was failing the CLA check. Review credit for @eedugon's and @shainaraskas' suggestions is preserved as co-author trailers. All previously reviewed content is unchanged except the items below.
Fixed a broken table: one applied suggestion had dropped a duplicate of the warning text into the middle of the connection-paths table, splitting it. Removed.
CCS billing direction (@jakommo): the tip now states explicitly that Data out is metered on the deployment that holds the data — for CCR the deployment you replicate from, for CCS the remote deployment being searched.
Error symptom (@jakommo): the warning now names the failure mode (unknown host / UnknownHostException in the ES logs) so users can find this doc from the error.
CRLF/^M noise (@jakommo): the file now keeps main's original line endings with the new section appended in LF — the diff is a clean ~22-line addition.

CI should be green now; ready for another look.

Add a Connection paths and private connectivity subsection to the remote clusters network security section, clarifying which paths support CCS/CCR by local cluster location and that private connection hostnames cannot be used between two ECH deployments. Add a corresponding limitation note to the shared private connectivity limitations snippet (AWS/Azure/GCP), and a billing tip pointing at the Data out dimension. Co-authored-by: Edu González de la Herrán <25320357+eedugon@users.noreply.github.com> Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

eedugon

LGTM!

nikfot

Added some comments for clarity.

nikfot · 2026-07-28T17:25:21Z

@@ -1,4 +1,5 @@
 * **Transport client:** The {{es}} transport client is not supported over private connections.
+* **Remote clusters between {{ech}} deployments:** Remote cluster connections ({{ccs}} and {{ccr}}) between two ECH deployments cannot use your private endpoint. Deployment-to-deployment traffic must use the remote deployment's public proxy address. Private connections apply to remote cluster traffic only when the local cluster runs in your own VPC or VNet (self-managed, {{ece}}, or {{eck}}). Refer to [Supported connection paths](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths).


I believe that "your private endpoint" can be misleading. Since this is in Elastic Cloud the user cannot create a private endpoint no matter what.

Maybe something like this:

Suggested change

* **Remote clusters between {{ech}} deployments:** Remote cluster connections ({{ccs}} and {{ccr}}) between two ECH deployments cannot use your private endpoint. Deployment-to-deployment traffic must use the remote deployment's public proxy address. Private connections apply to remote cluster traffic only when the local cluster runs in your own VPC or VNet (self-managed, {{ece}}, or {{eck}}). Refer to [Supported connection paths](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths).

* **Remote clusters between {{ech}} deployments:** Remote cluster connections ({{ccs}} and {{ccr}}) between two ECH deployments cannot be connecte using private endpoints. Deployment-to-deployment traffic must use the remote deployment's public proxy address. Private connections apply to remote cluster traffic only when the local cluster runs in your own VPC or VNet (self-managed, {{ece}}, or {{eck}}). Refer to [Supported connection paths](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths).

nikfot · 2026-07-28T17:28:22Z

+
+| Local cluster location | Remote cluster | Connection path | Private connectivity applicable? |
+|---|---|---|---|
+| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** Private connection hostnames resolve only inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |


The problem is not that the hostnames would not resolve. Ther problem is that the user does not have permission to create them inside the Elastic CLoud.

Suggested change

| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** Private connection hostnames resolve only inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |

| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** You can only create private connection hostnames inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |

nikfot · 2026-07-28T17:29:16Z

+| Local cluster location | Remote cluster | Connection path | Private connectivity applicable? |
+|---|---|---|---|
+| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** Private connection hostnames resolve only inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |
+| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |


To keep capitalization common across services

Suggested change

| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |

| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC Endpoint (AWS), Private Endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |

nikfot · 2026-07-28T17:30:03Z

+|---|---|---|---|
+| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** Private connection hostnames resolve only inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |
+| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |
+| {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't consume private endpoints in customer networks. |


Suggested change

| {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't consume private endpoints in customer networks. |

| {{ech}} deployment | Self-managed cluster in your network | Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. | **No.** {{ech}} deployments can't create private endpoints for customer networks. |

dnraitzyk · 2026-07-28T19:44:28Z

+| Local cluster location | Remote cluster | Connection path | Private connectivity applicable? |
+|---|---|---|---|
+| {{ech}} deployment (any region or cloud provider) | {{ech}} deployment | Remote proxy address over public endpoints. Cross-region and cross-provider connections are supported. | **No.** Private connection hostnames resolve only inside your VPC or VNet through your private DNS zone. Deployment-to-deployment traffic originates from Elastic-managed networks and can't traverse your private endpoint. |
+| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |


I don't think that "in this direction only" is very clear. What direction?

Suggested change

| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (in this direction only). |

| Self-managed or {{ece}} cluster in your VPC or VNet | {{ech}} deployment | Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. | **Yes** (customer network → ECH only). |

alxchalkias requested a review from a team as a code owner July 24, 2026 14:00

github-actions Bot deployed to docs-preview July 24, 2026 14:04 View deployment

eedugon reviewed Jul 24, 2026

View reviewed changes

alxchalkias requested review from cargious and nikfot July 25, 2026 05:58

github-actions Bot deployed to docs-preview July 25, 2026 06:02 View deployment

jakommo approved these changes Jul 27, 2026

View reviewed changes

shainaraskas reviewed Jul 27, 2026

View reviewed changes

Comment thread deploy-manage/remote-clusters.md Outdated

Comment thread deploy-manage/remote-clusters.md Outdated

Comment thread deploy-manage/remote-clusters.md Outdated

Comment thread deploy-manage/remote-clusters.md Outdated

shainaraskas reviewed Jul 27, 2026

View reviewed changes

Comment thread deploy-manage/remote-clusters.md Outdated

shainaraskas reviewed Jul 27, 2026

View reviewed changes

Comment thread deploy-manage/remote-clusters.md Outdated

shainaraskas reviewed Jul 27, 2026

View reviewed changes

Comment thread deploy-manage/remote-clusters.md Outdated

github-actions Bot deployed to docs-preview July 27, 2026 18:07 View deployment

alxchalkias force-pushed the alxchalkias/remote-clusters-connection-paths branch 2 times, most recently from f18d8e1 to 395be1e Compare July 28, 2026 09:38

alxchalkias force-pushed the alxchalkias/remote-clusters-connection-paths branch from 395be1e to 628e132 Compare July 28, 2026 09:41

github-actions Bot deployed to docs-preview July 28, 2026 09:45 View deployment

eedugon approved these changes Jul 28, 2026

View reviewed changes

Merge branch 'main' into alxchalkias/remote-clusters-connection-paths

edcedde

github-actions Bot deployed to docs-preview July 28, 2026 13:00 View deployment

nikfot reviewed Jul 28, 2026

View reviewed changes

dnraitzyk reviewed Jul 28, 2026

View reviewed changes

		@@ -1,4 +1,5 @@
		* Transport client: The {{es}} transport client is not supported over private connections.
		* Remote clusters between {{ech}} deployments: Remote cluster connections ({{ccs}} and {{ccr}}) between two ECH deployments cannot use your private endpoint. Deployment-to-deployment traffic must use the remote deployment's public proxy address. Private connections apply to remote cluster traffic only when the local cluster runs in your own VPC or VNet (self-managed, {{ece}}, or {{eck}}). Refer to [Supported connection paths](/deploy-manage/remote-clusters.md#remote-clusters-connection-paths).

	\| Self-managed or {{ece}} cluster in your VPC or VNet \| {{ech}} deployment \| Public proxy address, or a private connection: create a VPC endpoint (AWS), private endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. \| Yes (in this direction only). \|
	\| Self-managed or {{ece}} cluster in your VPC or VNet \| {{ech}} deployment \| Public proxy address, or a private connection: create a VPC Endpoint (AWS), Private Endpoint (Azure), or Private Service Connect endpoint (GCP) and connect to the remote cluster through it. Inter-region private connections are supported where the cloud provider supports them. \| Yes (in this direction only). \|

	\| {{ech}} deployment \| Self-managed cluster in your network \| Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. \| No. {{ech}} deployments can't consume private endpoints in customer networks. \|
	\| {{ech}} deployment \| Self-managed cluster in your network \| Outbound from Elastic over the public internet to your cluster's endpoint. Allow the connection with IP-based rules on your side. \| No. {{ech}} deployments can't create private endpoints for customer networks. \|

Uh oh!

Conversation

alxchalkias commented Jul 24, 2026

Summary

Why

Test plan

Uh oh!

cla-checker-service Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Elastic Docs Style Checker (Vale)

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

eedugon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jakommo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shainaraskas commented Jul 27, 2026

Uh oh!

alxchalkias commented Jul 28, 2026

Uh oh!

eedugon left a comment

Choose a reason for hiding this comment

Uh oh!

nikfot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cla-checker-service Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading