How can we secure the actuator endpoints?

Question

Accepted Answer

Spring Boot Actuator endpoints expose application health, metrics, environment details, thread information, and other operational data. Since some endpoints may reveal sensitive system information, they must be properly secured to prevent unauthorized access.

Key Points:
• Expose only the actuator endpoints that are required for monitoring.
• Protect actuator endpoints using Spring Security authentication and authorization.
• Use HTTPS and role-based access control to secure sensitive operational data.

Example:
In a production banking application, operations teams may need access to health and metrics endpoints, while regular users should not be able to view any actuator information.

Code Example:

```
application.properties

management.endpoints.web.exposure.include=health,info,metrics
```
Spring Security Configuration:

```
@Bean
public SecurityFilterChain securityFilterChain(
        HttpSecurity http) throws Exception {
```
    http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/actuator/**")
        .hasRole("ACTUATOR_ADMIN")
        .anyRequest()
```
        .authenticated());

return http.build();
}
```
In this example, only users with the ACTUATOR_ADMIN role can access actuator endpoints.

Additional Security Measures:

• Expose only necessary endpoints such as health and info.
• Disable sensitive endpoints like env, beans, and heapdump if not required.
• Run actuator endpoints on a separate management port.
• Restrict access using firewall or network policies.
• Always use HTTPS for encrypted communication.

Example:

management.server.port=9090

This separates actuator traffic from normal application traffic.

Real-World Example:

In a microservices environment:

• Prometheus accesses metrics endpoints.
• DevOps engineers access health endpoints.
• Application users cannot access actuator endpoints.

This provides monitoring capabilities while maintaining security.

Interview Tip:
A concise interview answer is: We can secure Actuator endpoints by limiting endpoint exposure, enabling Spring Security authentication and authorization, assigning a dedicated role such as ACTUATOR_ADMIN, using HTTPS, and exposing only the required monitoring endpoints. This ensures operational data remains accessible only to authorized users.