Add ILM-specific security privileges #36493
Conversation
talevy
added
WIP
:Data Management/ILM+SLM
|
Pinging @elastic/es-core-features |
talevy
force-pushed
the
ilm-manage
branch
2 times, most recently
from
38199f8
to
7b4c0d5
Compare
Although managing ILM policies is best done using the "manage" cluster privilege, it is useful to have read-only views. * adds `read_ilm` cluster privilege for viewing policies and status * adds Explain API to the `view_index_metadata` index privilege
talevy
changed the title
There was a problem hiding this comment.
Whilst these changes are ok and the extra privileges may be useful what we need most is a manage_ilm privilege which grants access to the CRUD policy ILM APIs as well as the start and stop APIs (basically the ILM equivalent of the manage_ccr privilege). This enables users to grant e.g. the user that sets up Beats this manage_ilm privilege instead of having to grant it the cluster manage privilege which will give it more control of the cluster than it needs.
The user will also need to grant the user that sets up the policy index privileges so the policy can run with the permissions needed to execute all the actions but index privileges already exist to allow this to do done.
|
thanks @colings86, I've updated. I think Docs can be done in separate PRs against ES and the Stack Docs repos. |
* add read_ilm cluster privilege Although managing ILM policies is best done using the "manage" cluster privilege, it is useful to have read-only views. * adds `read_ilm` cluster privilege for viewing policies and status * adds Explain API to the `view_index_metadata` index privilege * add manage_ilm privileges
* elastic/master: Remove deprecated `useDisMax` from MultiMatchQuery (elastic#36488) HLRC: Add get users action (elastic#36332) fix MultiValuesSourceFieldConfig toXContent (elastic#36525) Add ILM-specific security privileges (elastic#36493) Remove usages of `MockTcpTransport` from zen tests (elastic#36579)
This commit adds the `manage_ilm`, `read_ilm` cluster privileges, and the `manage_ilm` index privilege. these were introduced into ES by: elastic/elasticsearch#36493
This commit adds the `manage_ilm`, `read_ilm` cluster privileges, and the `manage_ilm` index privilege. these were introduced into ES by: elastic/elasticsearch#36493
adds ILM-specific security privileges to fine-tune control of how users set and retrieve
ILM data.
Cluster Privileges:
manage_ilm: permissions for allcluster:admin/ilm/*actionsread_ilm: permissions for getting ILM Status, and PoliciesIndex Privileges:
view_index_metadataprivilegeOne thing to note is that the permissions of the user setting a policy are used when
running policy actions. This means that the user with
manage_ilmpermissions thatcreated the policy should also have
manageindex privileges on those indices beingmanaged with that policy.