From bd9b2d1f384bad62bcc47188391a77aac5eff90d Mon Sep 17 00:00:00 2001 From: Dario Gieselaar Date: Thu, 25 Jun 2020 09:48:54 +0200 Subject: [PATCH 1/2] Add read privileges for observability-annotations index for apm_user role Closes elastic/kibana#69642. --- .../xpack/core/security/authz/store/ReservedRolesStore.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index 24d941919d2df..e462587c35979 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -180,7 +180,9 @@ private static Map initializeReservedRoles() { RoleDescriptor.IndicesPrivileges.builder().indices("apm-*") .privileges("read", "view_index_metadata").build(), RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*") - .privileges("view_index_metadata", "read").build(), + .privileges("read", "view_index_metadata").build(), + RoleDescriptor.IndicesPrivileges.builder().indices("observability-annotations") + .privileges("read", "view_index_metadata").build() }, null, MetadataUtils.DEFAULT_RESERVED_METADATA)) .put("machine_learning_user", new RoleDescriptor("machine_learning_user", new String[] { "monitor_ml" }, new RoleDescriptor.IndicesPrivileges[] { From 1b45584c97c1ff3ce0dacc21810ae05fbd5f3e1e Mon Sep 17 00:00:00 2001 From: Dario Gieselaar Date: Mon, 29 Jun 2020 08:50:58 +0200 Subject: [PATCH 2/2] Add test for apm_user's read-only access to observability-annotations --- .../core/security/authz/store/ReservedRolesStoreTests.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 3c7f3c92eef4d..c56d91abb03ec 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1148,6 +1148,8 @@ public void testAPMUserRole() { assertOnlyReadAllowed(role, "apm-" + randomIntBetween(0, 5)); assertOnlyReadAllowed(role, AnomalyDetectorsIndexFields.RESULTS_INDEX_PREFIX + AnomalyDetectorsIndexFields.RESULTS_INDEX_DEFAULT); + + assertOnlyReadAllowed(role, "observability-annotations"); } public void testMachineLearningAdminRole() {