# Action \[indices:admin/create\] is unauthorized for user

**URL:** https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [April 28, 2022, 4:51am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458 "2022-04-28T04:51:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mattstubbs](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mattstubbs](https://discuss.elastic.co/u/mattstubbs)
#### Post date: [April 28, 2022, 4:51am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458/1 "2022-04-28T04:51:10Z")

</div>

Hi Team,

**tl;dr** : Complains that user needs one of `[create_index,manage,all]`, but user has `create_index` and `manage`

A pretty basic error message here that seems very straightforward but is giving my team trouble.

I am trying to run this command in Kibana DevTools Console:

```auto
PUT /test-search/
{
	"mappings":{
		"properties":{
			"id":{
				"type":"integer"
			}
		}
	}
}

```

However the response is:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "action [indices:admin/create] is unauthorized for user [matt.stubbs@fakeemail.com] with roles [IRE Core Team,monitoring_user] on indices [test-search], this action is granted by the index privileges [create_index,manage,all]"
      }
    ],
    "type" : "security_exception",
    "reason" : "action [indices:admin/create] is unauthorized for user [matt.stubbs@fakeemail.com] with roles [IRE Core Team,monitoring_user] on indices [test-search], this action is granted by the index privileges [create_index,manage,all]"
  },
  "status" : 403
}

```

So it SEEMS that my user doesn't have the specified privileges in the assigned roles... however, they are set:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdbec9e4d3828fedcdbc50816460223bd2aae88f.png)

My first thought was that the user wasn't mapped correctly, but I checked that and the correct role is showing in the error message anyway. So... I'm not sure what I'm missing here. Any help appreciated!

---

<div class="post-metadata">

### Author: ![mattstubbs](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mattstubbs](https://discuss.elastic.co/u/mattstubbs)
#### Post date: [April 28, 2022, 5:42am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458/2 "2022-04-28T05:42:12Z")

</div>

After trying some of the dumbest stuff ever written on the internet a fix was found.  
Just change the indicies field to be `*`

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 29, 2022, 1:02am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458/3 "2022-04-29T01:02:57Z")

</div>

Welcome to our community! 😃

Thanks heaps for sharing your solution as well.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2022, 1:03am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458/4 "2022-05-27T01:03:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.