# Append-Only Index for Life **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [September 13, 2021, 10:38am UTC](https://discuss.elastic.co/t/append-only-index-for-life/284054 "2021-09-13T10:38:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ndtreviv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ndtreviv/32/22494_2.png) [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Post date:** [September 13, 2021, 10:38am UTC](https://discuss.elastic.co/t/append-only-index-for-life/284054/1 "2021-09-13T10:38:32Z")
We currently write audit logs and metrics to an elasticsearch index. I'm trying to find a way to prevent a VM admin user from logging into the VM that runs elasticsearch and being able to delete or update audit log documents in an index. The best I can come up with is RBAC, but as far as I can see that doesn't prevent an admin from giving themselves the necessary access, performing an update or delete, and then removing the access again. Is it possible to have an elasticsearch index that is append-only from the outset, with no chance of changing it at all? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 13, 2021, 11:46pm UTC](https://discuss.elastic.co/t/append-only-index-for-life/284054/2 "2021-09-13T23:46:57Z")
> [@ndtreviv](#): > > Is it possible to have an elasticsearch index that is append-only from the outset, with no chance of changing it at all? Not directly, no. You'd need to build a policy that only provides read only access to the indices, while restricting escalation assignment. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 11, 2021, 11:47pm UTC](https://discuss.elastic.co/t/append-only-index-for-life/284054/3 "2021-10-11T23:47:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.