# Assign a group of users READ only access to certain indices while allowing them to create visualizations?

**URL:** <https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651>\
**Category:** Elasticsearch\
**Created:** [August 23, 2018, 5:35am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651 "2018-08-23T05:35:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 23, 2018, 5:35am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651/1 "2018-08-23T05:35:41Z")

</div>

Hi,

We have set up AD authentication for our ELK stack and have successfully mapped ELK roles to our AD-groups which is working fantastically. Now we want to allow them to create visualizations as well, what is the recommended way to achieve this?

We've given them READ access to .kibana but we hesitate to give them WRITE access since that would affect the other indices which they have access to. So what is the recommended way to have a group of users have READ access to indices while at the same time WRITE to visualizations?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 23, 2018, 5:59am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651/2 "2018-08-23T05:59:40Z")

</div>

I don't quite follow.

If you grant **write** access to `.kibana` (e.g. by assigning them the `kibana_user` role) that doesn't give them write access to other indices. Each index is secured independently - you can have read acess to 1 index, write access to another, and _no_ access to everything else.

---

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 23, 2018, 6:03am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651/3 "2018-08-23T06:03:46Z")

</div>

Yeah i get that, but then we would have to have two roles right? Because as it is now, we've mapped Role1 to a Active Directory group which has READ access to certain indexes as well as .kibana. If we want them to have WRITE access to .kibana but still only have read access to regular indices we would have to create two roles right? One role for READ access to regular indices and another role for WRITE access to .kibana?

Sorry for my really poor explanation, it's too early in the morning and i haven't gotten my coffee fix yet ☕

EDIT: I totally forgot about that we can assign different access rules to multiple indices to a Role... That fixed my issue. Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2018, 6:03am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651/4 "2018-09-20T06:03:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.