# Deployment issue with dedicated user - how to limit permissions? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [December 24, 2018, 10:41am UTC](https://discuss.elastic.co/t/deployment-issue-with-dedicated-user-how-to-limit-permissions/161998 "2018-12-24T10:41:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Dawid\_WWW](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@Dawid\_WWW](https://discuss.elastic.co/u/Dawid_WWW)\ **Post date:** [December 24, 2018, 10:41am UTC](https://discuss.elastic.co/t/deployment-issue-with-dedicated-user-how-to-limit-permissions/161998/1 "2018-12-24T10:41:45Z")
Hello, I have a problem with permissions access for elastic deployment with dedicated user. When I use superuser role for sample\_user, deployment works properly. The issue is begin with create new role. I wanted permission reduction but when I am creating new role with maximum setting it returns me this error - > ``` > fatal: [host-g]: FAILED! => changed=true > cmd: docker run -v /srv/docker/volumes/metricbeat/metricbeat-setup.yml:/usr/share/metricbeat/metricbeat.yml --rm --network host 10.X.X.X:443/sdwan/metricbeat:b01faf49dfa8 setup > delta: '0:00:02.033285' > end: '2018-12-17 14:27:03.325520' > invocation: > module_args: > _raw_params: docker run -v /srv/docker/volumes/metricbeat/metricbeat-setup.yml:/usr/share/metricbeat/metricbeat.yml --rm --network host 10.X.X.X:443/sdwan/metricbeat:b01faf49dfa8 setup > _uses_shell: true > argv: null > chdir: null > creates: null > executable: null > removes: null > stdin: null > warn: true > msg: non-zero return code > rc: 1 > start: '2018-12-17 14:27:01.292235' > stderr: |- > Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /usr/share/metricbeat/kibana: Failed to import index-pattern: Failed to load directory /usr/share/metricbeat/kibana/6/index-pattern: > error loading /usr/share/metricbeat/kibana/6/index-pattern/metricbeat.json: action [indices:data/write/bulk[s]] is unauthorized for user [aiops]. Response: {"objects":[{"id":"metricbeat-*","type":"index-pattern","error":{"message":"action [indices:data/write/bulk[s]] is unauthorized for user [aiops]"}}]} > stderr_lines: > - 'Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /usr/share/metricbeat/kibana: Failed to import index-pattern: Failed to load directory /usr/share/metricbeat/kibana/6/index-pattern:' > - ' error loading /usr/share/metricbeat/kibana/6/index-pattern/metricbeat.json: action [indices:data/write/bulk[s]] is unauthorized for user [aiops]. Response: {"objects":[{"id":"metricbeat-*","type":"index-pattern","error":{"message":"action [indices:data/write/bulk[s]] is unauthorized for user [aiops]"}}]}' > stdout: |- > Loaded index template > Loading dashboards (Kibana must be running and reachable) > stdout_lines: > > ``` If I see it correctly, I chose all available indicies. ![Screenshot%20from%202018-12-24%2011-19-13](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2de711a000b46485766f46005a217bfa04040f2.png) and this is how the superuser role looks like ![Screenshot%20from%202018-12-24%2011-19-31](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8b74bb6cd7c97496aa1cbecb82188cd121ca72f.png) Where else can I make a mistake? Regards, Dawid ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [December 24, 2018, 5:53pm UTC](https://discuss.elastic.co/t/deployment-issue-with-dedicated-user-how-to-limit-permissions/161998/2 "2018-12-24T17:53:42Z")
Hi @Dawid_WWW, Please don't post images of text as they are hard to read, may not display correctly for everyone, and not searchable. Instead paste the text and format it with \ icon, and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. For example, don't post a screenshot of how your role looks like in the UI, but do share the output of a call to the [`Get Roles API`](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role.html) for this role. A few additional comments: - Please describe what you are trying to do and what you are trying to do in more concrete terms. `elastic deployement with dedicated user` is unfortunately not enough for us to understand your environment and what you are trying to achieve. - > The issue is begin with create new role. I wanted permission reduction but when I am creating new role with maximum setting it returns me this error How do you actually try to create this new role? We do not have access to your ansible playbook so you need to share the relevant parts of that with us before we can assist in any way, or try to do the same using the API directly. - Since it looks like you want to run metricbeat in Docker, have you read through our [relevant documentation](https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-docker.html) ? - > action [indices:data/write/bulk[s]] is unauthorized for user [aiops]. Which user is this `aiops` user? What roles and permissions do they have ? - I guess this is for testing purposes but when you assign `all` for privileges, it is redundant to add any others explicitly. It would be great if you could update your post to solve the issues I mentioned and add all the missing information. This will highly affect your chances of getting a swift and meaningful answer. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 7, 2019, 5:53pm UTC](https://discuss.elastic.co/t/deployment-issue-with-dedicated-user-how-to-limit-permissions/161998/3 "2019-01-07T17:53:44Z")
Closed on January 7, 2019, 5:53pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.