# ILM \`security\_exception\` error

**URL:** <https://discuss.elastic.co/t/ilm-security-exception-error/232172>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, ilm-index-lifecycle-management\
**Created:** [May 12, 2020, 8:46am UTC](https://discuss.elastic.co/t/ilm-security-exception-error/232172 "2020-05-12T08:46:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\
**Post date:** [May 12, 2020, 8:46am UTC](https://discuss.elastic.co/t/ilm-security-exception-error/232172/1 "2020-05-12T08:46:15Z")

</div>

Hey there,

So, I currently have a cluster running for timeseries with security enabled.

There's one main ILM policy, let's call it _policy1_:

```json
"policy" : {
      "phases" : {
        "warm" : {
          "min_age" : "0ms",
          "actions" : {
            "allocate" : {
              "number_of_replicas" : 1,
              "include" : { },
              "exclude" : { },
              "require" : {
                "temp" : "hot"
              }
            },
            "forcemerge" : {
              "max_num_segments" : 1
            },
            "set_priority" : {
              "priority" : 100
            },
            "shrink" : {
              "number_of_shards" : 1
            }
          }
        },
        "cold" : {
          "min_age" : "23d",
          "actions" : {
            "allocate" : {
              "number_of_replicas" : 0,
              "include" : { },
              "exclude" : { },
              "require" : {
                "temp" : "warm"
              }
            },
            "freeze" : { },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "7d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "83d",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }

```

I use 2 different users to work on this cluster:

- _user1_ which has a lot of privileges, but no superuser privileges.
- _superuser_ which has...well, superuser privileges.

I guess I tried to do something which I couldn't with _user1_, because now I have a lot of ILM `security_exception` errors:

```json
 "reason" : "action [indices:admin/settings/update] is unauthorized for user [user1]"

```

To fix this, I tried the following:

- log in with _user1_ and retry ILM step.
- log in with _superuser_ and retry ILM step
- log in with _superuser_, give _user1_ superuser privileges, log out, log back in with _user1_ and retry ILM step
- log in with _superuser_ and use the `move_to_step` API (after finding what to put under "name")

And nothing.

Then I tried to create a new ILM policy, _policy2_, copying the _policy1_ but without rollover, so without hot phase. I removed _policy1_ from a problematic index and applied the new _policy2_. So far, so good, I don't have any error, but I'm not sure from when the "min\_age" will be counted, so I'm not sure if it's normal that my index is still not deleted or not.

The last weird thing I noticed is that I created a whole new index template and bootstrapped a new index with the _policy1_ applied to it, all this while being logged in with _superuser_.  
A few minutes later, it already appears that it has the same ILM error on it (on the `set_priority` step):

```json
"reason" : "action [indices:admin/settings/update] is unauthorized for user [user1]"

```

This I really don't understand as _user1_ was never involved in anything about this index.

Does anyone as an idea of what is happening here?

Thanks in advance for your help!

Cheers,

jsu

---

<div class="post-metadata">

**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\
**Post date:** [May 12, 2020, 1:20pm UTC](https://discuss.elastic.co/t/ilm-security-exception-error/232172/2 "2020-05-12T13:20:50Z")

</div>

When the ILM policy is created, ES stores the credentials that were used by whatever user created the policy. These credentials are what is used for executing ILM actions.

It sounds like with your current users you can do `PUT /_ilm/policy1` with your `superuser` user (it can even be the same policy body), which will then have permissions to perform any of the ILM actions.

---

<div class="post-metadata">

**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\
**Post date:** [May 13, 2020, 10:14am UTC](https://discuss.elastic.co/t/ilm-security-exception-error/232172/3 "2020-05-13T10:14:53Z")

</div>

Thanks a lot @dakrone !

Indeed, I thought that updating my `user1` privileges would solve this as the original creator of the policy now had enough privileges for ILM actions. This didn't work.

But indeed updating the policy (exact same body, as you suggested) was the way to go! I could then "retry lifecycle step" for every problematic index (doing it in bulk didn't work for some reason) and everything worked like a charm. Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2020, 10:15am UTC](https://discuss.elastic.co/t/ilm-security-exception-error/232172/4 "2020-06-10T10:15:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.