Indices:admin/template/put is a "cluster" action?

[amiryesh (Amir Yeshurun)]

Hello,

I am trying to use the default "readwrite" role,
I am performing a put-index-template operation, and get the error:

action [indices:admin/template/put] is unauthorized for user [readwrite]

As the message states, the action is a "index" action, not a "cluster" action.

However, the role definition grants "all" privileges on all indices

readwrite:
cluster: monitor
indices:
'*': all

Changing "cluster: monitor" to "cluster:all" solves the problem.
This implies that there is a "cluster" level privilege that is required to perform the template-put operation.

My questions are:

1. What is the cluster level privilege that is required here?
2. Where can I find a list of privilege names and their description? (could not find this in the documentation)
3. Where can I see Shield logs in elastic.cloud so that I can further debug such issues on my own?

Thanks
/amiry

[jaymode (Jay Modi)]

@amiryesh

What is the cluster level privilege that is required here?

The cluster manage_index_templates permission is required. This is required because index templates can be applied globally, so changing them requires cluster management permissions.

@amiryesh

Where can I find a list of privilege names and their description? (could not find this in the documentation)

Take a look at Shield Privileges | Shield [2.4] | Elastic

@amiryesh

Where can I see Shield logs in elastic.cloud so that I can further debug such issues on my own?

I suggest you ask this question in the #cloud section.