# Indices:admin/template/put is a "cluster" action?

**URL:** <https://discuss.elastic.co/t/indices-admin-template-put-is-a-cluster-action/67262>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 27, 2016, 10:16am UTC](https://discuss.elastic.co/t/indices-admin-template-put-is-a-cluster-action/67262 "2016-11-27T10:16:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amiryesh](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@amiryesh](https://discuss.elastic.co/u/amiryesh)\
**Post date:** [November 27, 2016, 10:16am UTC](https://discuss.elastic.co/t/indices-admin-template-put-is-a-cluster-action/67262/1 "2016-11-27T10:16:43Z")

</div>

Hello,

I am trying to use the default "readwrite" role,  
I am performing a put-index-template operation, and get the error:

action [indices:admin/template/put] is unauthorized for user [readwrite]

As the message states, the action is a "index" action, not a "cluster" action.

However, the role definition grants "all" privileges on all indices

readwrite:  
cluster: monitor  
indices:  
'\*': all

Changing "cluster: monitor" to "cluster:all" solves the problem.  
This implies that there is a "cluster" level privilege that is required to perform the template-put operation.

My questions are:

1. What is the cluster level privilege that is required here?
2. Where can I find a list of privilege names and their description? (could not find this in the documentation)
3. Where can I see Shield logs in elastic.cloud so that I can further debug such issues on my own?

Thanks  
/amiry

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 7:49pm UTC](https://discuss.elastic.co/t/indices-admin-template-put-is-a-cluster-action/67262/2 "2016-12-05T19:49:39Z")

</div>

> [@amiryesh](#):
>
> What is the cluster level privilege that is required here?

The cluster `manage_index_templates` permission is required. This is required because index templates can be applied globally, so changing them requires cluster management permissions.

> [@amiryesh](#):
>
> Where can I find a list of privilege names and their description? (could not find this in the documentation)

Take a look at [Shield Privileges | Shield [2.4] | Elastic](https://www.elastic.co/guide/en/shield/current/shield-privileges.html)

> [@amiryesh](#):
>
> Where can I see Shield logs in elastic.cloud so that I can further debug such issues on my own?

I suggest you ask this question in the #cloud section.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2017, 7:50pm UTC](https://discuss.elastic.co/t/indices-admin-template-put-is-a-cluster-action/67262/3 "2017-01-02T19:50:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.