# Limit a role and API key privledges
**URL:** https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [June 13, 2023, 2:38pm UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883 "2023-06-13T14:38:01Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@alongaks](https://discuss.elastic.co/u/alongaks)
#### Post date: [June 13, 2023, 2:38pm UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883/1 "2023-06-13T14:38:01Z")
Hello,
I have a use case for creating a 'stack maintenance' user that will be called up with Ansible to perform the `cluster.routing.allocation.enable` action to limit shard allocation before Elasticsearch is stopped and other maintenance tasks completed/run:
```auto
curl -k -X PUT https://hostname:9200/_cluster/settings -H 'Content-Type: application/json' -H 'Authorization: ApiKey [encoded]' -d'
{
"persistent": {
"cluster.routing.allocation.enable": "primaries"
}
}
'
```
This works as expected from the standard command line above. I will work on testing it with Ansible.
Question is, can the role assigned/user API key configured `Cluster privileges 'cluster:admin/settings/update'` be further limited to only allow the assigned role on the user/user's API key the privs to touch _only_ `cluster.routing.allocation.enable` setting?
Having the privs for `cluster:admin/settings/update` is still powerful for what will be used as a 'maintenance' account.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [June 14, 2023, 12:26am UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883/2 "2023-06-14T00:26:43Z")
> [@alongaks](#):
>
> can the role assigned/user API key configured `Cluster privileges 'cluster:admin/settings/update'` be further limited to only allow the assigned role on the user/user's API key the privs to touch _only_ `cluster.routing.allocation.enable` setting?
No, currently this is not possible.
---
### Author:  [@alongaks](https://discuss.elastic.co/u/alongaks)
#### Post date: [June 14, 2023, 12:29pm UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883/3 "2023-06-14T12:29:22Z")
Ok, thanks for confirming!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2023, 12:29pm UTC](https://discuss.elastic.co/t/limit-a-role-and-api-key-privledges/335883/4 "2023-07-12T12:29:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.