# More fine grained privilege than "manage" on indices? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 7, 2018, 8:44am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678 "2018-09-07T08:44:08Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![JohanRask](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johanrask/32/22713_2.png) [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Post date:** [September 7, 2018, 8:44am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678/1 "2018-09-07T08:44:09Z")
We are forced to use a specific user for deployment and we are performing a /\_flush/synced during installation. As I understand, I can not have more fine grained control than "manage" which means that this user can also delete indices, is this correct? Regards /Johan ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [September 7, 2018, 9:28am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678/2 "2018-09-07T09:28:31Z")
Hello @JohanRask Yes, It is true that granting the `manage` index privilege will allow the user to delete indices. That's because we define and name union of privileges that we consider are usable together. This is a maintenance and usability balancing act. There exist fine grained privileges that we don't expose. In your case, you could add `indices:admin/flush` instead of `manage` (which as you pointed out is a superset). The user would only have privileges to call the `_flush` API. We generally don't encourage using low level privilege names because changing these is the only way we can "rebalance" them into more relevant unions that we then expose. That is, we will change them when we decide we need to restructure the model without thinking about backwards compatibility (this would be in the release notes though). As a feedback to us, can you please share the complete set of privileges your deployment user requires? ---
**Author:** ![JohanRask](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johanrask/32/22713_2.png) [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Post date:** [September 7, 2018, 9:48am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678/3 "2018-09-07T09:48:14Z")
Thanks! admin/flush will do the trick for now! We are doing it by the book as specified in the documentation for rolling restarts/upgrades BUT this is an enterprise where the installation is not performed by us and we do not know when it will be performed so everything has to be fully automated. Currently we have (cluster=monitor+manage) so we can track progress for cluster status and also track relocating+init shards when doing a version upgrade. We disable shard allocation and perform a flush/synced before taking each node down. Basically, we do not need complete cluster=manage or indices=manage, only those specified above. Is this enough? /Johan ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [September 7, 2018, 10:03am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678/4 "2018-09-07T10:03:31Z")
Understood, thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2018, 10:03am UTC](https://discuss.elastic.co/t/more-fine-grained-privilege-than-manage-on-indices/147678/5 "2018-10-05T10:03:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.