Need to give read access .fleet-artifacts system index to non admin user(Developer Role)

Elastic Stack Elasticsearch
1

I want to give read access to .fleet-artifacts index to non admin users, these users having developer role. I have given the permission but i am getting following error when i try to access via api.

"type": "security_exception",
"reason": "action [indices:admin/get] is unauthorized for user with effective roles [developer,kibana_user,monitoring_user,reporting_user,vx_beats] on restricted indices [.fleet-artifacts], this action is granted by the index privileges [view_index_metadata,manage,all]"

I can see same index with Admin user but not able to read with non admin user.

Any idea how can i give access to this index to non admin user ?

2

Are you configuring the role via the API or Kibana (or via files)?

You need to configure the role with allow_restricted_indices: true, but the exact instructions will depend on which method you are using.

3

Role is created in Kibana, You can see in below image i have given read access, but i did not see where i have to write allow_restricted_indices: true ?

image
image1521×374 32.2 KB

4

You can't set allow_restricted_indices using the UI, Elastic does not expose this setting through the UI.

You will need to create a specific role using the API, and then add this role to your user.

The request would be something like this:

PUT _security/role/grant_system_indices
{
  "indices": [
    {
      "names": [
        ".fleet*"
      ],
      "privileges": [
        "read"
      ],
      "allow_restricted_indices": true
    }
  ]
}
5

I did but retuen false.

{
"role": {
"created": false
}
}

6

If you updated an existing role, then it was not created

7

As you can see in below image i set value true and its showing in role as well, but when i try to access index via non admin use it give same error.

image

"type": "security_exception",
"reason": "action [indices:admin/get] is unauthorized for user with effective roles [developer,kibana_user,monitoring_user,reporting_user,vx_beats] on restricted indices [.fleet-artifacts], this action is granted by the index privileges [view_index_metadata,manage,all]"

8

May there is no any way to go access to system index to non admin user, i mean its restriction from elasticsearch.

9

No, it should work if you created the role and added it to your user.

Can you share the full request you made? You didn't share the role name.

Also, did you add the new role to your user?

10

Here is the full request. I created developer role, I did not get added user, how can i do it ? I mean user is part of developer role so I should not add this user.

PUT _security/role/developer
{
    "cluster": [
      "manage_watcher",
      "manage_ingest_pipelines",
      "read_ilm",
      "read_pipeline",
      "read_ccr",
      "read_slm",
      "manage_ml",
      "manage_transform"
    ],
    "indices": [
      {
        "names": [
          "apm-*",
          "winston-*",
          "filebeat-*",
          "metricbeat-*",
          "application-*",
          "log4stash-*",
          "monolog-*",
          "logs-*",
          ".watches",
          ".triggered_watches",
          ".watcher-history-*",
          "traces-*",
          "logs-apm* ",
          "metrics-apm*",
          ".ds*",
          "metrics-*",
          "logs-* ",
          "gco-*",
          ".apm-source-map"
        ],
        "privileges": [
          "read",
          "view_index_metadata",
          "index"
        ],
        "field_security": {
          "grant": [
            "*"
          ],
          "except": []
        },
        "allow_restricted_indices": false
      },
      {
        "names": [
          ".slo-*"
        ],
        "privileges": [
          "all"
        ],
        "field_security": {
          "grant": [
            "*"
          ]
        },
        "allow_restricted_indices": false
      },
      {
        "names": [
          ".fleet-artifacts*"
        ],
        "privileges": [
          "read"
        ],
        "field_security": {
          "grant": [
            "*"
          ]
        },
        "allow_restricted_indices": true
      }
    ],
    "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_discover.all",
          "feature_dashboard.all",
          "feature_canvas.all",
          "feature_maps.all",
          "feature_ml.all",
          "feature_graph.all",
          "feature_visualize.all",
          "feature_logs.all",
          "feature_infrastructure.all",
          "feature_apm.all",
          "feature_uptime.all",
          "feature_actions.all",
          "feature_stackAlerts.all",
          "feature_savedObjectsTagging.all",
          "feature_dev_tools.all",
          "feature_savedObjectsManagement.all",
          "feature_indexPatterns.all",
          "feature_slo.all"
        ],
        "resources": [
          "*"
        ]
      },
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_indexPatterns.all"
        ],
        "resources": [
          "space:eventbus",
          "space:gco"
        ]
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
}
11

Also I created this role mapping as well with my non admin user.

POST /_security/role_mapping/restricted_index
{
  "roles": [ "developer"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : [ "joshis" ] }
  },
  "metadata" : { 
    "version" : 1
  }
}
12

I would recommend to have it on a separate rolle and at this role to the role mapping of the user, but this should work as well.

Not sure why it is not working.

How are you making the request? Are you using an API Key?

13

Yes I doing this by API

14

I will try this and Update here, Thanks

15

API Key are not updated when you update the role, you need to create a new API Key to reflect the changes.

16

Yes it do, it will update it, I checked it after making request.

17

I created new role mapping with my user as we are using active dir I created using following request but still not working.

POST /_security/role_mapping/restricted_index

{

  "roles": [ "developer"],

  "enabled": true, 

  "rules": {

    "field" : { "username" : "cn=Sachin`Preformatted text`,dc=XXXX,dc=XXXX" }

  },

  "metadata" : { 

    "version" : 1

  }

}
18

read allows reading documents, it does not allow access to the index itself.
You need to grant view_index_metadata as well.