# Need to give read access .fleet-artifacts system index to non admin user(Developer Role)

**URL:** <https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 5, 2024, 7:46am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082 "2024-09-05T07:46:37Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 5, 2024, 7:46am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/1 "2024-09-05T07:46:37Z")

</div>

I want to give read access to .fleet-artifacts index to non admin users, these users having developer role. I have given the permission but i am getting following error when i try to access via api.

"type": "security\_exception",  
"reason": "action [indices:admin/get] is unauthorized for user with effective roles [developer,kibana\_user,monitoring\_user,reporting\_user,vx\_beats] on restricted indices [.fleet-artifacts], this action is granted by the index privileges [view\_index\_metadata,manage,all]"

I can see same index with Admin user but not able to read with non admin user.

Any idea how can i give access to this index to non admin user ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 5, 2024, 11:34am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/2 "2024-09-05T11:34:14Z")

</div>

Are you configuring the role via the API or Kibana (or via files)?

You need to configure the role with `allow_restricted_indices: true`, but the exact instructions will depend on which method you are using.

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 5, 2024, 11:48am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/3 "2024-09-05T11:48:52Z")

</div>

Role is created in Kibana, You can see in below image i have given read access, but i did not see where i have to write `allow_restricted_indices: true` ?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d86621c534bf94e13cee8d1785498fa8f7a34b1.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 5, 2024, 12:08pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/4 "2024-09-05T12:08:23Z")

</div>

You can't set `allow_restricted_indices` using the UI, Elastic does not expose this setting through the UI.

You will need to create a specific role using the API, and then add this role to your user.

The request would be something like this:

```auto
PUT _security/role/grant_system_indices
{
  "indices": [
    {
      "names": [
        ".fleet*"
      ],
      "privileges": [
        "read"
      ],
      "allow_restricted_indices": true
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 5, 2024, 12:58pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/5 "2024-09-05T12:58:03Z")

</div>

I did but retuen false.

{  
"role": {  
"created": false  
}  
}

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 6, 2024, 2:03am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/6 "2024-09-06T02:03:14Z")

</div>

If you updated an existing role, then it was not `created`

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 11:33am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/7 "2024-09-06T11:33:04Z")

</div>

As you can see in below image i set value true and its showing in role as well, but when i try to access index via non admin use it give same error.

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6866050c1a1747d1f4ebc8f17e031e9bbf64721.png)

"type": "security\_exception",  
"reason": "action [indices:admin/get] is unauthorized for user with effective roles [developer,kibana\_user,monitoring\_user,reporting\_user,vx\_beats] on restricted indices [.fleet-artifacts], this action is granted by the index privileges [view\_index\_metadata,manage,all]"

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 11:34am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/8 "2024-09-06T11:34:15Z")

</div>

May there is no any way to go access to system index to non admin user, i mean its restriction from elasticsearch.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2024, 12:29pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/9 "2024-09-06T12:29:12Z")

</div>

No, it should work if you created the role and added it to your user.

Can you share the full request you made? You didn't share the role name.

Also, did you add the new role to your user?

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 12:36pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/10 "2024-09-06T12:36:54Z")

</div>

Here is the full request. I created developer role, I did not get added user, how can i do it ? I mean user is part of developer role so I should not add this user.

```auto
PUT _security/role/developer
{
    "cluster": [
      "manage_watcher",
      "manage_ingest_pipelines",
      "read_ilm",
      "read_pipeline",
      "read_ccr",
      "read_slm",
      "manage_ml",
      "manage_transform"
    ],
    "indices": [
      {
        "names": [
          "apm-*",
          "winston-*",
          "filebeat-*",
          "metricbeat-*",
          "application-*",
          "log4stash-*",
          "monolog-*",
          "logs-*",
          ".watches",
          ".triggered_watches",
          ".watcher-history-*",
          "traces-*",
          "logs-apm* ",
          "metrics-apm*",
          ".ds*",
          "metrics-*",
          "logs-* ",
          "gco-*",
          ".apm-source-map"
        ],
        "privileges": [
          "read",
          "view_index_metadata",
          "index"
        ],
        "field_security": {
          "grant": [
            "*"
          ],
          "except": []
        },
        "allow_restricted_indices": false
      },
      {
        "names": [
          ".slo-*"
        ],
        "privileges": [
          "all"
        ],
        "field_security": {
          "grant": [
            "*"
          ]
        },
        "allow_restricted_indices": false
      },
      {
        "names": [
          ".fleet-artifacts*"
        ],
        "privileges": [
          "read"
        ],
        "field_security": {
          "grant": [
            "*"
          ]
        },
        "allow_restricted_indices": true
      }
    ],
    "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_discover.all",
          "feature_dashboard.all",
          "feature_canvas.all",
          "feature_maps.all",
          "feature_ml.all",
          "feature_graph.all",
          "feature_visualize.all",
          "feature_logs.all",
          "feature_infrastructure.all",
          "feature_apm.all",
          "feature_uptime.all",
          "feature_actions.all",
          "feature_stackAlerts.all",
          "feature_savedObjectsTagging.all",
          "feature_dev_tools.all",
          "feature_savedObjectsManagement.all",
          "feature_indexPatterns.all",
          "feature_slo.all"
        ],
        "resources": [
          "*"
        ]
      },
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_indexPatterns.all"
        ],
        "resources": [
          "space:eventbus",
          "space:gco"
        ]
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
}

```

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 1:26pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/11 "2024-09-06T13:26:24Z")

</div>

Also I created this role mapping as well with my non admin user.

```auto
POST /_security/role_mapping/restricted_index
{
  "roles": ["developer"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : ["joshis"] }
  },
  "metadata" : { 
    "version" : 1
  }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2024, 1:30pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/12 "2024-09-06T13:30:09Z")

</div>

I would recommend to have it on a separate rolle and at this role to the role mapping of the user, but this should work as well.

Not sure why it is not working.

How are you making the request? Are you using an API Key?

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 1:48pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/13 "2024-09-06T13:48:47Z")

</div>

Yes I doing this by API

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 6, 2024, 1:49pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/14 "2024-09-06T13:49:53Z")

</div>

I will try this and Update here, Thanks

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2024, 2:27pm UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/15 "2024-09-06T14:27:50Z")

</div>

> [@SachinJoshi](#):
>
> Yes I doing this by API

API Key are not updated when you update the role, you need to create a new API Key to reflect the changes.

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 13, 2024, 11:21am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/16 "2024-09-13T11:21:15Z")

</div>

Yes it do, it will update it, I checked it after making request.

---

<div class="post-metadata">

**Author:** ![SachinJoshi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SachinJoshi](https://discuss.elastic.co/u/SachinJoshi)\
**Post date:** [September 13, 2024, 11:23am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/17 "2024-09-13T11:23:09Z")

</div>

I created new role mapping with my user as we are using active dir I created using following request but still not working.

```auto
POST /_security/role_mapping/restricted_index

{

  "roles": ["developer"],

  "enabled": true, 

  "rules": {

    "field" : { "username" : "cn=Sachin`Preformatted text`,dc=XXXX,dc=XXXX" }

  },

  "metadata" : { 

    "version" : 1

  }

}        

```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 16, 2024, 4:07am UTC](https://discuss.elastic.co/t/need-to-give-read-access-fleet-artifacts-system-index-to-non-admin-user-developer-role/366082/18 "2024-09-16T04:07:00Z")

</div>

> [@SachinJoshi](#):
>
> granted by the index privileges [view\_index\_metadata,manage,all]

> [@SachinJoshi](#):
>
> ```auto
> "privileges": [
> "read"
> ],
> 
> ```

`read` allows reading documents, it does not allow access to the index itself.  
You need to grant `view_index_metadata` as well.