# PREVENT USER FROM DELETING INDEX

**URL:** <https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322>\
**Category:** Elastic Security\
**Tags:** elastic-stack-security\
**Created:** [March 10, 2022, 10:40am UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322 "2022-03-10T10:40:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darshil\_Shah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshil_shah/32/99145_2.png) [@Darshil\_Shah](https://discuss.elastic.co/u/Darshil_Shah)\
**Post date:** [March 10, 2022, 10:40am UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322/1 "2022-03-10T10:40:20Z")

</div>

I have created one role from Kibana in which i have given read and write privilege , but the users are still able to delete index with \_delete\_by\_query API call.  
How can i prevent user from deleting index ?

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [March 11, 2022, 8:10am UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322/2 "2022-03-11T08:10:38Z")

</div>

What are the exact permissions given to the role?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 11, 2022, 11:17am UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322/3 "2022-03-11T11:17:15Z")

</div>

Per the [documentation on index privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices), `write` includes permission to delete.

If you don't want your users to be able to delete documents, you should use a different privilege such as `index`.

---

<div class="post-metadata">

**Author:** ![swchandu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/swchandu/32/95295_2.png) [@swchandu](https://discuss.elastic.co/u/swchandu)\
**Post date:** [March 11, 2022, 12:39pm UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322/4 "2022-03-11T12:39:58Z")

</div>

It is not possible to delete the index with read/write only permission.  
check the access

"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "action [indices:admin/delete] is unauthorized for user [ding] with roles [zxy], this action is granted by the index privileges [delete\_index,manage,all]"  
}  
],  
"type" : "security\_exception",  
"reason" : "action [indices:admin/delete] is unauthorized for user [ding] with roles [zxy], this action is granted by the index privileges [delete\_index,manage,all]"  
},  
"status" : 403

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2022, 12:40pm UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322/5 "2022-04-08T12:40:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.