RBAC - Manage spaces - how to disable it?

Elastic Stack Kibana
1

In elastic stack 9.4 we want to disable /enable "Manage spaces" functionality.
I found only this in the documentation:
"An example of a built-in role is kibana_admin. Assigning this role to your users will grant access to all of Kibana's features. This includes the ability to manage spaces."

Is there another way to enable that functionality? I don't want to give users such a role.

I saw that by default this functionality is hidden.

   "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_discover_v2.all",
          "feature_dashboard_v2.all",
          "feature_visualize_v2.all",
          "feature_indexPatterns.all",
          "feature_savedObjectsManagement.all",
          "feature_fleetv2.read",
          "feature_fleet.read"
        ],
        "resources": [
          "*"
        ]
      }
    ]
2

You can create a custom role that excludes the spaces feature privilege.

Use the following API call to create the role

PUT /api/security/role/my_custom_role
{
  "elasticsearch": {
    "cluster": [],
    "indices": []
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "discover_v2": ["all"],
        "dashboard_v2": ["all"],
        "visualize_v2": ["all"],
        "indexPatterns": ["all"],
        "savedObjectsManagement": ["all"],
        "fleetv2": ["read"],
        "fleet": ["read"]
        # No "spaces" entry → Manage spaces access denied
      },
      "spaces": ["*"]
    }
  ]
}

Once the role is created, assign it to the relevant users via Stack Management → Security → Users, or using the Kibana user management API.

3

I will test it and let you know

4

Ah, wrong API endpoint, try this instead

PUT _security/role/my_custom_role
{
  "cluster": [],
  "indices": [],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_discover_v2.all",
        "feature_dashboard_v2.all",
        "feature_visualize_v2.all",
        "feature_indexPatterns.all",
        "feature_savedObjectsManagement.all",
        "feature_fleetv2.read",
        "feature_fleet.read"
      ],
      "resources": ["*"]
    }
  ]
}
5

Hi , thanks a lot . This unfortunately does not solve our issue. It is hidden by default . I want to find which one is the option to enable it for specific users (without set kibana_admin role to their users)

6

Hello @Ts_P

Related to this concern i already see below github issues which are open :

Thanks!!

7

thanks a lot for clarifying @Tortoise . thanks @covj12 for your help as well