# Security issue for indices shrunken by ILM? **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [March 2, 2022, 12:33pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616 "2022-03-02T12:33:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tomhe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomhe/32/120065_2.png) [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Post date:** [March 2, 2022, 12:33pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/1 "2022-03-02T12:33:47Z")
When using an ILM to shrink an index, the shrunken index gets a new name on the format `shrink--`, e.g. `shrink-j6-m-my-index` (for index `my-index`). In order to preserve access to both the shrunken index name and the original name I have to state both `my-index` and `shrink-*-my-index` in all roles that grant access to `my-index`. I believe that this opens up a security problem: Consider two indices `documents` and `secret-documents`. To grant access to the `documents` index after shrink I need to add `shrink-*-documents` as the index pattern in the role, but this pattern will then also unintentionally grant access to any shrunken `secret-documents` index (`shrink--secret-documents`). Question: Is there a recommended way to express index access privileges that supports the shrink ILM action (that does not unintentionally give access to secret data)? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 2, 2022, 1:15pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/2 "2022-03-02T13:15:10Z")
I don't think you need to change your roles to grant access to shrunken index, the ILM process will create an alias pointing to the original index name in the shrink index. For example, if you have an index named `my-documents` and have the shrink option in your ILM, after the phase with the shrink option is completed, you will have the `shrink-my-documents` index and this index will have an alias to `my-documents`, you will be able to query data in the `shrink-my-documents` index just querying on `my-documents`. Another example, if you have an index named `documents-2022.03.02`, after the shrink process, you will have `shrink-documents-2022.03.02` and this index will have an alias to `documents-2022.03.02`. I do not use shrink anymore on my ILM policies, but when I used it was transparent, no changes were needed in the roles as every index had an alias to the original name. ---
**Author:** ![tomhe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomhe/32/120065_2.png) [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Post date:** [March 2, 2022, 1:33pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/3 "2022-03-02T13:33:58Z")
Yes, the alias is created automatically, but access is granted on index name (and not alias name). ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 2, 2022, 1:39pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/4 "2022-03-02T13:39:15Z")
If the access is granted to `my-index` it doesn't matter if this is the index name or the alias, every request to `my-index` will work, every user that has permission to read the index `my-index` will be able to read `shrink-my-index` as this new shrunked index will have the alias `my-index`. ---
**Author:** ![tomhe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomhe/32/120065_2.png) [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Post date:** [March 3, 2022, 2:10pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/5 "2022-03-03T14:10:21Z")
You are correct. We must have made some mistake in our testing of this. The access privileges work with the alias name as you say. Thank you. ---
**Author:** ![tomhe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomhe/32/120065_2.png) [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Post date:** [March 3, 2022, 2:25pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/6 "2022-03-03T14:25:10Z")
After some more testing it was actually the \_refresh api call that does not work through the alias name. Even in a role that has "all" index privilege, the \_refresh call is not allowed. But this has nothing to do with the ILM or shrink action. ---
**Author:** ![tomhe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomhe/32/120065_2.png) [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Post date:** [March 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/7 "2022-03-03T14:47:05Z")
For reference, here is a bug report for that case: [Index privileges through alias name not working for \_refresh, \_flush · Issue #84626 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/84626) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 31, 2022, 2:47pm UTC](https://discuss.elastic.co/t/security-issue-for-indices-shrunken-by-ilm/298616/8 "2022-03-31T14:47:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.