# Updating role privileges is not effective
**URL:** https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [July 15, 2021, 2:11pm UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799 "2021-07-15T14:11:56Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@kpe](https://discuss.elastic.co/u/kpe)
#### Post date: [July 15, 2021, 2:11pm UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799/1 "2021-07-15T14:11:56Z")
Hello,
I've set an api\_key to manage an index but I'm getting this error :
```auto
Error: [403] {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for API key id [******] of user [logstash_internal] on indices [services_kpis], this action is granted by the index privileges [read,all]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for API key id [******] of user [logstash_internal] on indices [services_kpis], this action is granted by the index privileges [read,all]"},"status":403}
Exception: Elasticsearch::Transport::Transport::Errors::Forbidden
```
Then I've added the missing privileges "read" but still the same error.
```auto
curl -sS -H "Authorization: ApiKey *******" https://localhost:9200/_security/role/logstash_writer | jq -r '.logstash_writer | .cluster, .indices'
[
"manage_index_templates",
"monitor",
"manage_ilm",
"manage_api_key",
"manage_own_api_key"
]
[
{
"names": [
"services_kpis"
],
"privileges": [
"write",
"create",
"delete",
"create_index",
"manage",
"manage_ilm",
"create_doc",
"view_index_metadata",
"read"
],
"allow_restricted_indices": false
}
]
```
Why isn't directly effective ? If we have to restart all processes it's a shame...
Regards,
Kevin
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [July 16, 2021, 12:14am UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799/2 "2021-07-16T00:14:23Z")
An API key's privileges are immutable after its initial creation. It basically takes a [snapshot](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html#security-api-create-api-key-request-body) of the creator's privileges at creation time. If you update the creator's roles afterwards, you need create a new API key to reflect the changes.
---
### Author:  [@kpe](https://discuss.elastic.co/u/kpe)
#### Post date: [July 16, 2021, 8:52am UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799/3 "2021-07-16T08:52:30Z")
Thanks for your reply. Maybe we could add a note in the Create API key documentation 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 13, 2021, 8:52am UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799/4 "2021-08-13T08:52:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.