# What is the best set of privileges for non-admin kibana user?

**URL:** <https://discuss.elastic.co/t/what-is-the-best-set-of-privileges-for-non-admin-kibana-user/41653>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 12, 2016, 7:46pm UTC](https://discuss.elastic.co/t/what-is-the-best-set-of-privileges-for-non-admin-kibana-user/41653 "2016-02-12T19:46:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [February 12, 2016, 7:46pm UTC](https://discuss.elastic.co/t/what-is-the-best-set-of-privileges-for-non-admin-kibana-user/41653/1 "2016-02-12T19:46:57Z")

</div>

I've had advice on and seen postings that list different sets of privileges for the average kibana end-user but we're still getting errors which I'm sure are related to an incorrect set of privileges.

[https://www.elastic.co/guide/en/shield/current/defining-roles.html](https://www.elastic.co/guide/en/shield/current/defining-roles.html) states:

```
# Only read operations on indices named events_*
events_user:
  indices:
    'events_*':
      privileges: read

```

[https://www.elastic.co/guide/en/shield/current/\_granting\_privileges\_for\_specific\_actions.html](https://www.elastic.co/guide/en/shield/current/_granting_privileges_for_specific_actions.html) lists privileges for specific index actions.

[https://www.elastic.co/guide/en/shield/current/kibana.html](https://www.elastic.co/guide/en/shield/current/kibana.html) lists the privileges for a kibana user as a list of those actions.

What is the 'best' set for the following (I think obvious) use-case for a new non-admin kibana user to have granted to them:

- Login (to Discover page)
- Navigate to the Dashboard page
- Open a pre-made dashboard with a set of visualizations based on their index-pattern
- Create, edit and delete visualizations based on their index-pattern

Is this correct:

```
my_user:
  cluster:
      - cluster:monitor/nodes/info
      - cluster:monitor/health
  indices:
    'my_users_indices-*':
      - indices:admin/mappings/fields/get
      - indices:admin/validate/query
      - indices:data/read/search
      - indices:data/read/msearch
      - indices:admin/get
    '.kibana': 
      - indices:admin/create
      - indices:admin/exists
      - indices:admin/mapping/put
      - indices:admin/mappings/fields/get
      - indices:admin/refresh
      - indices:admin/validate/query
      - indices:data/read/get
      - indices:data/read/mget
      - indices:data/read/search
      - indices:data/write/delete
      - indices:data/write/index
      - indices:data/write/update
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/what-is-the-best-set-of-privileges-for-non-admin-kibana-user/41653/2 "2017-07-06T13:46:54Z")

</div>