[Security Solution] [Serverless] Open in Lens option from Visualize library is not Opening anything in Lens for users with Tier 1 Analyst role

[vgomez-el]

Describe the bug:
User with Tier 1 Analyst role cannot visualize properly in Lens

Kibana/Elasticsearch Stack version:

Server OS version:
Serverless, production environment
Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

1. Navigate to Explore --> network
2. Mouse over any chart
3. open the options menu
4. Click More --> Open in Lens
5. Notice the "You don't have permissions to access the requested page message"

Current behavior:
User is getting a "You don't have permissions to access the requested page message"

Expected behavior:
According to Serverless Security Roles spreadsheet, Tier 1 Analyst role should have All permissions for Visulize Library (Lens, Maps, Aggregations, Tools)

Screenshots (if relevant):
https://github.com/elastic/kibana/assets/120487607/da877a37-9454-4c2f-b7be-16dbb395cb18
Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[angorayc]

Hi, I logged in with t1_analyst, and found that visualization lib was not available. Not just open in Lens from Lens Embeddables.

Screen.Recording.2023-10-24.at.22.02.17.mov

[angorayc]

Map was not available when logged in with t1_analyst either:

Screen.Recording.2023-10-24.at.22.07.00.mov

[angorayc]

From the role definition: https://github.com/elastic/project-controller/blob/09a551b63d5fdc531f97b79c95a966eead8e62b3/internal/project/security/config/roles.yml#L124
Seems that it's expected not to have map and visualization access as t1_analyst, @dhurley14 could you please have a look to this?

[semd]

This is pretty serious, even Discovery is not available using those roles.

All roles are missing the "analytics" features, we need to add:

feature_canvas.[all|read]
feature_dashboard.[all|read]
feature_discover.[all|read]
feature_graph.[all|read]
feature_maps.[all|read]
feature_visualize.[all|read]

I see the "roles -> features" spreadsheet defines Security Dashboards, Visulize Library (Lens, Maps, Aggregations, Tools) and Kibana Dashboards (Integrations-included and Custom), they are set to all in every role, so we should add:

feature_canvas.all
feature_dashboard.all
feature_discover.all
feature_graph.all
feature_maps.all
feature_visualize.all

To in all the roles definition in the yml. I will create a PR ASAP adding them

[semd]

@vgomez-el This should be already solved, could you please test again?

[vgomez-el]

REC-20231108182214.mp4

Sure, It works right now! I will mark the bug as validated and close it.

Thank you all!