Fleet should restrict the permissions on the keys.

[ph]

In the following code, we give more permission to the API that we would like to, we should restrict the permissions to the data stream and not the backing indices and we should only use minimal permissions.

kibana/x-pack/test/fleet_api_integration/apis/fleet_setup.ts

Lines 64 to 73 in 49d95f6

	names: [
	'logs-*',
	'metrics-*',
	'traces-*',
	'.ds-logs-*',
	'.ds-metrics-*',
	'.ds-traces-*',
	],
	privileges: ['write', 'create_index', 'indices:admin/auto_create'],
	allow_restricted_indices: false,

{
	"fleet-output": {
		"cluster": ["monitor"],
		"index": [{
			"names": [
				"logs-*",
				"metrics-*",
                                "traces-*",
			],
			"privileges": [
				"create_doc",
				"indices:admin/auto_create"
			]
		}]
	}
}

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[jen-huang]

Does this overlap/dupe with #89682?

[ruflin]

@jen-huang Jep, I think it's a duplicate. We had a quick chat about it and seems both of us decided to take action on it :-D

[ph]

Just to make sure there is no confusion in the implementation, let's use the permission as defined in the description above. They will be better than what we have today and more locked down. When the new roles is done we can do lock it even more, elastic/elasticsearch#68414 Going to create an issue and ask them to ping us.