Observability predefined roles

[sorenlouv]

This is part of the effort of providing better default roles for end users.

Progress

Following solutions have added privileges:

• APM
• Logs
• Metrics
• Uptime

Read only user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      // apm
      { "names": ["apm-*", "logs-apm*", "metrics-apm*", "traces-apm*", "observability-annotations"], "privileges": ["read", "view_index_metadata"] },
      // logs
      { "names": ["logs-*", "filebeat-*", "kibana_sample_data_logs*"], "privileges": ["read", "view_index_metadata"] },
      // metrics
	  { "names": ["metrics-*", "metricbeat-*"], "privileges": ["read", "view_index_metadata"] },
	  // uptime
      { "names": ["heartbeat-*", "synthetics-*"], "privileges": ["read", "view_index_metadata"] },
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "apm": ["read"],
        "logs": ["read"],
	    "infrastructure": ["read"],
        "ml": ["read"],
        "uptime": ["read"]
      },
      "spaces": ["*"]
    }
  ]
}

Power user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      // apm
      { "names": ["apm-*", "logs-apm*", "metrics-apm*", "traces-apm*"], "privileges": ["read", "view_index_metadata"] },
      { "names": ["observability-annotations"], "privileges": ["read", "write", "view_index_metadata"] },
      // logs
      { "names": ["logs-*", "filebeat-*", "kibana_sample_data_logs*"], "privileges": ["read", "view_index_metadata"] },
      // metrics
      { "names": ["metrics-*", "metricbeat-*"], "privileges": ["read", "view_index_metadata"] },
	  // uptime
      { "names": ["heartbeat-*", "synthetics-*"], "privileges": ["read", "view_index_metadata"] },
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "apm": ["all"],
        "logs": ["all"],
        "infrastructure": ["all"],
        "ml": ["all"],
        "uptime": ["all"]
      },
      "spaces": ["*"]
    }
  ]
}

Superuser

Default superuser: Access to everything

[elasticmachine]

Pinging @elastic/uptime (Team:uptime)

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[elasticmachine]

Pinging @elastic/apm-ui (Team:apm)

[Kerry350]

Logs

Read only user

Can be tested by hitting curl -X PUT "<KIBANA_URL>/api/security/role/logs_read_only" --user user:password -H 'Content-Type: application/json' -H 'kbn-xsrf: some-string with:

{
  "elasticsearch":{
     "cluster":[],
     "indices":[
        {
           "names": ["logs-*", "filebeat-*", "kibana_sample_data_logs*"],
           "privileges":["read", "view_index_metadata"]
        }
    ]
  },
  "kibana":[
     {
        "base": [],
        "feature": {
          "logs": ["read"],
          "ml": ["read"]
        },
        "spaces": ["*"]
     }
  ]
}

(This user will not be able to create alerts, create / recreate ML jobs, or edit the logs source configuration).

Power user

Can be tested by hitting curl -X PUT "<KIBANA_URL>/api/security/role/logs_power_role" --user user:password -H 'Content-Type: application/json' -H 'kbn-xsrf: some-string with:

{
  "elasticsearch":{
     "cluster":[],
     "indices":[
        {
           "names": ["logs-*", "filebeat-*", "kibana_sample_data_logs*"],
           "privileges":["read", "view_index_metadata"]
        }
    ]
  },
  "kibana":[
     {
        "base": [],
        "feature": {
          "logs": ["all"],
          "ml": ["all"]
        },
        "spaces": ["*"]
     }
  ]
}

[sorenlouv]

Thanks @Kerry350 . WDYT about updating the issue description with the logs permission to keep it all in a single declaration?

(just leave your comment. It's probably good to have both a combined and separate)

[sorenlouv]

APM

Read only user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      { "names": ["apm-*"], "privileges": ["read", "view_index_metadata"] },
      { "names": ["logs-apm*"], "privileges": ["read", "view_index_metadata"] }, 
      { "names": ["metrics-apm*"], "privileges": ["read", "view_index_metadata"] }, 
      { "names": ["traces-apm*"], "privileges": ["read", "view_index_metadata"] }, 
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "apm": ["read"],
        "ml": ["read"]
      },
      "spaces": ["*"]
    }
  ]
}

Power user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      { "names": ["apm-*"], "privileges": ["read", "view_index_metadata"] }
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "apm": ["all"],
        "ml": ["all"]
      },
      "spaces": ["*"]
    }
  ]
}

[Kerry350]

@sqren Sure, I didn't want to assume and ruin your description 😅 I've merged Logs in with APM in the main declaration.

[Zacqary]

Updated issue description with Metrics permissions.

[jasonrhodes]

Thanks @Zacqary ! Can you add just the Metrics definition as a comment here, also? That looks like a good convention.

[Zacqary]

Metrics

Read only

To test: hit curl -X PUT "<KIBANA_URL>/api/security/role/metrics_read_only" --user user:password -H 'Content-Type: application/json' -H 'kbn-xsrf: some-string with:

{
  "elasticsearch":{
     "cluster": [],
     "indices": [
        {
           "names": ["metrics-*", "metricbeat-*"],
           "privileges": ["read", "view_index_metadata"]
        }
    ]
  },
  "kibana": [
     {
        "base": [],
        "feature": {
          "infrastructure": ["read"],
          "ml": ["read"]
        },
        "spaces": ["*"]
     }
  ]
}

Power user

To test: hit curl -X PUT "<KIBANA_URL>/api/security/role/metrics_power" --user user:password -H 'Content-Type: application/json' -H 'kbn-xsrf: some-string with:

{
  "elasticsearch":{
     "cluster": [],
     "indices": [
        {
           "names": ["metrics-*", "metricbeat-*"],
           "privileges": ["read", "view_index_metadata"]
        }
    ]
  },
  "kibana": [
     {
        "base": [],
        "feature": {
          "infrastructure": ["all"],
          "ml": ["all"]
        },
        "spaces": ["*"]
     }
  ]
}

[bytebilly]

Thanks, looks great!
I see that you are using Kibana JSON for role definition, that is slightly different from Elasticsearch JSON.
Is there a strong reason for that? Since role definitions will be stored in Elasticsearch, we can turn into that format at some point.

[Kerry350]

@bytebilly I'd utilised the same format as APM, so I'll defer to @sqren on whether there was a technical reason.

Would your preference be adherence to this API?

[bytebilly]

@Kerry350 yes that would be my preferred one, since roles are not Kibana related and will be "translated" into the Elasticsearch DSL anyway.
We are still discussing technical details, but it could be that we'll store predefined roles as Elasticsearch JSON so it is easier to modify/contribute directly with PRs to the Elasticsearch repo.

[shahzad31]

@sqren for the apm user we also want to add user-experince kibana feature i think.

[legrego]

@sqren for the apm user we also want to add user-experince kibana feature i think.

@shahzad31 isn't the User Experience app bundled inside the existing apm feature?

[sorenlouv]

Is there a strong reason for that?

No preference from my side. From conversations with you and the security team (who already did this) it was my impression this was the preferred format but I might have misunderstood something.
Btw. This is the format used by the Security UI in Kibana which I used as a reference point.

[sorenlouv]

@shahzad31 isn't the User Experience app bundled inside the existing apm feature?

Yes, the permissions for UX app are already handled via the apm permissions.

[shahzad31]

UPTIME

Read only user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      { "names": ["heartbeat-*"], "privileges": ["read", "view_index_metadata"] },
      { "names": ["synthetics-*"], "privileges": ["read", "view_index_metadata"] }, 
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "uptime": ["read"],
      },
      "spaces": ["*"]
    }
  ]
}

Power user

{
  "elasticsearch": {
    "cluster": [],
    "indices": [
      { "names": ["heartbeat-*"], "privileges": ["read", "view_index_metadata"] },
      { "names": ["synthetics-*"], "privileges": ["read", "view_index_metadata"] },
    ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "uptime": ["all"],
      },
      "spaces": ["*"]
    }
  ]
}