Skip to content

Commit

Permalink
Addresses more PR feedback
Browse files Browse the repository at this point in the history
Signed-off-by: Darshit Chanpura <[email protected]>
  • Loading branch information
DarshitChanpura committed Aug 31, 2023
1 parent 7f4566b commit ef577c3
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion _security/access-control/permissions.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ Rather than individual permissions, you can often achieve your desired security

System index permissions are unique among other permissions in that they extend some traditional admin-only accessibility to non-admin users. These permissions give normal users the ability to modify any system index specified in the role or roles to which they are mapped. The exception to this is the security system index, `.opendistro_security`, which is used to store Security's configuration YAML files and remains accessible only to admins with an admin certificate.

Along with standard index permissions, system index permissions are specified in the 'roles.yml' configuration file under 'index_permissions' (See [roles.yml](site.urlsite.baseurl/security/configuration/yaml/#rolesyml). The user gains access to the system index by specifying `system:admin/system_index` in the role's `allowed_actions` section. With the addition of this action, all system indices covered by patterns defined in `index_patterns` are now accessible to this role. The `*` pattern, on the other hand by itself, is an exception that cannot be used to grant access to all system indices at once.
Along with standard index permissions, you specify system index permissions in the 'roles.yml' configuration file under 'index_permissions' (See [roles.yml]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#rolesyml). You do this by specifying `system:admin/system_index` in the role's `allowed_actions` section and adding the system index in the `index_patterns` section.

For example, the system index permission that gives a user permission to modify the system index that stores configurations for the Alerting plugin is defined by the index pattern `.opendistro-alerting-config` and its allowed action is defined as `system:admin/system_index`. The following role shows how this system index permission is configured along with other attributes:

Expand Down

0 comments on commit ef577c3

Please sign in to comment.