[BUG] Confusing index template permissions level

[davidshtian]

Describe the bug
Try to add index template to role and map to a user, due to official Access Control Permissions docs, I tried to add index permission to the role.

For the new [index template] (https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html#index-templates), the setting "indices:admin/index_template/get" (also this permission is not included in Access Control Permissions docs) is okay.

However, for the legacy template, the setting "indices:admin/template/get" is not working, and I need to add this permission to cluster level permissions, and it works.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'Security/Roles'
2. Click on 'Create role'
3. Add permission "indices:admin/template/get" to Index permissions
4. See error below:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "no permissions for [indices:admin/template/delete] and User [name=template, backend_roles=[], requestedTenant=__user__]"
      }
    ],
    "type" : "security_exception",
    "reason" : "no permissions for [indices:admin/template/delete] and User [name=template, backend_roles=[], requestedTenant=__user__]"
  },
  "status" : 403
}

5. Add permission "indices:admin/template/get" to Cluster permissions, and the query executed successfully.

Expected behavior
Modify the "indices:admin/index_template/get" permission to index level as its name showed.

Plugins
Security plugin.

Screenshots
Not working setting:

Working setting:

Host/Environment (please complete the following information):

• OS: Amazon Linux release 2
• Version 1.0.0

Additional context
N/A

[davidshtian]

Additional Info - kind of similar issue here Indices:admin/template/put is a “cluster” action?

[CEHENKLE]

Transferring issue to security plugin in. Please let me know (@) if this is the wrong location. Thanks!

[stephen-crawford]

[Triage] @cwperks could you take a minute to review this when you get a chance. Thank you.

[cwperks]

Closing this issue as there is a related issues in dashboards to solve this problem with UX:

• Index permissions should not be assigned to cluster permissions and vice versa security-dashboards-plugin#1347
• [FEATURE] Permission groups in index/cluster permissions dropdown do not differentiate index and cluster groups security-dashboards-plugin#1346

There is a related PR in the security-dashboards-plugin to add all actions to the dropdowns:

• Synchronize all permissions from latest OpenSearch security-dashboards-plugin#1333
• There needs to be an associated PR with the documentation website to add the actions to the permissions page: https://opensearch.org/docs/latest/security/access-control/permissions/
• As pointed out, the legacy indices:admin/template/* permissions are cluster permissions even though they are prefixed with indices:. This should be reflected on the permissions page on the documentation website