security: roles.yml is empty and add built in monitoring users

This change removes all default roles from the roles.yml file that is distributed with xpack and
adds built in roles for monitoring users and remote monitoring agents.

Closes elastic/elasticsearch#3122

Original commit: elastic/x-pack-elasticsearch@b04508bd56

elasticsearch/x-pack/security/config/x-pack/roles.yml

@@ -1,31 +0,0 @@
-logstash:
-  cluster:
-    - manage_index_templates
-  indices:
-    - names: 'logstash-*'
-      privileges:
-        - write
-        - read
-        - create_index
-
-# Monitoring user role. Assign to monitoring users.
-monitoring_user:
-  indices:
-    - names:
-        - '.marvel-es-*'
-        - '.monitoring-*'
-      privileges: [ "read" ]
-    - names: '.kibana'
-      privileges:
-        - view_index_metadata
-        - read
-
-# Monitoring remote agent role. Assign to the agent user on the remote monitoring cluster
-# to which the monitoring agent will export all its data
-remote_monitoring_agent:
-  cluster: [ "manage_index_templates", "manage_ingest_pipelines", "monitor" ]
-  indices:
-    - names:
-        - '.marvel-es-*'
-        - '.monitoring-*'
-      privileges: [ "all" ]

elasticsearch/x-pack/security/src/main/java/org/elasticsearch/xpack/security/authz/permission/MonitoringUserRole.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security.authz.permission;
+
+import org.elasticsearch.xpack.security.authz.RoleDescriptor;
+import org.elasticsearch.xpack.security.authz.permission.ClusterPermission.Core;
+import org.elasticsearch.xpack.security.support.MetadataUtils;
+
+/**
+ * A built-in role that grants users the necessary privileges to use Monitoring. The user will also need the {@link KibanaUserRole}
+ */
+public class MonitoringUserRole extends Role {
+
+    private static final RoleDescriptor.IndicesPrivileges[] INDICES_PRIVILEGES = new RoleDescriptor.IndicesPrivileges[] {
+            RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(".marvel-es-*", ".monitoring-*")
+                    .privileges("read")
+                    .build() };
+
+    public static final String NAME = "monitoring_user";
+    public static final RoleDescriptor DESCRIPTOR =
+            new RoleDescriptor(NAME, null, INDICES_PRIVILEGES, null, MetadataUtils.DEFAULT_RESERVED_METADATA);
+    public static final MonitoringUserRole INSTANCE = new MonitoringUserRole();
+
+    private MonitoringUserRole() {
+        super(DESCRIPTOR.getName(),
+                Core.NONE,
+                new IndicesPermission.Core(Role.Builder.convertFromIndicesPrivileges(DESCRIPTOR.getIndicesPrivileges())),
+                RunAsPermission.Core.NONE);
+    }
+}

elasticsearch/x-pack/security/src/main/java/org/elasticsearch/xpack/security/authz/permission/RemoteMonitoringAgentRole.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security.authz.permission;
+
+import org.elasticsearch.xpack.security.authz.RoleDescriptor;
+import org.elasticsearch.xpack.security.authz.privilege.ClusterPrivilege;
+import org.elasticsearch.xpack.security.authz.privilege.Privilege.Name;
+import org.elasticsearch.xpack.security.support.MetadataUtils;
+
+/**
+ * Built-in role that grants the necessary privileges for a remote monitoring agent.
+ */
+public class RemoteMonitoringAgentRole extends Role {
+
+    private static final String[] CLUSTER_PRIVILEGES = new String[] { "manage_index_templates", "manage_ingest_pipelines", "monitor" };
+    private static final RoleDescriptor.IndicesPrivileges[] INDICES_PRIVILEGES = new RoleDescriptor.IndicesPrivileges[] {
+            RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(".marvel-es-*", ".monitoring-*")
+                    .privileges("all")
+                    .build() };
+
+    public static final String NAME = "remote_monitoring_agent";
+    public static final RoleDescriptor DESCRIPTOR =
+            new RoleDescriptor(NAME, CLUSTER_PRIVILEGES, INDICES_PRIVILEGES, null, MetadataUtils.DEFAULT_RESERVED_METADATA);
+    public static final RemoteMonitoringAgentRole INSTANCE = new RemoteMonitoringAgentRole();
+
+    private RemoteMonitoringAgentRole() {
+        super(DESCRIPTOR.getName(),
+                new ClusterPermission.Core(ClusterPrivilege.get(new Name(DESCRIPTOR.getClusterPrivileges()))),
+                new IndicesPermission.Core(Role.Builder.convertFromIndicesPrivileges(DESCRIPTOR.getIndicesPrivileges())),
+                RunAsPermission.Core.NONE);
+    }
+}

elasticsearch/x-pack/security/src/main/java/org/elasticsearch/xpack/security/authz/store/ReservedRolesStore.java

@@ -16,6 +16,8 @@ import org.elasticsearch.xpack.security.SecurityContext;
 import org.elasticsearch.xpack.security.authz.RoleDescriptor;
 import org.elasticsearch.xpack.security.authz.permission.KibanaRole;
 import org.elasticsearch.xpack.security.authz.permission.KibanaUserRole;
+import org.elasticsearch.xpack.security.authz.permission.MonitoringUserRole;
+import org.elasticsearch.xpack.security.authz.permission.RemoteMonitoringAgentRole;
 import org.elasticsearch.xpack.security.authz.permission.Role;
 import org.elasticsearch.xpack.security.authz.permission.SuperuserRole;
 import org.elasticsearch.xpack.security.authz.permission.TransportClientRole;
@@ -42,6 +44,10 @@ public class ReservedRolesStore implements RolesStore {
                 return TransportClientRole.INSTANCE;
             case KibanaUserRole.NAME:
                 return KibanaUserRole.INSTANCE;
+            case MonitoringUserRole.NAME:
+                return MonitoringUserRole.INSTANCE;
+            case RemoteMonitoringAgentRole.NAME:
+                return RemoteMonitoringAgentRole.INSTANCE;
             case KibanaRole.NAME:
                 // The only user that should know about this role is the kibana user itself (who has this role). The reason we want to hide
                 // this role is that it was created specifically for kibana, with all the permissions that the kibana user needs.
@@ -68,6 +74,10 @@ public class ReservedRolesStore implements RolesStore {
                 return TransportClientRole.DESCRIPTOR;
             case KibanaUserRole.NAME:
                 return KibanaUserRole.DESCRIPTOR;
+            case MonitoringUserRole.NAME:
+                return MonitoringUserRole.DESCRIPTOR;
+            case RemoteMonitoringAgentRole.NAME:
+                return RemoteMonitoringAgentRole.DESCRIPTOR;
             case KibanaRole.NAME:
                 // The only user that should know about this role is the kibana user itself (who has this role). The reason we want to hide
                 // this role is that it was created specifically for kibana, with all the permissions that the kibana user needs.
@@ -84,13 +94,15 @@ public class ReservedRolesStore implements RolesStore {
     public Collection<RoleDescriptor> roleDescriptors() {
         if (KibanaUser.is(securityContext.getUser())) {
             return Arrays.asList(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR, KibanaUserRole.DESCRIPTOR,
-                    KibanaRole.DESCRIPTOR);
+                    KibanaRole.DESCRIPTOR, MonitoringUserRole.DESCRIPTOR, RemoteMonitoringAgentRole.DESCRIPTOR);
         }
-        return Arrays.asList(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR, KibanaUserRole.DESCRIPTOR);
+        return Arrays.asList(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR, KibanaUserRole.DESCRIPTOR,
+                MonitoringUserRole.DESCRIPTOR, RemoteMonitoringAgentRole.DESCRIPTOR);
     }
 
     public static Set<String> names() {
-        return Sets.newHashSet(SuperuserRole.NAME, KibanaRole.NAME, TransportClientRole.NAME, KibanaUserRole.NAME);
+        return Sets.newHashSet(SuperuserRole.NAME, KibanaRole.NAME, TransportClientRole.NAME, KibanaUserRole.NAME,
+                MonitoringUserRole.NAME, RemoteMonitoringAgentRole.NAME);
     }
 
     public static boolean isReserved(String role) {
@@ -99,6 +111,8 @@ public class ReservedRolesStore implements RolesStore {
             case KibanaRole.NAME:
             case KibanaUserRole.NAME:
             case TransportClientRole.NAME:
+            case MonitoringUserRole.NAME:
+            case RemoteMonitoringAgentRole.NAME:
             case SystemUser.ROLE_NAME:
                 return true;
             default:

elasticsearch/x-pack/security/src/test/java/org/elasticsearch/xpack/security/authz/permission/MonitoringUserRoleTests.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security.authz.permission;
+
+import org.elasticsearch.action.admin.cluster.health.ClusterHealthAction;
+import org.elasticsearch.action.admin.cluster.reroute.ClusterRerouteAction;
+import org.elasticsearch.action.admin.cluster.settings.ClusterUpdateSettingsAction;
+import org.elasticsearch.action.admin.cluster.state.ClusterStateAction;
+import org.elasticsearch.action.admin.cluster.stats.ClusterStatsAction;
+import org.elasticsearch.action.admin.indices.create.CreateIndexAction;
+import org.elasticsearch.action.admin.indices.delete.DeleteIndexAction;
+import org.elasticsearch.action.admin.indices.settings.put.UpdateSettingsAction;
+import org.elasticsearch.action.admin.indices.template.put.PutIndexTemplateAction;
+import org.elasticsearch.action.delete.DeleteAction;
+import org.elasticsearch.action.get.GetAction;
+import org.elasticsearch.action.index.IndexAction;
+import org.elasticsearch.action.search.SearchAction;
+import org.elasticsearch.test.ESTestCase;
+import org.elasticsearch.transport.TransportRequest;
+import org.elasticsearch.xpack.monitoring.action.MonitoringBulkAction;
+import org.elasticsearch.xpack.security.authc.Authentication;
+
+import static org.hamcrest.Matchers.is;
+import static org.mockito.Mockito.mock;
+
+/**
+ * Tests for the builtin monitoring user
+ */
+public class MonitoringUserRoleTests extends ESTestCase {
+
+    public void testCluster() {
+        final TransportRequest request = new TransportRequest.Empty();
+        final Authentication authentication = mock(Authentication.class);
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(ClusterHealthAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(ClusterStateAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(ClusterStatsAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(PutIndexTemplateAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(ClusterRerouteAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(ClusterUpdateSettingsAction.NAME, request, authentication), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.cluster().check(MonitoringBulkAction.NAME, request, authentication), is(false));
+    }
+
+    public void testRunAs() {
+        assertThat(MonitoringUserRole.INSTANCE.runAs().isEmpty(), is(true));
+    }
+
+    public void testUnauthorizedIndices() {
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test("foo"), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(".reporting"), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(".kibana"), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher("indices:foo").test(randomAsciiOfLengthBetween(8, 24)),
+                is(false));
+    }
+
+    public void testMonitoringIndices() {
+        testReadAccess(".monitoring-" + randomAsciiOfLength(randomIntBetween(0, 13)));
+        testReadAccess(".marvel-es-" + randomAsciiOfLength(randomIntBetween(0, 13)));
+    }
+
+    private void testReadAccess(String index) {
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher("indices:foo").test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher("indices:bar").test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(IndexAction.NAME).test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(DeleteAction.NAME).test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(index), is(false));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(index), is(true));
+        assertThat(MonitoringUserRole.INSTANCE.indices().allowedIndicesMatcher(GetAction.NAME).test(index), is(true));
+    }
+}

elasticsearch/x-pack/security/src/test/java/org/elasticsearch/xpack/security/authz/permission/RemoteMonitoringAgentRoleTests.java

@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security.authz.permission;
+
+import org.elasticsearch.action.admin.cluster.health.ClusterHealthAction;
+import org.elasticsearch.action.admin.cluster.reroute.ClusterRerouteAction;
+import org.elasticsearch.action.admin.cluster.settings.ClusterUpdateSettingsAction;
+import org.elasticsearch.action.admin.cluster.state.ClusterStateAction;
+import org.elasticsearch.action.admin.cluster.stats.ClusterStatsAction;
+import org.elasticsearch.action.admin.indices.create.CreateIndexAction;
+import org.elasticsearch.action.admin.indices.delete.DeleteIndexAction;
+import org.elasticsearch.action.admin.indices.get.GetIndexAction;
+import org.elasticsearch.action.admin.indices.settings.put.UpdateSettingsAction;
+import org.elasticsearch.action.admin.indices.template.put.PutIndexTemplateAction;
+import org.elasticsearch.action.delete.DeleteAction;
+import org.elasticsearch.action.get.GetAction;
+import org.elasticsearch.action.index.IndexAction;
+import org.elasticsearch.action.search.SearchAction;
+import org.elasticsearch.test.ESTestCase;
+import org.elasticsearch.transport.TransportRequest;
+import org.elasticsearch.xpack.monitoring.action.MonitoringBulkAction;
+import org.elasticsearch.xpack.security.authc.Authentication;
+
+import static org.hamcrest.Matchers.is;
+import static org.mockito.Mockito.mock;
+
+/**
+ * Tests for the remote monitoring agent role
+ */
+public class RemoteMonitoringAgentRoleTests extends ESTestCase {
+
+    public void testCluster() {
+        final TransportRequest request = new TransportRequest.Empty();
+        final Authentication authentication = mock(Authentication.class);
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(ClusterHealthAction.NAME, request, authentication), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(ClusterStateAction.NAME, request, authentication), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(ClusterStatsAction.NAME, request, authentication), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(PutIndexTemplateAction.NAME, request, authentication), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(ClusterRerouteAction.NAME, request, authentication), is(false));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(ClusterUpdateSettingsAction.NAME, request, authentication),
+                is(false));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.cluster().check(MonitoringBulkAction.NAME, request, authentication), is(false));
+    }
+
+    public void testRunAs() {
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.runAs().isEmpty(), is(true));
+    }
+
+    public void testUnauthorizedIndices() {
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test("foo"), is(false));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(".reporting"), is(false));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(".kibana"), is(false));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher("indices:foo")
+                .test(randomAsciiOfLengthBetween(8, 24)), is(false));
+    }
+
+    public void testKibanaIndices() {
+        testAllIndexAccess(".monitoring-" + randomAsciiOfLength(randomIntBetween(0, 13)));
+        testAllIndexAccess(".marvel-es-" + randomAsciiOfLength(randomIntBetween(0, 13)));
+    }
+
+    private void testAllIndexAccess(String index) {
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher("indices:foo").test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher("indices:bar").test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(IndexAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(DeleteAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(SearchAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(GetAction.NAME).test(index), is(true));
+        assertThat(RemoteMonitoringAgentRole.INSTANCE.indices().allowedIndicesMatcher(GetIndexAction.NAME).test(index), is(true));
+    }
+}

elasticsearch/x-pack/security/src/test/java/org/elasticsearch/xpack/security/authz/store/FileRolesStoreTests.java

@@ -7,6 +7,7 @@ package org.elasticsearch.xpack.security.authz.store;
 
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.env.Environment;
+import org.elasticsearch.xpack.XPackPlugin;
 import org.elasticsearch.xpack.XPackSettings;
 import org.elasticsearch.xpack.security.audit.logfile.CapturingLogger;
 import org.elasticsearch.xpack.security.authc.support.RefreshListener;
@@ -20,7 +21,6 @@ import org.elasticsearch.test.ESTestCase;
 import org.elasticsearch.threadpool.TestThreadPool;
 import org.elasticsearch.threadpool.ThreadPool;
 import org.elasticsearch.watcher.ResourceWatcherService;
-import org.elasticsearch.xpack.XPackPlugin;
 
 import java.io.BufferedWriter;
 import java.io.OutputStream;
@@ -235,11 +235,7 @@ public class FileRolesStoreTests extends ESTestCase {
         Path path = getDataPath("default_roles.yml");
         Map<String, Role> roles = FileRolesStore.parseFile(path, logger, Settings.EMPTY);
         assertThat(roles, notNullValue());
-        assertThat(roles.size(), is(3));
-
-        assertThat(roles, hasKey("logstash"));
-        assertThat(roles, hasKey("monitoring_user"));
-        assertThat(roles, hasKey("remote_monitoring_agent"));
+        assertThat(roles.size(), is(0));
     }
 
     public void testAutoReload() throws Exception {

elasticsearch/x-pack/security/src/test/java/org/elasticsearch/xpack/security/authz/store/ReservedRolesStoreTests.java

@@ -8,6 +8,8 @@ package org.elasticsearch.xpack.security.authz.store;
 import org.elasticsearch.xpack.security.SecurityContext;
 import org.elasticsearch.xpack.security.authz.permission.KibanaRole;
 import org.elasticsearch.xpack.security.authz.permission.KibanaUserRole;
+import org.elasticsearch.xpack.security.authz.permission.MonitoringUserRole;
+import org.elasticsearch.xpack.security.authz.permission.RemoteMonitoringAgentRole;
 import org.elasticsearch.xpack.security.authz.permission.SuperuserRole;
 import org.elasticsearch.xpack.security.authz.permission.TransportClientRole;
 import org.elasticsearch.xpack.security.user.ElasticUser;
@@ -54,8 +56,14 @@ public class ReservedRolesStoreTests extends ESTestCase {
         assertThat(reservedRolesStore.role(KibanaUserRole.NAME), sameInstance(KibanaUserRole.INSTANCE));
         assertThat(reservedRolesStore.roleDescriptor(KibanaUserRole.NAME), sameInstance(KibanaUserRole.DESCRIPTOR));
 
-        assertThat(reservedRolesStore.roleDescriptors(),
-                contains(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR, KibanaUserRole.DESCRIPTOR));
+        assertThat(reservedRolesStore.role(MonitoringUserRole.NAME), sameInstance(MonitoringUserRole.INSTANCE));
+        assertThat(reservedRolesStore.roleDescriptor(MonitoringUserRole.NAME), sameInstance(MonitoringUserRole.DESCRIPTOR));
+
+        assertThat(reservedRolesStore.role(RemoteMonitoringAgentRole.NAME), sameInstance(RemoteMonitoringAgentRole.INSTANCE));
+        assertThat(reservedRolesStore.roleDescriptor(RemoteMonitoringAgentRole.NAME), sameInstance(RemoteMonitoringAgentRole.DESCRIPTOR));
+
+        assertThat(reservedRolesStore.roleDescriptors(), contains(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR,
+                KibanaUserRole.DESCRIPTOR, MonitoringUserRole.DESCRIPTOR, RemoteMonitoringAgentRole.DESCRIPTOR));
 
         assertThat(reservedRolesStore.role(KibanaRole.NAME), nullValue());
         assertThat(reservedRolesStore.roleDescriptor(KibanaRole.NAME), nullValue());
@@ -76,8 +84,15 @@ public class ReservedRolesStoreTests extends ESTestCase {
 
         assertThat(reservedRolesStore.role(KibanaRole.NAME), sameInstance(KibanaRole.INSTANCE));
         assertThat(reservedRolesStore.roleDescriptor(KibanaRole.NAME), sameInstance(KibanaRole.DESCRIPTOR));
-        assertThat(reservedRolesStore.roleDescriptors(),
-                contains(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR, KibanaUserRole.DESCRIPTOR, KibanaRole.DESCRIPTOR));
+
+        assertThat(reservedRolesStore.role(MonitoringUserRole.NAME), sameInstance(MonitoringUserRole.INSTANCE));
+        assertThat(reservedRolesStore.roleDescriptor(MonitoringUserRole.NAME), sameInstance(MonitoringUserRole.DESCRIPTOR));
+
+        assertThat(reservedRolesStore.role(RemoteMonitoringAgentRole.NAME), sameInstance(RemoteMonitoringAgentRole.INSTANCE));
+        assertThat(reservedRolesStore.roleDescriptor(RemoteMonitoringAgentRole.NAME), sameInstance(RemoteMonitoringAgentRole.DESCRIPTOR));
+
+        assertThat(reservedRolesStore.roleDescriptors(), contains(SuperuserRole.DESCRIPTOR, TransportClientRole.DESCRIPTOR,
+                KibanaUserRole.DESCRIPTOR, KibanaRole.DESCRIPTOR, MonitoringUserRole.DESCRIPTOR, RemoteMonitoringAgentRole.DESCRIPTOR));
 
         assertThat(reservedRolesStore.role(SystemUser.ROLE_NAME), nullValue());
     }
@@ -89,5 +104,7 @@ public class ReservedRolesStoreTests extends ESTestCase {
         assertThat(ReservedRolesStore.isReserved(SystemUser.ROLE_NAME), is(true));
         assertThat(ReservedRolesStore.isReserved(TransportClientRole.NAME), is(true));
         assertThat(ReservedRolesStore.isReserved(KibanaUserRole.NAME), is(true));
+        assertThat(ReservedRolesStore.isReserved(RemoteMonitoringAgentRole.NAME), is(true));
+        assertThat(ReservedRolesStore.isReserved(MonitoringUserRole.NAME), is(true));
     }
 }

elasticsearch/x-pack/security/src/test/resources/org/elasticsearch/xpack/security/authz/store/default_roles.yml

@@ -1,31 +0,0 @@
-logstash:
-  cluster:
-    - manage_index_templates
-  indices:
-    - names: 'logstash-*'
-      privileges:
-        - write
-        - read
-        - create_index
-
-# Monitoring user role. Assign to monitoring users.
-monitoring_user:
-  indices:
-    - names:
-        - '.marvel-es-*'
-        - '.monitoring-*'
-      privileges: [ "read" ]
-    - names: '.kibana'
-      privileges:
-        - view_index_metadata
-        - read
-
-# Monitoring remote agent role. Assign to the agent user on the remote monitoring cluster
-# to which the monitoring agent will export all its data
-remote_monitoring_agent:
-  cluster: [ "manage_index_templates", "manage_ingest_pipelines" ]
-  indices:
-    - names:
-        - '.marvel-es-*'
-        - '.monitoring-*'
-      privileges: [ "all" ]