From 417f7062c576c897a6832e78ea69b60c7d3c1cb2 Mon Sep 17 00:00:00 2001 From: Dario Gieselaar Date: Wed, 1 Jul 2020 09:04:57 +0200 Subject: [PATCH] [7.x] Add read privileges for annotations for apm_user (#58530) (#58781) Co-authored-by: Elastic Machine --- .../xpack/core/security/authz/store/ReservedRolesStore.java | 4 +++- .../core/security/authz/store/ReservedRolesStoreTests.java | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index 24d941919d2..e462587c359 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -180,7 +180,9 @@ public class ReservedRolesStore implements BiConsumer, ActionListene RoleDescriptor.IndicesPrivileges.builder().indices("apm-*") .privileges("read", "view_index_metadata").build(), RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*") - .privileges("view_index_metadata", "read").build(), + .privileges("read", "view_index_metadata").build(), + RoleDescriptor.IndicesPrivileges.builder().indices("observability-annotations") + .privileges("read", "view_index_metadata").build() }, null, MetadataUtils.DEFAULT_RESERVED_METADATA)) .put("machine_learning_user", new RoleDescriptor("machine_learning_user", new String[] { "monitor_ml" }, new RoleDescriptor.IndicesPrivileges[] { diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index f1516b0522e..d7e17795bf6 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1148,6 +1148,8 @@ public class ReservedRolesStoreTests extends ESTestCase { assertOnlyReadAllowed(role, "apm-" + randomIntBetween(0, 5)); assertOnlyReadAllowed(role, AnomalyDetectorsIndexFields.RESULTS_INDEX_PREFIX + AnomalyDetectorsIndexFields.RESULTS_INDEX_DEFAULT); + + assertOnlyReadAllowed(role, "observability-annotations"); } public void testMachineLearningAdminRole() {