honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Corrected syntax for adding IDs to definition lists in built-in roles 

Relates to elastic/x-pack-elasticsearch#5040

Original commit: elastic/x-pack-elasticsearch@693c4adfb5
This commit is contained in:
Clinton Gormley 2017-06-13 14:00:56 +02:00
parent 5a0ffb4b3a
commit fff33e753a
1 changed files with 13 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
docs/en/security/authorization.asciidoc
View File

@ -59,15 +59,13 @@ themselves.
{security} also provides a set of built-in roles you can explicitly assign {security} also provides a set of built-in roles you can explicitly assign
to users. These roles have a fixed set of privileges and cannot be updated. to users. These roles have a fixed set of privileges and cannot be updated.
[[built-in-roles-ingest-user]] [[built-in-roles-ingest-user]] `ingest_admin` ::
`ingest_admin` ::
Grants access to manage *all* index templates and *all* ingest pipeline configurations. Grants access to manage *all* index templates and *all* ingest pipeline configurations.
+ +
NOTE: This role does *not* provide the ability to create indices; those privileges NOTE: This role does *not* provide the ability to create indices; those privileges
must be defined in a separate role. must be defined in a separate role.
[[built-in-roles-kibana-system]] [[built-in-roles-kibana-system]] `kibana_system` ::
`kibana_system` ::
Grants access necessary for the <<kibana, Kibana system user>> Grants access necessary for the <<kibana, Kibana system user>>
to read from and write to the Kibana indices and check the availability of the to read from and write to the Kibana indices and check the availability of the
Elasticsearch cluster. Elasticsearch cluster.
@ -75,13 +73,11 @@ Elasticsearch cluster.
NOTE: This role should not be assigned to users as the granted permissions may NOTE: This role should not be assigned to users as the granted permissions may
change between releases. change between releases.
[[built-in-roles-kibana-user]] [[built-in-roles-kibana-user]] `kibana_user`::
`kibana_user`::
Grants the minimum privileges required for any user of Kibana. This role grants Grants the minimum privileges required for any user of Kibana. This role grants
access to the Kibana indices and grants monitoring privileges for the cluster. access to the Kibana indices and grants monitoring privileges for the cluster.
[[built-in-roles-logstash-system]] [[built-in-roles-logstash-system]] `logstash_system` ::
`logstash_system` ::
Grants access necessary for the <<ls-monitoring-user, Logstash system user>> Grants access necessary for the <<ls-monitoring-user, Logstash system user>>
to send system-level data (such as monitoring) to Elasticsearch. to send system-level data (such as monitoring) to Elasticsearch.
+ +
@ -91,44 +87,37 @@ change between releases.
NOTE: This role does not provide access to the logstash indices and is not NOTE: This role does not provide access to the logstash indices and is not
suitable for use within a Logstash pipeline. suitable for use within a Logstash pipeline.
[[built-in-roles-ml-admin]] [[built-in-roles-ml-admin]] `machine_learning_admin`::
`machine_learning_admin`::
Grants `manage_ml` cluster privileges and read access to the `.ml-*` indices. Grants `manage_ml` cluster privileges and read access to the `.ml-*` indices.
[[built-in-roles-ml-user]] [[built-in-roles-ml-user]] `machine_learning_user`::
`machine_learning_user`::
Grants the minimum privileges required to view {xpackml} configuration, Grants the minimum privileges required to view {xpackml} configuration,
status, and results. This role grants `monitor_ml` cluster privileges and status, and results. This role grants `monitor_ml` cluster privileges and
read access to the `.ml-notifications` and `.ml-anomalies*` indices, read access to the `.ml-notifications` and `.ml-anomalies*` indices,
which store {ml} results. which store {ml} results.
[[built-in-roles-monitoring-user]] [[built-in-roles-monitoring-user]] `monitoring_user`::
`monitoring_user`::
Grants the minimum privileges required for any user of Monitoring other than those Grants the minimum privileges required for any user of Monitoring other than those
required to use Kibana. This role grants access to the monitoring indices. required to use Kibana. This role grants access to the monitoring indices.
Monitoring users should also be assigned the `kibana_user` role. Monitoring users should also be assigned the `kibana_user` role.
[[built-in-roles-remote-monitoring-agent]] [[built-in-roles-remote-monitoring-agent]] `remote_monitoring_agent`::
`remote_monitoring_agent`::
Grants the minimum privileges required for a remote monitoring agent to write data Grants the minimum privileges required for a remote monitoring agent to write data
into this cluster. into this cluster.
[[built-in-roles-reporting-user]] [[built-in-roles-reporting-user]] `reporting_user`::
`reporting_user`::
Grants the specific privileges required for users of Reporting other than those Grants the specific privileges required for users of Reporting other than those
required to use Kibana. This role grants access to the reporting indices. Reporting required to use Kibana. This role grants access to the reporting indices. Reporting
users should also be assigned the `kibana_user` role and a role that grants them users should also be assigned the `kibana_user` role and a role that grants them
access to the data that will be used to generate reports with. access to the data that will be used to generate reports with.
[[built-in-roles-superuser]] [[built-in-roles-superuser]] `superuser`::
`superuser`::
Grants full access to the cluster, including all indices and data. A user with Grants full access to the cluster, including all indices and data. A user with
the `superuser` role can also manage users and roles and the `superuser` role can also manage users and roles and
<<run-as-privilege, impersonate>> any other user in the system. Due to the <<run-as-privilege, impersonate>> any other user in the system. Due to the
permissive nature of this role, take extra care when assigning it to a user. permissive nature of this role, take extra care when assigning it to a user.
[[built-in-roles-transport-client]] [[built-in-roles-transport-client]] `transport_client`::
`transport_client`::
Grants the privileges required to access the cluster through the Java Transport Grants the privileges required to access the cluster through the Java Transport
Client. The Java Transport Client fetches information about the nodes in the Client. The Java Transport Client fetches information about the nodes in the
cluster using the _Node Liveness API_ and the _Cluster State API_ (when cluster using the _Node Liveness API_ and the _Cluster State API_ (when
@ -140,14 +129,12 @@ to the cluster state. This means users can view the metadata over all indices,
index templates, mappings, node and basically everything about the cluster. index templates, mappings, node and basically everything about the cluster.
However, this role does not grant permission to view the data in all indices. However, this role does not grant permission to view the data in all indices.
[[built-in-roles-watcher-admin]] [[built-in-roles-watcher-admin]] `watcher_admin`::
`watcher_admin`::
+ +
Grants write access to the `.watches` index, read access to the watch history and Grants write access to the `.watches` index, read access to the watch history and
the triggered watches index and allows to execute all watcher actions. the triggered watches index and allows to execute all watcher actions.
[[built-in-roles-watcher-user]] [[built-in-roles-watcher-user]] `watcher_user`::
`watcher_user`::
+ +
Grants read access to the `.watches` index, the get watch action and the watcher Grants read access to the `.watches` index, the get watch action and the watcher
stats. stats.