OpenSearch/elasticsearch/qa/smoke-test-monitoring-with-shield/roles.yml

admin:
  cluster:
    - all
  indices:
    - names: '*'
      privileges:
        - all

monitored_system:
  cluster: [ 'cluster:admin/xpack/monitoring/bulk' ]

required_for_test:
  cluster: [ 'monitor' ]
  indices:
    - names: '.monitoring-*'
      privileges:
        - write
        - read
        - manage