OpenSearch/elasticsearch/qa/smoke-test-monitoring-with-security/roles.yml

monitoring_system:
  cluster: [ 'cluster:admin/xpack/monitoring/bulk' ]

monitoring_without_bulk:
  cluster: [ 'monitor' ]
  indices:
    - names: '.monitoring-*'
      privileges:
        - write
        - read
        - manage