[APM] Unauthorized Services Visible in APM Service Inventory Due to Alerts

[cauemarcondes]

Services that users lack access permissions for are currently visible in the APM Service inventory when triggered by alerts. This unintended behaviour exposes unauthorized services to users, compromising access restrictions.

The expected behaviour is for APM to exclude services from alerts if the user does not have access, similar to how access is managed in ML. This issue aims to adjust alert handling in APM to ensure that only authorized services are visible in the Service inventory.

The last two services are only listed because they have alerts, as seen there are no APM metrics available.

Solution:

We must apply the same filtering as done on services coming from ML https://github.com/elastic/kibana/blob/main/x-pack/plugins/observability_solution/apm/server/routes/services/get_services/merge_service_stats.ts#L52-L54

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

[kpatticha]

it's worth mentioning

• We show only the service name, we don't show any other information that the user is not authorised
• from my understanding, the fix should be really easy and straightforward