Adds documentation for permission that provides access to system indexes #4849

cwillum · 2023-08-22T00:40:32Z

Description

Document a new permission that allows normal users to modify system indexes.

Issues Resolved

Documents the new permission and the setting that enables or disables its functionality.

Fixes #4736

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: cwillum <[email protected]>

DarshitChanpura

Thanks for putting this PR together @cwillum. Left some comments around the permission name

DarshitChanpura · 2023-08-23T19:35:52Z

_security/access-control/permissions.md

@@ -65,6 +65,16 @@ Rather than individual permissions, you can often achieve your desired security
 {: .tip }


+### System permission
+
+The system permission `system:admin/system_index` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify system indexes for the cluster. It excludes, however, access to the security system index `.opendistro_security`, which is used to store the configuration YAML files and remains accessible only to admins with an admin certificate.


This sounds like the permission itself is system:admin/system_index however system_index here is actually a placeholder text that should be replaced by the actual name of the system index i.e. system:admin/.opendistro-anomaly-detectors

Thanks for pointing this out. I didn't pick this up from my review of materials.

DarshitChanpura · 2023-08-23T19:36:32Z

_security/access-control/permissions.md

+
+The system permission `system:admin/system_index` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify system indexes for the cluster. It excludes, however, access to the security system index `.opendistro_security`, which is used to store the configuration YAML files and remains accessible only to admins with an admin certificate.
+
+Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).


nit: ... disable this feature ... . Thoughts?

DarshitChanpura · 2023-08-23T19:38:57Z

_security/access-control/permissions.md

+
+Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).
+
+Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health.


We should also mention that users with permission to modify roles restapi:admin/roles can essentially grant themselves or any other user in cluster access to system indices. However, these permissions will have to be individually granted. They cannot be granted as a * permission. i.e. system:admin/* is not a valid permission.

Also, .opendistro_security index is not permission-able.

Right, covered both these points in current text. Thanks

Signed-off-by: cwillum <[email protected]>

cwillum

@DarshitChanpura Thanks for the early review. I've addressed your comments. I'll wait to circulate this for documentation team review until Security confirms this is going into 2.10.

cwillum · 2023-08-24T00:09:48Z

_security/access-control/permissions.md

@@ -65,6 +65,16 @@ Rather than individual permissions, you can often achieve your desired security
 {: .tip }


+### System permission
+
+The system permission `system:admin/system_index` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify system indexes for the cluster. It excludes, however, access to the security system index `.opendistro_security`, which is used to store the configuration YAML files and remains accessible only to admins with an admin certificate.


Thanks for pointing this out. I didn't pick this up from my review of materials.

cwillum · 2023-08-24T00:10:14Z

_security/access-control/permissions.md

+
+The system permission `system:admin/system_index` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify system indexes for the cluster. It excludes, however, access to the security system index `.opendistro_security`, which is used to store the configuration YAML files and remains accessible only to admins with an admin certificate.
+
+Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).


cwillum · 2023-08-24T17:49:04Z

_security/access-control/permissions.md

+
+Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).
+
+Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health.


Right, covered both these points in current text. Thanks

DarshitChanpura

Hey @cwillum I apologize for confusion around system index permission setup. I've added some comments that hopefully clarify the feature.

_security/access-control/permissions.md

DarshitChanpura · 2023-08-25T17:17:45Z

_security/configuration/yaml.md

+```yml
+plugins.security.system_indices.additional_control.enabled: true
+```
+When set to `false`, the permission is disabled and only admins with an admin certificate can make changes to system indexes. By default, the setting is `true` for a new cluster.


Be default, the setting is false. Refer here:
https://github.com/opensearch-project/security/blob/d77466418d3dfe551ca1ead20fcb4e6fda88515e/src/main/java/org/opensearch/security/support/ConfigConstants.java#L319

DarshitChanpura · 2023-08-25T17:20:44Z

_security/configuration/yaml.md

+```
+When set to `false`, the permission is disabled and only admins with an admin certificate can make changes to system indexes. By default, the setting is `true` for a new cluster.
+
+To learn more about the `system:admin/<system_index_name>` permission, see [System permission]({{site.url}}{{site.baseurl}}/security/access-control/permissions/#system-permission).


Thoughts on: To learn more about the System Index Permissions, see ..

DarshitChanpura · 2023-08-25T17:22:13Z

_security/access-control/permissions.md

+
+The system permission `system:admin/<system_index_name>` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify the system index specified in the permission name. For example, the permission `system:admin/.opendistro-alerting-config` gives a user permission to modify the system index that stores configurations for the Alerting plugin. 
+
+The system permission excludes, however, access to the security system index `.opendistro_security`, which is used to store Security's configuration YAML files and remains accessible only to admins with an admin certificate.


Thoughts on: "The system permission, however, excludes access to the .opendistro_security system index, which stores the Security plugin's configuration, and is only accessible to admins with an admin certificate."

Signed-off-by: cwillum <[email protected]>

cwillum

@DarshitChanpura Thanks for reviewing this part way through. I've addressed the comments. Please have another look when you get a chance. As always, thank you.

_security/access-control/permissions.md

Signed-off-by: cwillum <[email protected]>

cwillum

@peternied Thanks for the review. I've addressed your comments. Will wait to push this along further until I get word from Security that the feature is merged.

cwillum · 2023-09-05T21:07:12Z

_security/access-control/permissions.md

+
+* Specifying the full name of a system index limits access to that index alone: `.opendistro-alerting-config`.
+* Specifying the prefix and a partial name for a system index provides access to all system indexes that begin with the name: `.opendistro-anomaly-detector*`.
+* Using `.*` is effectively the same as specifying the prefix with wildcard, as described in the previous point. This gives access to all system indexes that begin with a `.`.


@peternied Thanks for pointing this out. I've reworded the points above to bring guidance in line with this clarification. Is the additional wildcard necessary under allowed_actions only when you want to specify all system indexes under index_patterns?
One other nitpick. Are values for this configuration wrapped in single quotes or double quotes? Or doesn't it matter? I've seen both.

cwillum · 2023-09-05T22:36:10Z

_security/access-control/permissions.md

+* Using `.*` is effectively the same as specifying the prefix with wildcard, as described in the previous point. This gives access to all system indexes that begin with a `.`.
+* Entering the wildcard `*` by itself does not give access to any indexes.
+
+Use extreme caution when using the wildcard to configure access to system indexes. We highly recommend thinking ahead and anticipating the range of access that you will be extending to users before updating your configuration files.


@peternied Good perspective on that. I removed that caution (seemed redundant, anyhow) and replaced it with a "tip" about using the GET /_cat/indices/<index> operation to verify your index pattern. Thank you for that.

DarshitChanpura · 2023-09-06T01:40:56Z

@cwillum There have been changes in the feature flag name. I've addresses those here: https://github.com/opensearch-project/documentation-website/pull/4953/files. Please review it

* Changes the feature flag key and updates description of a consideration Signed-off-by: Darshit Chanpura <[email protected]> * Addresses source PR feedback Signed-off-by: Darshit Chanpura <[email protected]> --------- Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura

all updates have been addressed. LGTM!

DarshitChanpura · 2023-09-07T17:28:27Z

Security PR is merged: opensearch-project/security#3325

Signed-off-by: cwillum <[email protected]>

natebower

@cwillum Please see my comments and changes and let me know when addressed so that I can read again and approve. Thanks!

_security/access-control/permissions.md

natebower · 2023-09-11T13:05:59Z

_security/access-control/permissions.md

+
+Users that have the permission [`restapi:admin/roles`]({{site.url}}{{site.baseurl}}/security/access-control/api/#access-control-for-the-api) are able to map system index permissions to all users in the same way they would for a cluster or index permission in the `roles.yml` file. However, to preserve some control over this permission, the system index permission feature is disabled by default and allows administrators to enable this feature by setting the configuration `plugins.security.system_indices.permissions.enabled` to `true`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).
+
+Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health. An admin user should also take precautions when assigning `restapi:admin/roles` to users because this permission gives a user not only the ability to assign the system index permission to another user but also the ability to self-assign access to any system index.


Suggested change

Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health. An admin user should also take precautions when assigning `restapi:admin/roles` to users because this permission gives a user not only the ability to assign the system index permission to another user but also the ability to self-assign access to any system index.

Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health. An admin user should also take precautions when assigning the `restapi:admin/roles` permission to users because it provides not only the ability to assign the system index permission to another user but also the ability to self-assign access to any system index.

_security/configuration/yaml.md

Signed-off-by: cwillum <[email protected]>

cwillum

@natebower I've addressed your comments. At the ready to make any last changes if need be. Thanks.

_security/access-control/permissions.md

natebower

LGTM!

Signed-off-by: cwillum <[email protected]>

…tem indexes (#4849)" This reverts commit 3ec2b9c.

…xes (opensearch-project#4849) * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * Fixes some wordings around system index permission access and usage (opensearch-project#4948) * Fixes some wordings around system index permission access and usage Signed-off-by: Darshit Chanpura <[email protected]> * Addresses PR feedback Signed-off-by: Darshit Chanpura <[email protected]> * Addresses more PR feedback Signed-off-by: Darshit Chanpura <[email protected]> --------- Signed-off-by: Darshit Chanpura <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * Changes the feature flag key and updates some text (opensearch-project#4953) * Changes the feature flag key and updates description of a consideration Signed-off-by: Darshit Chanpura <[email protected]> * Addresses source PR feedback Signed-off-by: Darshit Chanpura <[email protected]> --------- Signed-off-by: Darshit Chanpura <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]> Signed-off-by: Darshit Chanpura <[email protected]> Co-authored-by: Darshit Chanpura <[email protected]>

…xes (#4849) * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * Fixes some wordings around system index permission access and usage (#4948) * Fixes some wordings around system index permission access and usage Signed-off-by: Darshit Chanpura <[email protected]> * Addresses PR feedback Signed-off-by: Darshit Chanpura <[email protected]> * Addresses more PR feedback Signed-off-by: Darshit Chanpura <[email protected]> --------- Signed-off-by: Darshit Chanpura <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * Changes the feature flag key and updates some text (#4953) * Changes the feature flag key and updates description of a consideration Signed-off-by: Darshit Chanpura <[email protected]> * Addresses source PR feedback Signed-off-by: Darshit Chanpura <[email protected]> --------- Signed-off-by: Darshit Chanpura <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> * fix#4736 system index permission Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]> Signed-off-by: Darshit Chanpura <[email protected]> Co-authored-by: Darshit Chanpura <[email protected]>

fix#4736 system index permission

c77bac7

Signed-off-by: cwillum <[email protected]>

cwillum added 2 - In progress Issue/PR: The issue or PR is in progress. security release-notes PR: Include this PR in the automated release notes v2.10.0 labels Aug 22, 2023

cwillum self-assigned this Aug 22, 2023

cwillum requested review from hdhalter, kolchfa-aws, Naarcha-AWS, vagimeli, ananzh, seanneumann, AMoo-Miki and natebower as code owners August 22, 2023 00:40

cwillum added 3 commits August 21, 2023 17:42

fix#4736 system index permission

f37d69e

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

abc33d3

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

f2b57de

Signed-off-by: cwillum <[email protected]>

DarshitChanpura reviewed Aug 23, 2023

View reviewed changes

cwillum added 3 commits August 23, 2023 17:47

fix#4736 system index permission

13b0589

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

f75599c

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

887ff13

Signed-off-by: cwillum <[email protected]>

cwillum commented Aug 24, 2023

View reviewed changes

DarshitChanpura reviewed Aug 25, 2023

View reviewed changes

DarshitChanpura mentioned this pull request Aug 29, 2023

[Question] Should system index permissions check allow access to system indices with .* pattern? opensearch-project/security#3259

Closed

cwillum added 4 commits August 29, 2023 14:42

Merge branch 'main' into fix#4736-permissionable-sys-indexes

8cad753

fix#4736 system index permission

4b1494a

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

548c739

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

4953ef5

Signed-off-by: cwillum <[email protected]>

cwillum commented Aug 30, 2023

View reviewed changes

_security/access-control/permissions.md Show resolved Hide resolved

fix#4736 system index permission

7662f64

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

063c27c

Signed-off-by: cwillum <[email protected]>

cwillum commented Sep 5, 2023

View reviewed changes

DarshitChanpura approved these changes Sep 7, 2023

View reviewed changes

DarshitChanpura requested a review from peternied September 7, 2023 14:58

peternied approved these changes Sep 7, 2023

View reviewed changes

cwillum added 2 commits September 7, 2023 16:31

fix#4736 system index permission

c959b64

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

ba37dc1

Signed-off-by: cwillum <[email protected]>

cwillum added 5 - Editorial review PR: Editorial review in progress and removed 4 - Doc review PR: Doc review in progress labels Sep 7, 2023

cwillum added 2 commits September 7, 2023 17:21

fix#4736 system index permission

771a8b0

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

3e96bd9

Signed-off-by: cwillum <[email protected]>

natebower requested changes Sep 11, 2023

View reviewed changes

cwillum added 4 commits September 11, 2023 10:01

fix#4736 system index permission

bcaee4f

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

798eecb

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

35268a2

Signed-off-by: cwillum <[email protected]>

fix#4736 system index permission

e7e7208

Signed-off-by: cwillum <[email protected]>

cwillum commented Sep 11, 2023

View reviewed changes

_security/access-control/permissions.md Outdated Show resolved Hide resolved

natebower approved these changes Sep 11, 2023

View reviewed changes

fix#4736 system index permission

0caa394

Signed-off-by: cwillum <[email protected]>

cwillum removed the 5 - Editorial review PR: Editorial review in progress label Sep 11, 2023

cwillum merged commit 3ec2b9c into main Sep 11, 2023
4 checks passed

cwillum added the 3 - Done Issue is done/complete label Sep 11, 2023

vagimeli added a commit that referenced this pull request Sep 19, 2023

Revert "Adds documentation for permission that provides access to sys…

6e70013

…tem indexes (#4849)" This reverts commit 3ec2b9c.

hdhalter mentioned this pull request Sep 25, 2023

[DOC] Feedback on /access-control/permissions/ #3523

Closed

4 tasks

hdhalter deleted the fix#4736-permissionable-sys-indexes branch March 28, 2024 21:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds documentation for permission that provides access to system indexes #4849

Adds documentation for permission that provides access to system indexes #4849

cwillum commented Aug 22, 2023

DarshitChanpura left a comment

DarshitChanpura Aug 23, 2023

cwillum Aug 24, 2023

DarshitChanpura Aug 23, 2023

cwillum Aug 24, 2023

DarshitChanpura Aug 23, 2023

cwillum Aug 24, 2023

cwillum left a comment

cwillum Aug 24, 2023

cwillum Aug 24, 2023

cwillum Aug 24, 2023

DarshitChanpura left a comment

DarshitChanpura Aug 25, 2023

DarshitChanpura Aug 25, 2023

DarshitChanpura Aug 25, 2023 •

edited

Loading

cwillum left a comment

cwillum left a comment

cwillum Sep 5, 2023

cwillum Sep 5, 2023

DarshitChanpura commented Sep 6, 2023 •

edited

Loading

DarshitChanpura left a comment •

edited

Loading

DarshitChanpura commented Sep 7, 2023

natebower left a comment

natebower Sep 11, 2023

cwillum left a comment

natebower left a comment


		The system permission `system:admin/system_index` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify system indexes for the cluster. It excludes, however, access to the security system index `.opendistro_security`, which is used to store the configuration YAML files and remains accessible only to admins with an admin certificate.

		Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).


		Admin users that have the permission `restapi:admin/roles` are able to map the `system:admin/system_index` permission to users just as they would for a cluster or index permission. However, to preserve some control over this permission, the configuration setting `plugins.security.system_indices.additional_control.enabled` allows administrators to disable this permission by setting it to `false`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).

		Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health.


		The system permission `system:admin/<system_index_name>` is unique among other permissions in that it extends some traditional admin-only accessibility to non-admin users. This permission gives normal users the ability to modify the system index specified in the permission name. For example, the permission `system:admin/.opendistro-alerting-config` gives a user permission to modify the system index that stores configurations for the Alerting plugin.

		The system permission excludes, however, access to the security system index `.opendistro_security`, which is used to store Security's configuration YAML files and remains accessible only to admins with an admin certificate.


		Users that have the permission [`restapi:admin/roles`]({{site.url}}{{site.baseurl}}/security/access-control/api/#access-control-for-the-api) are able to map system index permissions to all users in the same way they would for a cluster or index permission in the `roles.yml` file. However, to preserve some control over this permission, the system index permission feature is disabled by default and allows administrators to enable this feature by setting the configuration `plugins.security.system_indices.permissions.enabled` to `true`. For more information about this setting, see [Enabling user access to system indexes]({{site.url}}{{site.baseurl}}/security/configuration/yaml/#enabling-user-access-to-system-indexes).

		Keep in mind that an admin user who enables this feature necessarily accepts the risks involved with giving normal users access to system indexes, which may contain sensitive information and configurations essential to a cluster's health. An admin user should also take precautions when assigning `restapi:admin/roles` to users because this permission gives a user not only the ability to assign the system index permission to another user but also the ability to self-assign access to any system index.

Adds documentation for permission that provides access to system indexes #4849

Adds documentation for permission that provides access to system indexes #4849

Conversation

cwillum commented Aug 22, 2023

Description

Issues Resolved

Checklist

DarshitChanpura left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura Aug 25, 2023 • edited Loading

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura commented Sep 6, 2023 • edited Loading

DarshitChanpura left a comment • edited Loading

Choose a reason for hiding this comment

DarshitChanpura commented Sep 7, 2023

natebower left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

natebower left a comment

Choose a reason for hiding this comment

DarshitChanpura Aug 25, 2023 •

edited

Loading

DarshitChanpura commented Sep 6, 2023 •

edited

Loading

DarshitChanpura left a comment •

edited

Loading