How to create custom roles and users for an Alibaba Cloud Elasticsearch instance - Elasticsearch

To control access to your clusters, indexes, fields, or other operations, you can use the role-based access control (RBAC) feature in Elasticsearch X-Pack. RBAC allows you to grant specific privileges to roles and then assign those roles to users. While Alibaba Cloud Elasticsearch includes several built-in roles, you can also create custom roles for more granular control. This article explains how to configure several common roles to manage user permissions.

Background

Alibaba Cloud Elasticsearch supports the X-Pack RBAC mechanism. For more information, see User authorization.
Alibaba Cloud Elasticsearch supports multiple security authentication features. For more information, see Authentication and authorization in Elasticsearch.

Procedure

Note

These instructions apply to Alibaba Cloud Elasticsearch V6.7 and V7.x. The steps for other versions may differ. For the most accurate steps, refer to the user interface in the console.

Create a role.

Log on to the Kibana console.
For more information, see Log on to the Kibana console.
Navigate to the management page.
- V6.7: In the left-side navigation pane, click Management.
- V7.x: In the upper-left corner of the page, click the icon and then select Management > Stack Management.
In the Security section, click Roles.

Click Create role and configure the parameters.

填写角色信息

Parameter	Description
Role Name	The name of the role.
Cluster privileges	Defines privileges for cluster operations, such as viewing cluster health and settings, or creating a snapshot. For more information, see Cluster privileges.
Run As privileges	The user who assumes this role. This is optional. If you do not select a user here, you can assign the role when you create the user. For more information, see Create a user.
Index privileges	Defines privileges for index operations, such as granting `read` access to all fields of all indexes by setting the index name to ``. Index names support wildcards () and regular expressions. For more information, see Indices privileges. Configure the following parameters: Indices: Select an Index Pattern, such as `heartbeat-`. Note* If you do not have an index pattern, go to the Management page, click Index Pattern under Kibana, and follow the on-screen instructions to create one. Privileges: The privileges to assign to the role. Granted fields (optional): The fields on which to grant privileges.
Kibana privileges	Defines privileges for Kibana operations. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

When creating a role, you must assign privileges. This article provides examples of the following role configurations:

Grant a standard user read-only privileges on a specific index. This user can only access the specified index.
For more information, see Configure read-only index privileges.
Grant a standard user privileges to view all or some dashboards.
For more information, see Configure dashboard privileges.
Grant a standard user read and write privileges on some indexes and read-only privileges on all clusters. For example, the user can view cluster health, snapshots, and settings, and write data to and update mappings for an index.
For more information, see Configure index read/write and cluster read-only privileges.
Grant a standard user read-only privileges for Kibana Discover and an index. This user can go to the Discover page in the Kibana console to view the data of that index.
For more information, see Configure Discover read-only privileges for index data.
Grant a standard user privileges to create, read, update, and delete documents, create and delete indexes, and modify index configurations, without granting access to the Kibana console.
For more information, see Configure permissions to manage indexes and documents without Kibana access.

Click Create role.

Create a user and assign roles to grant permissions.

Navigate to the management page.
- V6.7: In the left-side navigation pane, click Management.
- V7.x: In the upper-left corner of the page, click the icon and then select Management > Stack Management.
In the Security section, click Users.

Click Create new user and configure the parameters.

Create new user

Parameter	Description
Username	The username for logging on to the Kibana console.
Password	The password for the user to log on to the Kibana console.
Confirm Password	Must match the Password.
Full name	The full name of the user.
Email address	The user's email address.
Roles	Assign roles to the user. You can select one or more custom or built-in roles. Important Even if you specified a user in the `Run As privileges` section when you create the role, you must still assign that role to the user here. Otherwise, the user cannot log on.

Click Create user.

Log on to the Kibana console as the new user and perform an operation to verify the permissions.

Configure read-only index privileges

Use case

Grant a standard user read-only privileges for a specific index. The user can query index data in the Kibana console but cannot access cluster-level APIs.

Role configuration

索引只读权限

Table 1. Privilege description

Privilege type	Privilege key	Privilege value	Description
Index privileges	indices	kibana_sample_data_logs	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
	Granted fields (optional)	`*`	Index fields. * indicates all fields.
Kibana privileges	privileges	`read`	Grants the Kibana read-only privilege to all spaces. The default value is none, which means that all spaces have no privilege to access Kibana. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the new user and run a read command. The command should return a normal result.
```
GET /kibana_sample_data_logs/_search
```

Run a write command. You will receive an authorization error.

POST /kibana_sample_data_logs/_doc/1
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

验证只读权限

Configure dashboard privileges

Use case

Grant a standard user read-only privileges for a specific index and allow the user to view the dashboard data of that index.

Role configuration

When you create a user, assign the read-index and kibana_dashboard_only_user roles to the user. Dashboard role configuration

read-index: An example of a custom role that you must create. This role has read-only privileges for a specified index.
kibana_dashboard_only_user: A built-in Kibana role that has the privilege to view dashboard data for specified indexes.
Note
- In Kibana 7.0 and later, the kibana_dashboard_only_user role has been deprecated. To view the dashboard for a specific index, you only need to configure read-only privileges for that index. For more information, see Configuring read-only privileges for an index.
- The kibana_dashboard_only_user role can be used with custom roles in many scenarios. If you need to assign only the Dashboards only roles feature to a custom role, in the Kibana area on the Management page, click Advanced Settings, find the Dashboard section, and bind a custom role (the default is the kibana_dashboard_only_user role).

Verification

Log on to the Kibana console as the new user. You can view the dashboard of the corresponding index. 查看Dashboard大盘

Configure index read/write and cluster read-only

Use case

Grants a user read, write, and delete privileges for specific indexes, and read-only privileges for the cluster and Kibana.

Role configuration

索引读写和集群只读权限

Table 2. Privilege description

Privilege type	Privilege key	Privilege value	Description
Cluster privileges	Cluster	`monitor`	Grants read-only privileges on the cluster. For example, viewing cluster health, status, hot threads, node information, and blocked tasks.
Index privileges	indices	`heartbeat-,library`	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see roles-indices-priv.
	privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
		`create_index`	The privilege to create an index. If you define an index alias when creating an index, you also need to grant the `manage` privilege. Important The index alias must also satisfy the matching rules defined under indices.
		`view_index_metadata`	Grants read-only access to index metadata, such as mappings and settings.
		`write`	The privilege to perform all write operations on documents, including `index`, `update`, `delete`, `bulk`, and updating mappings. This privilege covers a wider range of operations than `create` and `index`.
		`monitor`	The privilege to monitor all operations, including `index recovery`, `segments info`, `index stats`, and `status`.
		`delete`	The privilege to delete index documents.
		`delete_index`	The privilege to delete an index.
	granted fields	`*`	The index fields to authorize. * represents all fields of the index.
Kibana privileges	privileges	`read`	Grants Kibana read-only privilege to all spaces. The default value is none, which means that no spaces have the privilege to access Kibana. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the standard user. The following commands all succeed.

View detailed information about the indexes in the cluster.
```
GET /_cat/indices?v
```
View the cluster status.
```
GET /_cluster/stats
```
Query data in the library_v1 index.
```
GET /library_v1/_search
```
Query data in the library_v2 index.
```
GET /library_v2/_search
```

Write data to the heartbeat-2023.01.01 index by using the POST method.

POST /heartbeat-2023.01.01/_doc/2
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

Write data to the library_v3 index by using the PUT method.

PUT /library_v3/_doc/1
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

Delete the library_v1 index.
```
DELETE library_v1
```

Configure Discover read-only privileges

Use case

Grant a standard user read-only privileges for Kibana Discover and an index. This user can go to the Discover page in the Kibana console to view the data of that index.

Role configuration

Discover Read权限配置

Table 3. Privilege description

Privilege type	Privilege key	Privilege value	Description
Cluster privileges	Privileges	`monitor`	Grants read-only privileges on all clusters, such as viewing cluster health and status, hot threads, node information, node and cluster statistics, and pending cluster tasks.
Index privileges	Indices	kibana_sample_data_ecommerce	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	Privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
	Granted fields (optional)	`*`	Index field. The `*` represents all fields.
Kibana privileges	Privileges	`read`	Grants read-only privileges for all Kibana spaces. The default value is `none`, which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features, such as the Discover page, and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the new user. You can view the data of the specified index on the Discover page. 查看Discover页面

Manage indexes and documents without Kibana access

Use case

Grants a user privileges to manage indexes and documents via the API, without access to the Kibana console.

Role configuration

角色配置

Table 4. Privilege description

Privilege type	Privilege key	Privilege value	Description
Index privileges	Indices	`test*`	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	Privileges	`create_index`	The privilege to create an index. If the request to create an index contains an alias to be added to the index, you also need to grant the `manage` privilege.
		`delete_index`	The privilege to delete an index.
		`index`	The privilege to index and update documents, and to update index mappings.
		`delete`	The privilege to delete documents.
		`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
		`manage`	Grants privileges for index management operations, such as managing aliases, settings, mappings, and templates.
	Granted fields (optional)	`*`	Index fields. `*` represents all fields.
Kibana privileges	Privileges	`none`	Set to `none` (default), which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Use cURL to create and then delete an index.
Modify the index configuration. This example sets the index data to cold data.
Perform CRUD operations on documents.
Log on to the Kibana console as the user.
A message is displayed indicating that the user lacks the required privileges.