How to create custom roles and users for an Alibaba Cloud Elasticsearch instance - Elasticsearch

Procedure

Note

These instructions apply to Elasticsearch V6.7 and V7.x. Steps for other versions may differ. Refer to the console for the most accurate steps.

Create a role.

Log on to the Kibana console.

For more information, see Log on to the Kibana console.
Navigate to the management page.
- V6.7: In the left-side navigation pane, click Management.
- V7.x: In the upper-left corner of the page, click the icon and then select Management > Stack Management.
In the Security section, click Roles.

Click Create role and configure the parameters.

Parameter	Description
Role Name	The name of the role.
Cluster privileges	Defines privileges for cluster operations, such as viewing cluster health and settings, or creating a snapshot. For more information, see Cluster privileges.
Run As privileges	Optional. The user who assumes this role. If not specified here, you can assign the role when you create the user. For more information, see Create a user.
Index privileges	Defines privileges for index operations, such as granting `read` access to all fields of all indexes by setting the index name to ``. Index names support wildcards () and regular expressions. For more information, see Indices privileges. Configure the following parameters: Indices: Select an Index Pattern, such as `heartbeat-`. Note* If you do not have an index pattern, go to the Management page, click Index Pattern under Kibana, and follow the on-screen instructions to create one. Privileges: The privileges to assign to the role. Granted fields (optional): The fields on which to grant privileges.
Kibana privileges	Defines privileges for Kibana operations. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

When creating a role, you must assign privileges. The following examples show common role configurations:

Grant a standard user read-only privileges on a specific index. This user can only access the specified index.

For more information, see Configure read-only index privileges.
Grant a standard user privileges to view all or some dashboards.

For more information, see Configure dashboard privileges.
Grant a standard user read and write privileges on some indexes and read-only privileges on all clusters. For example, the user can view cluster health, snapshots, and settings, and write data to and update mappings for an index.

For more information, see Configure index read/write and cluster read-only privileges.
Grant a standard user read-only privileges for Kibana Discover and an index. This user can go to the Discover page in the Kibana console to view the data of that index.

For more information, see Configure Discover read-only privileges for index data.
Grant a standard user privileges to create, read, update, and delete documents, create and delete indexes, and modify index configurations, without granting access to the Kibana console.

For more information, see Configure permissions to manage indexes and documents without Kibana access.

Click Create role.

Create a user and assign roles to grant permissions.

Navigate to the management page.
- V6.7: In the left-side navigation pane, click Management.
- V7.x: In the upper-left corner of the page, click the icon and then select Management > Stack Management.
In the Security section, click Users.

Click Create new user and configure the parameters.

Parameter	Description
Username	The username for logging on to the Kibana console.
Password	The password for the user to log on to the Kibana console.
Confirm Password	Must match the Password.
Full name	The full name of the user.
Email address	The user's email address.
Roles	Assign roles to the user. You can select one or more custom or built-in roles. Important Even if you specified a user in the `Run As privileges` section when you create the role, you must still assign that role to the user here. Otherwise, the user cannot log on.

Click Create user.

Log on to the Kibana console as the new user and perform an operation to verify the permissions.

Configure read-only index privileges

Use case

Grant a standard user read-only privileges for a specific index. The user can query index data in the Kibana console but cannot access cluster-level APIs.

Role configuration

Table 1. Privilege description

Privilege type	Privilege key	Privilege value	Description
Index privileges	indices	kibana_sample_data_logs	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
	Granted fields (optional)	`*`	Index fields. * indicates all fields.
Kibana privileges	privileges	`read`	Grants Kibana read-only access to all spaces. The default is none, which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the new user and run a read command. The command should return a normal result.
```
GET /kibana_sample_data_logs/_search
```

Run a write command. You will receive an authorization error.

POST /kibana_sample_data_logs/_doc/1
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "action [indices:data/write/index] is unauthorized for user [user-test]"
      }
    ],
    "type": "security_exception",
    "reason": "action [indices:data/write/index] is unauthorized for user [user-test]"
  },
  "status": 403
}

Configure dashboard privileges

Use case

Grant a standard user read-only privileges for a specific index and allow the user to view the dashboard data of that index.

Role configuration

When you create a user, assign the read-index and kibana_dashboard_only_user roles to the user.

read-index: An example of a custom role that you must create. This role has read-only privileges for a specified index.
kibana_dashboard_only_user: A built-in Kibana role that has the privilege to view dashboard data for specified indexes.
Note
- In Kibana 7.0 and later, the kibana_dashboard_only_user role has been deprecated. To view the dashboard for a specific index, you only need to configure read-only privileges for that index. For more information, see Configuring read-only privileges for an index.
- The kibana_dashboard_only_user role can be used with custom roles in many scenarios. If you need to assign only the Dashboards only roles feature to a custom role, in the Kibana area on the Management page, find the Dashboard section, and bind a custom role (the default is the kibana_dashboard_only_user role).

Verification

Log on to the Kibana console as the new user. You can view the dashboard of the corresponding index.

The dashboard named heartbeat-dashboard contains a heartbeat-visu line chart, with Count on the Y-axis and @timestamp per 30 seconds on the X-axis, showing the heartbeat count trend over time.

Configure index read/write and cluster read-only

Use case

Grant a user read, write, and delete privileges for specific indexes, and read-only privileges for the cluster and Kibana.

Role configuration

Table 2. Privilege description

Privilege type	Privilege key	Privilege value	Description
Cluster privileges	Cluster	`monitor`	Grants read-only privileges on the cluster, such as viewing cluster health, status, hot threads, node information, and blocked tasks.
Index privileges	indices	`heartbeat-,library`	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see roles-indices-priv.
	privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
		`create_index`	The privilege to create an index. If you define an index alias when creating an index, you also need to grant the `manage` privilege. Important The index alias must also satisfy the matching rules defined under indices.
		`view_index_metadata`	Grants read-only access to index metadata, such as mappings and settings.
		`write`	The privilege to perform all write operations on documents, including `index`, `update`, `delete`, `bulk`, and updating mappings. This privilege covers a wider range of operations than `create` and `index`.
		`monitor`	The privilege to monitor all operations, including `index recovery`, `segments info`, `index stats`, and `status`.
		`delete`	The privilege to delete index documents.
		`delete_index`	The privilege to delete an index.
	granted fields	`*`	The index fields to authorize. * represents all fields of the index.
Kibana privileges	privileges	`read`	Grants Kibana read-only access to all spaces. The default is none, which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the standard user. The following commands all succeed.

GET _cat/indices?v
GET _cluster/stats

GET /product_info/_search
GET /product_info1/_search

POST /kibana_sample_data_logs/_doc/2
{
"productName":"testpro",
"annual_rate":"3.22%",
"describe":"testpro"
}
PUT /product_info2/_doc/1
{
"productName":"testpro",
"annual_rate":"3.22%",
"describe":"testpro"
}

DELETE product_info

--- Output ---
health status index                           uuid  pri rep docs.count docs.deleted store.size pri.store.size
green  open   .monitoring-es-6-2020.12.14     xxx   1   1
green  open   .kibana_1                       xxx   1   1
green  open   kibana_sample_data_logs         xxx   5   1   2          0            18.1kb     9kb
green  open   .monitoring-kibana-6-2020.12.12 xxx   1   1
green  open   .monitoring-es-6-2020.12.11     xxx   1   1
green  open   .monitoring-es-6-2020.12.10     xxx   1   1
green  open   .monitoring-kibana-6-2020.12.14 xxx   1   1
green  open   .monitoring-es-6-2020.12.09     xxx   1   1
green  open   .kibana_task_manager            xxx   1   1
green  open   .monitoring-kibana-6-2020.12.13 xxx   1   1
green  open   .monitoring-kibana-6-2020.12.09 xxx   1   1
green  open   product_info1                   xxx   5   1   0          0            2.5kb      1.2kb
green  open   .monitoring-kibana-6-2020.12.11 xxx   1   1
green  open   .monitoring-es-6-2020.12.12     xxx   1   1
green  open   product_info2                   xxx   5   1   1          0            9.3kb      4.6kb
green  open   .monitoring-kibana-6-2020.12.10 xxx   1   1
green  open   .monitoring-es-6-2020.12.13     xxx   1   1
green  open   .security-6                     xxx   1   1

View detailed information about the indexes in the cluster.
```
GET /_cat/indices?v
```
View the cluster status.
```
GET /_cluster/stats
```
Query data in the library_v1 index.
```
GET /library_v1/_search
```
Query data in the library_v2 index.
```
GET /library_v2/_search
```

Write data to the heartbeat-2023.01.01 index by using the POST method.

POST /heartbeat-2023.01.01/_doc/2
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

Write data to the library_v3 index by using the PUT method.

PUT /library_v3/_doc/1
{
    "productName": "testpro",
    "annual_rate": "3.22%",
    "describe": "testpro"
}

Delete the library_v1 index.
```
DELETE library_v1
```

Configure Discover read-only privileges

Use case

Grant a standard user read-only privileges for Kibana Discover and an index. This user can go to the Discover page in the Kibana console to view the data of that index.

Role configuration

Table 3. Privilege description

Privilege type	Privilege key	Privilege value	Description
Cluster privileges	Privileges	`monitor`	Grants read-only privileges on all clusters, such as viewing cluster health and status, hot threads, node information, node and cluster statistics, and pending cluster tasks.
Index privileges	Indices	kibana_sample_data_ecommerce	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	Privileges	`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
	Granted fields (optional)	`*`	Index field. The `*` represents all fields.
Kibana privileges	Privileges	`read`	Grants read-only privileges for all Kibana spaces. The default value is `none`, which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features, such as the Discover page, and require you to specify a Kibana space.

Verification

Log on to the Kibana console as the new user. You can view the data of the specified index on the Discover page.

The index currently being viewed is kibana_sample_data_ecommerce, and the page successfully displays the e-commerce order document details in that index.

Manage indexes and documents without Kibana access

Use case

Grant a user privileges to manage indexes and documents via the API, without access to the Kibana console.

Role configuration

Table 4. Privilege description

Privilege type	Privilege key	Privilege value	Description
Index privileges	Indices	`test*`	The name of the index. You can specify the full name, an alias, a wildcard, or a regular expression. For more information, see Indices Privileges.
	Privileges	`create_index`	The privilege to create an index. If the request to create an index contains an alias to be added to the index, you also need to grant the `manage` privilege.
		`delete_index`	The privilege to delete an index.
		`index`	The privilege to index and update documents, and to update index mappings.
		`delete`	The privilege to delete documents.
		`read`	Grants read-only privileges on the index. These privileges include `get`, `mget`, `search`, and `count`. For more information, see privileges-list-indices.
		`manage`	Grants privileges for index management operations, such as managing aliases, settings, mappings, and templates.
	Granted fields (optional)	`*`	Index fields. `*` represents all fields.
Kibana privileges	Privileges	`none`	Set to `none` (default), which denies access to all Kibana spaces. Important Kibana versions earlier than 7.0 support only Base privileges, which grant access to all spaces by default. Kibana 7.0 and later support Feature privileges in addition to Base privileges. Feature privileges grant access to specific Kibana features and require you to specify a Kibana space.

Verification

Use cURL to create and then delete an index.

[root@iZbp17az4re1xxx ~]#
[root@iZbp17az4re1xxx ~]# curl -u 'test:xxx' -XPUT "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role"
{"acknowledged":true,"shards_acknowledged":true,"index":"test_role"}[root@iZbp17az4re1kuerxxx ~]#
[root@iZbp17az4re1xxx ~]#
[root@iZbp17az4re1xxx ~]# curl -u 'test:xxx' -XDELETE "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role"
{"acknowledged":true} root@iZbp17az4re1kuerxxx ~]#

Modify the index configuration. This example sets the index data to cold data.

[root@iZbp17az4re1kuere  ~]#
[root@iZbp17az4re1kuere  ~]# curl -u 'test:xxx'  -XPUT "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_settings" -H 'content-Type:application/json' -d '{"index":{"routing":{"allocation":{"require.box_type": "warm"}}}}'
{"acknowledged":true}[root@iZbp17az4re1kuere-xxx  ~]#

Perform CRUD operations on documents.

[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]# curl -u 'test_xxx' -XPOST "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_doc/1" -H 'content-Type:application/json' -d '{"test":"you know, for search"}'
{"_index":"test_role","_type":"_doc","_id":"1","_version":1,"result":"created","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":0,"_primary_term":1}
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]# curl -u 'test_xxx' -XPOST "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_doc/2" -H 'content-Type:application/json' -d '{"test":"you know, for search"}'
{"_index":"test_role","_type":"_doc","_id":"2","_version":1,"result":"created","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":1,"_primary_term":1}
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]# curl -u 'test_xxx' -XPOST "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_doc/2" -H 'content-Type:application/json' -d '{"test":"you know, for search, 2.0"}'
{"_index":"test_role","_type":"_doc","_id":"2","_version":2,"result":"updated","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":2,"_primary_term":1}
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]# curl -u 'test_xxx' -XGET "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_search?q=test:'search'"
{"took":64,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":2,"max_score":0.19100356,"hits":[{"_index":"test_role","_type":"_doc","_id":"1","_score":0.19100356,"_source":{"test":"you know,for search"}},{"_index":"test_role","_type":"_doc","_id":"2","_score":0.17439455,"_source":{"test":"you know,for search, 2.0"}}]}}
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]# curl -u 'test_xxx' -XDELETE "http://es-cn-co92y5p2b000xxx.elasticsearch.aliyuncs.com:9200/test_role/_doc/2"
{"_index":"test_role","_type":"_doc","_id":"2","_version":3,"result":"deleted","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":3,"_primary_term":1}
[root@iZbp17az4re1kueren xxx ~]#
[root@iZbp17az4re1kueren xxx ~]#

Log on to the Kibana console as the user.

A message is displayed indicating that the user lacks the required privileges.

Elasticsearch:Manage user permissions with X-Pack roles

Background

Procedure

Configure read-only index privileges

Use case

Role configuration

Verification

Configure dashboard privileges

Use case

Role configuration

Verification

Configure index read/write and cluster read-only

Use case

Role configuration

Verification

Configure Discover read-only privileges

Use case

Role configuration

Verification

Manage indexes and documents without Kibana access

Use case

Role configuration

Verification