Granting Kbn System read permissions to read from EP Data stream #74309
Conversation
pjhampton
added
>non-issue
:Security/Authorization
|
Pinging @elastic/es-security (Team:Security) |
elasticsearchmachine
added
the
external-contributor
|
@elasticmachine merge upstream |
| .privileges("all").build(), | ||
| // Endpoint / Fleet policy responses. Kibana requires read access to send telemetry | ||
| RoleDescriptor.IndicesPrivileges.builder() | ||
| .indices(".ds-metrics-endpoint.policy-*") |
There was a problem hiding this comment.
-
"Endpoint / Fleet policy responses" Do such responses contain user data (some type of metrics are OK)? We usually avoid granting Kibana access to user data. Please acknowledge this.
-
When granting privileges we consider the backing index of a data stream a low level abstraction. Whenever defining roles it is enough to use the data stream name, eg:
| .indices(".ds-metrics-endpoint.policy-*") | |
| .indices("metrics-endpoint.policy-*") |
This is true in user facing definitions; I'm fine with it like this since this is "hidden".
There was a problem hiding this comment.
"Endpoint / Fleet policy responses" Do such responses contain user data (some type of metrics are OK)? We usually avoid granting Kibana access to user data. Please acknowledge this.
That's correct - it's being accessed for telemetry usage. These are fleet policy responses that do not contain any PII or sensitive information. They are being accessed to check for failed policy configurations from the context of endpoint installs. This will enable us to improve onboarding/UX and find bugs on our end.
When granting privileges we consider the backing index of a data stream a low level abstraction. Whenever defining roles it is enough to use the data stream name, ...
Good to know. Thanks!
…security/authz/store/ReservedRolesStore.java Co-authored-by: Albert Zaharovits <albert.zaharovits@elastic.co>
|
@elasticmachine merge upstream |
Related PR: elastic/kibana#102171
Granting the Kibana System
kibana_systemuser read access to this data stream.ds-metrics-endpoint.policy-*. This will allow Kibana to lift out failures, analyze them and send them home if user configurations allow so.