Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add backing indices to kibana_system permissions for TI packages supporting IOC expiration #95449

Closed
wants to merge 2 commits into from

Conversation

kcreddy
Copy link
Contributor

@kcreddy kcreddy commented Apr 21, 2023

With earlier permissions #94506 that were added, we were able to successfully install the package manually from the Kibana UI and also execute the transform.
However, the system tests for ti* packages failing due to permission error on the source indices of the transform:

Error: error running package system tests: could not complete test run: could not add data stream config to policy: could not add package to policy; API status code = 403; response body = {"statusCode":403,"error":"Forbidden","message":"Error installing ti_recordedfuture 1.7.0: security_exception\n\tRoot causes:\n\t\tsecurity_exception: Cannot create transform [logs-ti_recordedfuture.latest_ioc-default-0.1.0] because user elastic/kibana lacks the required permissions [.ds-logs-ti_recordedfuture.threat-*:[read], logs-ti_recordedfuture_latest.threat-1.7.0:[]]"}

Adding backing indices directly using .ds- prefix into the existing privileges fixed the system tests locally.

This PR adds a .ds- prefix into the existing privileges for the source indices of ti* packages so that backing indices are directly given permissions.

@kcreddy kcreddy self-assigned this Apr 21, 2023
@kcreddy kcreddy added the >bug label Apr 21, 2023
@elasticsearchmachine elasticsearchmachine added external-contributor Pull request authored by a developer outside the Elasticsearch team v8.8.0 labels Apr 21, 2023
@kcreddy kcreddy closed this Apr 25, 2023
@kcreddy
Copy link
Contributor Author

kcreddy commented Apr 25, 2023

Closing since the issue turned out to be CI version of Elasticsearch. The system tests are successful with original permissions itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>bug external-contributor Pull request authored by a developer outside the Elasticsearch team v8.8.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants