[Fleet] Reduce permissions. (#90302) (#91084)

* Reduce permissions. * Change permissions back. * Reducing permissions on fleet_enroll role - 'write', 'create_index' -> 'auto_configure', 'create_doc' * Remove indices:admin/auto_create from privileges.
elastic · Feb 11, 2021 · a936fe6 · a936fe6
1 parent 55ff85a
commit a936fe6
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 53 deletions.
diff --git a/x-pack/plugins/fleet/server/services/api_keys/index.ts b/x-pack/plugins/fleet/server/services/api_keys/index.ts
@@ -22,17 +22,8 @@ export async function generateOutputApiKey(
       cluster: ['monitor'],
       index: [
         {
-          names: [
-            'logs-*',
-            'metrics-*',
-            'traces-*',
-            '.ds-logs-*',
-            '.ds-metrics-*',
-            '.ds-traces-*',
-            '.logs-endpoint.diagnostic.collection-*',
-            '.ds-.logs-endpoint.diagnostic.collection-*',
-          ],
-          privileges: ['write', 'create_index', 'indices:admin/auto_create'],
+          names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'],
+          privileges: ['auto_configure', 'create_doc'],
         },
       ],
     },

diff --git a/x-pack/plugins/fleet/server/services/setup.ts b/x-pack/plugins/fleet/server/services/setup.ts
@@ -192,17 +192,8 @@ async function putFleetRole(callCluster: CallESAsCurrentUser) {
       cluster: ['monitor', 'manage_api_key'],
       indices: [
         {
-          names: [
-            'logs-*',
-            'metrics-*',
-            'traces-*',
-            '.ds-logs-*',
-            '.ds-metrics-*',
-            '.ds-traces-*',
-            '.logs-endpoint.diagnostic.collection-*',
-            '.ds-.logs-endpoint.diagnostic.collection-*',
-          ],
-          privileges: ['write', 'create_index', 'indices:admin/auto_create'],
+          names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'],
+          privileges: ['auto_configure', 'create_doc'],
         },
       ],
     },

diff --git a/x-pack/test/fleet_api_integration/apis/agents_setup.ts b/x-pack/test/fleet_api_integration/apis/agents_setup.ts
@@ -60,17 +60,8 @@ export default function (providerContext: FtrProviderContext) {
         cluster: ['monitor', 'manage_api_key'],
         indices: [
           {
-            names: [
-              'logs-*',
-              'metrics-*',
-              'traces-*',
-              '.ds-logs-*',
-              '.ds-metrics-*',
-              '.ds-traces-*',
-              '.logs-endpoint.diagnostic.collection-*',
-              '.ds-.logs-endpoint.diagnostic.collection-*',
-            ],
-            privileges: ['write', 'create_index', 'indices:admin/auto_create'],
+            names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'],
+            privileges: ['auto_configure', 'create_doc'],
             allow_restricted_indices: false,
           },
         ],

diff --git a/x-pack/test/fleet_api_integration/apis/fleet_setup.ts b/x-pack/test/fleet_api_integration/apis/fleet_setup.ts
@@ -62,15 +62,8 @@ export default function (providerContext: FtrProviderContext) {
             cluster: ['monitor', 'manage_api_key'],
             indices: [
               {
-                names: [
-                  'logs-*',
-                  'metrics-*',
-                  'traces-*',
-                  '.ds-logs-*',
-                  '.ds-metrics-*',
-                  '.ds-traces-*',
-                ],
-                privileges: ['write', 'create_index', 'indices:admin/auto_create'],
+                names: ['logs-*', 'metrics-*', 'traces-*'],
+                privileges: ['create_doc', 'indices:admin/auto_create'],
                 allow_restricted_indices: false,
               },
             ],
@@ -101,17 +94,8 @@ export default function (providerContext: FtrProviderContext) {
         cluster: ['monitor', 'manage_api_key'],
         indices: [
           {
-            names: [
-              'logs-*',
-              'metrics-*',
-              'traces-*',
-              '.ds-logs-*',
-              '.ds-metrics-*',
-              '.ds-traces-*',
-              '.logs-endpoint.diagnostic.collection-*',
-              '.ds-.logs-endpoint.diagnostic.collection-*',
-            ],
-            privileges: ['write', 'create_index', 'indices:admin/auto_create'],
+            names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'],
+            privileges: ['auto_configure', 'create_doc'],
             allow_restricted_indices: false,
           },
         ],