[Monitoring] R&D security changes necessary to migrate to reading from MB indices

[chrisronline]

We need to consider what changes we need to make to allow users to read from metricbeat-* from the Stack Monitoring UI. For example, we need to update the reserved role to allow reading from metricbeat-*, or ensure leaving this as-is will not be a problem for users.

Or maybe we can pursue moving away from this resolved role, ala #51296

[elasticmachine]

Pinging @elastic/stack-monitoring (Team:Monitoring)

[igoristic]

@chrisronline One thing I don't understand is that we're explicitly creating roles/polices for metricbeat-* indices, but we also have a way to change it via: monitoring.ui.metricbeat.index. Do we need a way to detect that and add the same index privileges that metricbeat-* has to the remote_monitoring_agent role?

---

Also, I was able to fix "monitoring remote_monitoring_user failed to create alias" issue by using the following role:

POST _xpack/security/role/remote_monitoring_user
{
  "cluster" : [
    "manage_ilm",
    "manage_index_templates",
    "manage_ingest_pipelines",
    "monitor",
    "cluster:admin/ilm/get",
    "cluster:admin/ilm/put",
    "cluster:monitor/xpack/watcher/watch/get",
    "cluster:admin/xpack/watcher/watch/put",
    "cluster:admin/xpack/watcher/watch/delete"
  ],
  "indices" : [
    {
      "names" : [
        ".monitoring-*"
      ],
      "privileges" : [
        "all"
      ],
      "allow_restricted_indices" : false
    },
    {
      "names" : [
        "metricbeat-*"
      ],
      "privileges" : [
        "index",
        "create_index",
        "view_index_metadata",
        "manage",
        "write",
        "manage_ilm",
        "read_cross_cluster"
      ],
      "allow_restricted_indices" : false
    }
  ]
}

This is something that will probably need to be implemented on the ES side similar to how we did it for: elastic/elasticsearch#63750

[chrisronline]

I'd wager a guess that we'd need to follow the same practices the @elastic/logs-metrics-ui team does for this. Perhaps they handle the security of the custom index at the Kibana security level?

[simianhacker]

Closed by #71233