Skip to content

Commit 80963f1

Browse files
author
David Roberts
committed
Add Kibana application privileges to the reserved role docs
Users who create roles that are similar to the reserved roles need to know about these. The privileges were added to the reserved roles in elastic/elasticsearch#40651 and elastic/elasticsearch#42757
1 parent 4c89757 commit 80963f1

File tree

1 file changed

+11
-5
lines changed

1 file changed

+11
-5
lines changed

docs/en/stack/security/authorization/built-in-roles.asciidoc

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,13 @@ suitable for writing beats output to {es}.
3939

4040
[[built-in-roles-data-frame-transforms-admin]] `data_frame_transforms_admin` ::
4141
Grants `manage_data_frame_transforms` cluster privileges, which enable you to
42-
manage data frames.
42+
manage data frame transforms. This role also includes the `reserved_ml` {kib}
43+
application privilege which makes the {kib} {ml} application visible.
4344

4445
[[built-in-roles-data-frame-transforms-user]] `data_frame_transforms_user` ::
4546
Grants `monitor_data_fram_transforms` cluster privileges, which enable you to
46-
use data frames.
47+
use data frame transforms. This role also includes the `reserved_ml` {kib}
48+
application privilege which makes the {kib} {ml} application visible.
4749

4850
[[built-in-roles-ingest-user]] `ingest_admin` ::
4951
Grants access to manage *all* index templates and *all* ingest pipeline configurations.
@@ -92,19 +94,23 @@ suitable for use within a Logstash pipeline.
9294
[[built-in-roles-ml-admin]] `machine_learning_admin`::
9395
Grants `manage_ml` cluster privileges, read access to `.ml-anomalies*`,
9496
`.ml-notifications*`, `.ml-state*`, `.ml-meta*` indices and write access to
95-
`.ml-annotations*` indices.
97+
`.ml-annotations*` indices. This role also includes the `reserved_ml` {kib}
98+
application privilege which makes the {kib} {ml} application visible.
9699

97100
[[built-in-roles-ml-user]] `machine_learning_user`::
98101
Grants the minimum privileges required to view {ml} configuration,
99102
status, and work with results. This role grants `monitor_ml` cluster privileges,
100103
read access to the `.ml-notifications` and `.ml-anomalies*` indices
101104
(which store {ml} results), and write access to `.ml-annotations*` indices.
105+
This role also includes the `reserved_ml` {kib} application privilege which
106+
makes the {kib} {ml} application visible.
102107

103108
[[built-in-roles-monitoring-user]] `monitoring_user`::
104109
Grants the minimum privileges required for any user of {monitoring} other than those
105110
required to use {kib}. This role grants access to the monitoring indices and grants
106-
privileges necessary for reading basic cluster information. Monitoring users should
107-
also be assigned the `kibana_user` role.
111+
privileges necessary for reading basic cluster information. This role also includes
112+
the `reserved_monitoring` {kib} application privilege which makes the {kib} monitoring
113+
application visible. Monitoring users should also be assigned the `kibana_user` role.
108114

109115
[[built-in-roles-remote-monitoring-agent]] `remote_monitoring_agent`::
110116
Grants the minimum privileges required to write data into the monitoring indices

0 commit comments

Comments
 (0)