From 4e297ae72a18a3655fc8e5c8f7c6cb259104d2d4 Mon Sep 17 00:00:00 2001 From: Dario Gieselaar Date: Wed, 1 Jul 2020 09:04:38 +0200 Subject: [PATCH] [7.8] Add read privileges for annotations for apm_user (#58530) (#58782) --- .../xpack/core/security/authz/store/ReservedRolesStore.java | 4 +++- .../core/security/authz/store/ReservedRolesStoreTests.java | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index d7b8e4469919e..2c2470d6d20a9 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -168,7 +168,9 @@ private static Map initializeReservedRoles() { RoleDescriptor.IndicesPrivileges.builder().indices("apm-*") .privileges("read", "view_index_metadata").build(), RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*") - .privileges("view_index_metadata", "read").build(), + .privileges("read", "view_index_metadata").build(), + RoleDescriptor.IndicesPrivileges.builder().indices("observability-annotations") + .privileges("read", "view_index_metadata").build() }, null, MetadataUtils.DEFAULT_RESERVED_METADATA)) .put("machine_learning_user", new RoleDescriptor("machine_learning_user", new String[] { "monitor_ml" }, new RoleDescriptor.IndicesPrivileges[] { diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 1ab8d9a170625..e8d2638cbf5df 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1091,6 +1091,8 @@ public void testAPMUserRole() { assertOnlyReadAllowed(role, "apm-" + randomIntBetween(0, 5)); assertOnlyReadAllowed(role, AnomalyDetectorsIndexFields.RESULTS_INDEX_PREFIX + AnomalyDetectorsIndexFields.RESULTS_INDEX_DEFAULT); + + assertOnlyReadAllowed(role, "observability-annotations"); } public void testMachineLearningAdminRole() {