Cluster Privilege for ILM policy namespaces

[albertzaharovits]

Currently there are two cluster privileges for ILM actions manage_ilm and read_ilm. It is also possible, although not recommended, to grant privileges for specific ILM actions (the list of which is here https://www.elastic.co/guide/en/elasticsearch/reference/master/index-lifecycle-management-api.html ).

We discussed inside the Security team that a new privilege is desirable. This privilege would be granting access to policy management APIs (a subset of ILM actions, create, get and delete policy actions) . Moreover it must be a form of "configurable cluster privilege" such that the privilege can work on a restricted namespace of the policies.

This would prevent users that, even if they don't have privileges to assign a particular policy to an index, they can nonetheless alter the existing policy assigned to that index. The new privilege would permit the administrator to segment the policy namespace.

@elastic/es-core-features Can I get your thumbs up on this approach?

Given #49451 we should be working on this soon-ish.

[elasticmachine]

Pinging @elastic/es-security (:Security/Authorization)

[dakrone]

@albertzaharovits let me make sure I understand you. You want to add a new cluster privilege that allows only for:

• Create/Update a policy
• Delete a policy
• Retrieve a policy

And prevents other actions like retrying, or move-to-step.

Is that correct?

[albertzaharovits]

@dakrone That is correct.

In addition, the administrator would be able to define a namespace for the policies that can be accessed in the modes you listed. This is something new for the Security space as well.
For example:
"manage_ilm_policy": { "policies": ".kibana*"} would allow create/update/delete/retrieve policies but only those policies named with a leading ".kibana" prefix.

[dakrone]

Okay, thanks for clarifying @albertzaharovits, for the policy name, I assume that would match the policy ID as given in the URL right (or be a wildcard)?

[albertzaharovits]

The wildcard in the permission must match the policy ID from the URL.

[dakrone]

This sounds good to the ILM team. One thing that came up in discussion, is this something we would also want to do for SLM in the future? (It wouldn't have to be done at the same time, just a future discussion)