Skip to content

Commit 312f9ac

Browse files
yetanothertwyetanothertw
committed
Adding tabs instead of sections
1 parent 3991350 commit 312f9ac

File tree

1 file changed

+63
-54
lines changed

1 file changed

+63
-54
lines changed

‎deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md‎

Lines changed: 63 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,13 @@ The examples on this page use the [Role management API](https://www.elastic.co/d
3535

3636

3737
:::{{admonition}} Document and field level security in {{serverless-full}}
38-
This topic explains how to apply document and field level security in {{stack}}. You can also apply document and field level security in {{serverless-full}} projects.
38+
This topic explains how to apply document and field level security in {{stack}} and includes steps for achieving similar tasks in {{serverless-full}} projects.
3939

40-
In {{serverless-full}}, you can only manage document and field level security using the {{ecloud}} console. However, document level security is still managed using queries, and you can use the queries on this page as a guideline.
40+
In {{serverless-full}}, you can only manage document and field level security using the {{ecloud}} console. However, document-level security is still managed using queries, and you can use the queries on this page as a guideline.
4141

42-
[Learn more](/deploy-manage/users-roles/serverless-custom-roles.md#document-level-and-field-level-security).
42+
As an administrator, you can create custom roles in the console that define exactly what data users can access by assigning {{es}} [cluster](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-cluster-privileges) and [index](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-index-privileges) privileges and [{{kib}}](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-kib-privileges) privileges.
43+
44+
[Learn more](/deploy-manage/users-roles/serverless-custom-roles.md#document-level-and-field-level-security)
4345
:::
4446

4547
## Document level security [document-level-security]
@@ -59,6 +61,9 @@ Omitting the `query` parameter entirely disables document level security for the
5961

6062
### Basic examples
6163

64+
:::::{tab-set}
65+
66+
::::{tab-item} {{stack}}
6267
The following role definition grants read access only to documents that belong to the `click` category within all the `events-*` data streams and indices:
6368

6469
```console
@@ -109,6 +114,43 @@ POST /_security/role/dept_role
109114
]
110115
}
111116
```
117+
::::
118+
119+
::::{tab-item} {{serverless-short}}
120+
To configure document-level security (DLS), you create a custom role where you define the documents that this role grants access to, using the [QueryDSL](/explore-analyze/query-filter/languages/querydsl.md) syntax:
121+
122+
1. Go to the **Custom Roles** page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
123+
1. Select **Create role**.
124+
1. Give your custom role a meaningful name and description.
125+
1. In the **Index privileges** area, specify the data stream pattern and the privilege you want to grant. For example, enter `events-*` and `read`.
126+
1. Enable the **Grant read privileges to specific documents** toggle and add your query using the QueryDSL syntax.
127+
128+
* For example, to allow read access only to documents that belong to the click category within all the `events-*` data streams, enter the following query:
129+
```
130+
{
131+
"match" : { "category" : “click” }
132+
}
133+
```
134+
135+
:::{image} /deploy-manage/images/serverless-custom-role-document-level-privileges-ex-1.png
136+
:title: Configuring document-level security
137+
:::
138+
139+
* To allow read access only to the documents whose `department_id` equals 12, enter the following query:
140+
```
141+
{
142+
"term" : { "department_id" : 12 }
143+
}
144+
```
145+
146+
![Configuring document-level security another example](/deploy-manage/images/serverless-custom-role-document-level-privileges-ex-2.png)
147+
148+
1. Optional: To grant this role access to {{kib}} spaces for feature access and visibility, click **Assign to this space**. Specify the level of access required and click **Assign role**.
149+
1. Select **Create role** to save your custom role.
150+
::::
151+
152+
:::::
153+
112154
113155
### Templating a role query [templating-role-query]
114156
@@ -198,50 +240,13 @@ The [set security user processor](elasticsearch://reference/enrich-processor/ing
198240
For more information, see [Ingest pipelines](/manage-data/ingest/transform-enrich/ingest-pipelines.md) and [Set security user](elasticsearch://reference/enrich-processor/ingest-node-set-security-user-processor.md).
199241

200242

201-
### Configuring document-level security in {{serverless-short}} [document-level-serverless]
202-
```{applies_to}
203-
serverless: ga
204-
```
205-
206-
As an administrator, you can create custom roles that enable users to access data and project features. When you create a custom role, you can assign {{es}} [cluster](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-cluster-privileges) and [index](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-index-privileges) privileges and [{{kib}}](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-kib-privileges) privileges.
207-
208-
To configure document-level security (DLS), you create a custom role where you define the documents that this role grants access to, using the [QueryDSL](/explore-analyze/query-filter/languages/querydsl.md) syntax:
209-
210-
1. Go to the **Custom Roles** page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
211-
1. Select **Create role**.
212-
1. Give your custom role a meaningful name and description.
213-
1. In the **Index privileges** area, specify the data stream pattern and the privilege you want to grant. For example, enter `events-*` and `read`.
214-
1. Enable the **Grant read privileges to specific documents** toggle and add your query using the QueryDSL syntax.
215-
* For example, to allow read access only to documents that belong to the click category within all the `events-*` data streams, enter the following query:
216-
```
217-
{
218-
"match" : { "category" : “click” }
219-
}
220-
```
221-
222-
:::{image} /deploy-manage/images/serverless-custom-role-document-level-privileges-ex-1.png
223-
:title: Configuring document-level security
224-
:::
225-
226-
* To allow read access only to the documents whose `department_id` equals 12, enter the following query:
227-
```
228-
{
229-
"term" : { "department_id" : 12 }
230-
}
231-
```
232-
233-
:::{image} /deploy-manage/images/serverless-custom-role-document-level-privileges-ex-2.png
234-
:title: Configuring document-level security another example
235-
:::
236-
237-
1. Optional: To grant this role access to {{kib}} spaces for feature access and visibility, click **Assign to this space**. Specify the level of access required and click **Assign role**.
238-
1. Select **Create role** to save your custom role.
239-
240-
241243
## Field level security [field-level-security]
242244

243245
To enable field level security, specify the fields that each role can access as part of the indices permissions in a role definition. Field level security is thus bound to a well-defined set of data streams or indices (and potentially a set of [documents](../../../deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md)).
244246

247+
:::::{tab-set}
248+
249+
::::{tab-item} {{stack}}
245250
The following role definition grants read access only to the `category`, `@timestamp`, and `message` fields in all the `events-*` data streams and indices.
246251

247252
```console
@@ -261,9 +266,9 @@ POST /_security/role/test_role1
261266

262267
Access to the following metadata fields is always allowed: `_id`, `_type`, `_parent`, `_routing`, `_timestamp`, `_ttl`, `_size` and `_index`. If you specify an empty list of fields, only these metadata fields are accessible.
263268

264-
::::{note}
269+
:::{note}
265270
Omitting the fields entry entirely disables field level security.
266-
::::
271+
:::
267272

268273

269274
You can also specify field expressions. For example, the following example grants read access to all fields that start with an `event_` prefix:
@@ -426,16 +431,9 @@ The resulting permission is equal to:
426431
}
427432
```
428433

429-
::::{note}
430-
Field-level security should not be set on [`alias`](elasticsearch://reference/elasticsearch/mapping-reference/field-alias.md) fields. To secure a concrete field, its field name must be used directly.
431434
::::
432435

433-
### Configuring field-level security in {{serverless-short}} [field-level-serverless]
434-
```{applies_to}
435-
serverless: ga
436-
```
437-
438-
As an administrator, you can create custom roles that enable users to access data and project features. When you create a custom role, you can assign {{es}} [cluster](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-cluster-privileges) and [index](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-es-index-privileges) privileges and [{{kib}}](/deploy-manage/users-roles/serverless-custom-roles.md#custom-roles-kib-privileges) privileges.
436+
::::{tab-item} {{serverless-short}}
439437

440438
To configure field-level security (FLS), you create a custom role where you define the specific fields that this role grants or denies access to:
441439

@@ -457,7 +455,15 @@ To configure field-level security (FLS), you create a custom role where you defi
457455
:::
458456

459457
1. Optional: To grant this role access to {{kib}} spaces for feature access and visibility, click **Assign to this space**. Specify the level of access required and click **Assign role**.
460-
1. Select **Create role** to save your custom role.
458+
1. Select **Create role** to save your custom role.
459+
460+
::::
461+
462+
:::::
463+
464+
:::{note}
465+
Field-level security should not be set on [`alias`](elasticsearch://reference/elasticsearch/mapping-reference/field-alias.md) fields. To secure a concrete field, its field name must be used directly.
466+
:::
461467

462468

463469
## Multiple roles with document and field level security [multiple-roles-dls-fls]
@@ -475,6 +481,9 @@ If you need to restrict access to both documents and fields, consider splitting
475481
::::
476482

477483
## Field and document level security with Cross-cluster API keys [ccx-apikeys-dls-fls]
484+
```{applies_to}
485+
serverless: unavailable
486+
```
478487

479488
[Cross-cluster API keys](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-create-cross-cluster-api-key) can be used to authenticate requests to a remote cluster. The `search` parameter defines permissions for cross-cluster search. The `replication` parameter defines permissions for cross-cluster replication.
480489

0 commit comments

Comments
 (0)