[Cloud Security Posture] fix ilm deletion step error permissions

[Omolola-Akinleye]

SDH Ticket Cannot execute ILM policy delete step on CSPM findings logs was created a few weeks ago. Discussion Thread between product manager, engineering and sdh engineer on two proposed solutions:

• Solution: Update the datastream index with delete_index privileges for logs-cloud_security_posture.-* to prevent deletion phase execution error when the logs-cloud_security_posture.-*` exceeds the retention period(180 days). There are also has been similar SDH Cannot execute ILM policy delete step with elevated deleted privileges on Endpoint/APM data streams.

This PR focuses on the add the logs-cloud_security_posture.-* index under the kibana_system role with delete_index privilege to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle.

{
"failed_step": "delete",
"step_info": {
"type": "security_exception",
"reason": "action [indices:admin/delete] is unauthorized for user [kibana_system] with effective roles [kibana_system] on indices [.ds-logs-cloud_security_posture.findings-default-2024.03.15-000001], this action is granted by the index privileges [delete_index,manage,all]"
}
}

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[jeramysoucy]

For my own knowledge, is this different from the delete_index named privilege?

It might be my limited understanding of the issue and how we manage these indices, but...

• do we need delete_index also on the above indices (logs-cloud_security_posture.findings-*)?
• and should we really be applying the same privileges to vulnerabilities_latest-default* here? Or is this unnecessary?

[Omolola-Akinleye]

do we need delete_index also on the above indices (logs-cloud_security_posture.findings-*)?

For index privilege i see TransportDeleteIndexAction.TYPE.name() will have admin:delete action

and should we really be applying the same privileges to vulnerabilities_latest-default* here? Or is this unnecessary?

That good point! We should have privleges for vulnerabilities_latest-default* and logs-cloud_security_posture.findings-*

[jeramysoucy]

Thanks for double checking and confirming!

[jeramysoucy]

Thanks for double checking and confirming!