[Cloud Security Posture] fix ilm deletion step error permissions #128634
Conversation
elasticsearchmachine
added
v9.1.0
needs:triage
Omolola-Akinleye
added
the
Team:Cloud Security
elasticsearchmachine
removed
the
needs:triage
Omolola-Akinleye
added
needs:triage
|
Pinging @elastic/es-security (Team:Security) |
Omolola-Akinleye
added
auto-backport
| "index", | ||
| "delete", | ||
| // Require "delete_index" to perform ILM policy actions | ||
| TransportDeleteIndexAction.TYPE.name(), |
There was a problem hiding this comment.
For my own knowledge, is this different from the delete_index named privilege?
It might be my limited understanding of the issue and how we manage these indices, but...
- do we need
delete_indexalso on the above indices (logs-cloud_security_posture.findings-*)? - and should we really be applying the same privileges to
vulnerabilities_latest-default*here? Or is this unnecessary?
There was a problem hiding this comment.
do we need delete_index also on the above indices (logs-cloud_security_posture.findings-*)?
For index privilege i see TransportDeleteIndexAction.TYPE.name() will have admin:delete action
and should we really be applying the same privileges to vulnerabilities_latest-default* here? Or is this unnecessary?
That good point! We should have privleges for vulnerabilities_latest-default* and logs-cloud_security_posture.findings-*
There was a problem hiding this comment.
Thanks for double checking and confirming!
| "index", | ||
| "delete", | ||
| // Require "delete_index" to perform ILM policy actions | ||
| TransportDeleteIndexAction.TYPE.name(), |
There was a problem hiding this comment.
Thanks for double checking and confirming!
…stic#128634) * fix ilm deletion step policy * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]>
3 participants
SDH Ticket Cannot execute ILM policy delete step on CSPM findings logs was created a few weeks ago. Discussion Thread between product manager, engineering and sdh engineer on two proposed solutions:
delete_indexprivileges forlogs-cloud_security_posture.-* to prevent deletion phase execution error when thelogs-cloud_security_posture.-*` exceeds the retention period(180 days). There are also has been similar SDH Cannot execute ILM policy delete step with elevated deleted privileges on Endpoint/APM data streams.This PR focuses on the add the
logs-cloud_security_posture.-*index under thekibana_systemrole withdelete_indexprivilege to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle.