From 8a0482d2cb597e28dd7437a52cfdb6cf81c1f0bb Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 27 Aug 2025 13:16:57 +0530 Subject: [PATCH] Add Defender for Cloud to 3rd party integrations permissions required for transform --- .../authz/store/KibanaOwnedReservedRoleDescriptors.java | 6 +++++- .../core/security/authz/store/ReservedRolesStoreTests.java | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index ac128fdc7a41c..f22cab11f4272 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -530,7 +530,11 @@ static RoleDescriptor kibanaSystem(String name) { // For source indices of the Cloud Detection & Response (CDR) packages // that ships a transform and has ILM policy RoleDescriptor.IndicesPrivileges.builder() - .indices("logs-m365_defender.vulnerability-*", "logs-microsoft_defender_endpoint.vulnerability-*") + .indices( + "logs-m365_defender.vulnerability-*", + "logs-microsoft_defender_endpoint.vulnerability-*", + "logs-microsoft_defender_cloud.assessment-*" + ) .privileges( "read", "view_index_metadata", diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index acf4c423edf04..af27057ac9575 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1717,7 +1717,8 @@ public void testKibanaSystemRole() { Arrays.asList( "logs-m365_defender.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), - "logs-microsoft_defender_endpoint.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)) + "logs-microsoft_defender_endpoint.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), + "logs-microsoft_defender_cloud.assessment-" + randomAlphaOfLength(randomIntBetween(0, 13)) ).forEach(indexName -> { final IndexAbstraction indexAbstraction = mockIndexAbstraction(indexName); assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(indexAbstraction), is(false));