Pinging @elastic/es-security (Team:Security)

Hi @kc13greiner, thanks for reviewing.

We are working on a new direction for "rules and alerts" that rewrites everything from scratch in a new architecture. Until now, the indexes we created were all named .alerts-* so we could rely on the existing permissions for ReservedRolesStore.ALERTS_INDEX_ALIAS. This is, however, the index name pattern for alerting v1, and we want to enforce a clear distinction for users when querying these indexes for alerts. These indexes are managed by the Kibana system user on startup, so for our changes to work, it will need read, write, delete, and manage permissions.

Hi @kc13greiner, thanks for reviewing.

We are working on a new direction for "rules and alerts" that rewrites everything from scratch in a new architecture. Until now, the indexes we created were all named .alerts-* so we could rely on the existing permissions for ReservedRolesStore.ALERTS_INDEX_ALIAS. This is, however, the index name pattern for alerting v1, and we want to enforce a clear distinction for users when querying these indexes for alerts. These indexes are managed by the Kibana system user on startup, so for our changes to work, it will need read, write, delete, and manage permissions.

Thanks for the info!

You mention it will need read, write, delete, and manage permissions: is there a subset of specific privileges you could add rather than "all"?

You mention it will need read, write, delete, and manage permissions: is there a subset of specific privileges you could add rather than "all"?

@kc13greiner, atm not, we plan on using all of these as we did for the old ALERTS_INDEX_ALIAS.

You mention it will need read, write, delete, and manage permissions: is there a subset of specific privileges you could add rather than "all"?

@kc13greiner, atm not, we plan on using all of these as we did for the old ALERTS_INDEX_ALIAS.

++ ok! Thanks for the discussion! Since it is a system index and all the privileges are required, we can accept this 👍

@kc13greiner and thanks for the approval 🙌 I fully understand where you are coming from wrt to granting the least amount of necessary permissions. It is just that in this case, we have needed the same in the past, I just need to update the index names 😁