Pinging @elastic/security-solution (Team: SecuritySolution)

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

Pinging @elastic/security-threat-hunting-explore (Team:Threat Hunting:Explore)

@elasticmachine merge upstream

I noticed a problem. It only happens with particular set of conditions:

• Security serverless projects
• A custom role is defined with:
  • Security top-level feature is All.
  • Security sub-features are enabled
  • Security > Endpoint Exceptions sub-feature is Read

In this scenario, the role migration will assign Security > Endpoint Exceptions: All, a privilege not granted before. This happens because the Security minimal_all is configured to do so, which is necessary for non-serverless environments.

Changing to PR to draft while we try to find a solution that works for all environments.

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!

💔 Build Failed

• Buildkite Build
• Commit: bd620a1

Failed CI Steps

• FTR Configs #44
• FTR Configs #44
• FTR Configs #93
• FTR Configs #93
• FTR Configs #97
• FTR Configs #97

Test Failures

• [job] [logs] FTR Configs #97 / security (basic license) Privileges GET /api/security/privileges should include sub-feature privileges when respectlicenseLevel is false
• [job] [logs] FTR Configs #97 / security (basic license) Privileges GET /api/security/privileges should include sub-feature privileges when respectlicenseLevel is false
• [job] [logs] FTR Configs #44 / security Privileges GET /api/security/privileges should return a privilege map with all known privileges, without actions
• [job] [logs] FTR Configs #44 / security Privileges GET /api/security/privileges should return a privilege map with all known privileges, without actions

Metrics [docs]

✅ unchanged

History

• 💔 Build #269234 failed 2d3ef2f
• 💔 Build #269150 failed 1d4df1d
• 💔 Build #268900 failed 356b14a
• 💔 Build #268774 failed f13287d

cc @semd

I noticed a problem. It only happens with particular set of conditions:

• Security serverless projects

• A custom role is defined with:

  • Security top-level feature is All.
  • Security sub-features are enabled
  • Security > Endpoint Exceptions sub-feature is Read

In this scenario, the role migration will assign Security > Endpoint Exceptions: All, a privilege not granted before. This happens because the Security minimal_all is configured to do so, which is necessary for non-serverless environments.

Changing to PR to draft while we try to find a solution that works for all environments.

hey @semd,

i've added a PR that hopefully fixes the issue you described by adding role migration conditionally based on build flavor. i'll add you as a reviewer, could you take a look at it sometime? i'd be happy to have your thoughts and concerns on this approach.

pr: #219566
the related commit is called unify and migrate endpoint exceptions RBAC

the pr is still draft, as i'm still fixing the tests, and also, planning to keep the pr open for a while, so we can collect more siemV2->siemV3 migrations if needed.