Skip to content

[9.1] [EDR Workflows] Global artifact API privilege to deprecated features (#225678)#227991

Merged
kibanamachine merged 1 commit intoelastic:9.1from
kibanamachine:backport/9.1/pr-225678
Jul 15, 2025
Merged

[9.1] [EDR Workflows] Global artifact API privilege to deprecated features (#225678)#227991
kibanamachine merged 1 commit intoelastic:9.1from
kibanamachine:backport/9.1/pr-225678

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.1:

Questions ?

Please refer to the Backport tool documentation

…lastic#225678)

## Summary

elastic#219566 deprecated `siemV2`, and added a new
`global_artifact_management_all` privilege. See previous PR description
for diagrams.

However, the `replaceBy` role deprecation feature does not 'migrate'
privileges completely, only copies `ui:` privileges.

Therefore, `api:securitySolution-writeGlobalArtifacts` was missing from
the required places, resulting in the bug described in the original
issue: elastic/security-team#12921

This PR:
- adds the missing `api:` privileges to the required places,
- for this, it copy/pastes Endpoint Exceptions `api`/`ui` privileges
directly into multiple Kibana feature versions, so it can be
versioned/deprecated (its `siem`/`siemV2` privileges differ from
`siemV3`): 17f6397 and
4c8730e
- adds a new backward compatibility API test, that uses the space aware
feature flag to regress the bug issue

> [!TIP]
> This bug was found by another backward compatibility tests, during
enabling the space awareness feature flag. Those tests were skipped in
the PR, and can be enabled after this fix is merged to 9.1.

https://github.com/elastic/kibana/pull/222230/files#diff-2f89ba63a6a03d9982bb0a0022c1a6e733b889aa7779a8ea9ebb771bae9e68f2

> [!IMPORTANT]
> The fix only affects an `api` privilege, that is only used behind a
feature flag. Therefore, not having this fix in the next serverless
promotion should not cause any issue on serverless, as serverless
environment does not use this api privilege.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 1dc8cf8)
@kibanamachine kibanamachine merged commit b147a31 into elastic:9.1 Jul 15, 2025
15 of 16 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @gergoabraham

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants