Authorized route migration for routes owned by security-defend-workflows

[kibanamachine]

Authz API migration for authorized routes

This PR migrates access:<privilege> tags used in route definitions to new security configuration.
Please refer to the documentation for more information: Authorization API

Before migration:

Access control tags were defined in the options object of the route:

router.get({
  path: '/api/path',
  options: {
    tags: ['access:<privilege_1>', 'access:<privilege_2>'],
  },
  ...
}, handler);

After migration:

Tags have been replaced with the more robust security.authz.requiredPrivileges field under security:

router.get({
  path: '/api/path',
  security: {
    authz: {
      requiredPrivileges: ['<privilege_1>', '<privilege_2>'],
    },
  },
  ...
}, handler);

What to do next?

1. Review the changes in this PR.
2. You might need to update your tests to reflect the new security configuration:

• If you have tests that rely on checking access tags.
• If you have snapshot tests that include the route definition.
• If you have FTR tests that rely on checking unauthorized error message. The error message changed to also include missing privileges.

Any questions?

If you have any questions or need help with API authorization, please reach out to the @elastic/kibana-security team.

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[szwarckonrad]

All changes align well with the expected structure, and I haven’t noticed anything missing in the new version compared to the current one.

[paul-tavares]

👍

thanks @szwarckonrad for the updates to tests.

[kibanamachine]

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11783697819

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6ed4627

Metrics [docs]

✅ unchanged

History

• 💔 Build #247126 failed fb2739e

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation