[DOC] Better documentation around Cluster and Index permissions, wrt adding indices perms as Cluster perms

[philvarner]

Is your feature request related to a problem?
I believe this is mostly a documentation issue.

The underlying issue I was having was attempting to create a minimal set of permissions for my application to work, and encountered a problem similar to the one outlined here

I believe the underlying issue is that it is confusing that there are separate Cluster permissions and Index permissions, but applying the action group cluster_all to Cluster permissions does not actually grant all for the permissions that may be necessary, adn that permissions prefixed with indices: or the action group cluster_composite_ops (which one might assume was also part of cluster_all!) may also need to be added.

The example https://opensearch.org/docs/latest/security-plugin/access-control/users-roles/#set-up-a-bulk-access-role-in-opensearch-dashboards includes cluster_composite_ops as a Cluster permission, but there's no description as to why.

The definition of cluster_all states Grants all cluster permissions., which would lead a reader to believe there are no other permissions that can be added on top of this as Cluster permissions. The cluster_composite_ops description makes no mention that it actually applies indicies: permissions, and that it would be necessary to add it Cluster perms. Additionally, the opensearch javascript client uses bulk operations for the index method, even though that's not obviously a bulk operation from the name. This is compounded by the error messaging stating, for example, Reason: no permissions for [indices:data/write/bulk], which is confusing when a user has explicitly granted this permissions as an Index permission but not a Cluster permission.

What solution would you like?

1. Better description of the default action groups, stating exactly which permissions are granted.
2. Clarifying language about when and why indices: permissions need to be added to Cluster permissions (I now know that I need to do this, but I still do not understand why).

What alternatives have you considered?

n/a

Do you have any additional context?

n/a

[peternied]

FYI @cwillum

[peternied]

Thanks for opening this issue. For the moment, I'm going to keep this in the security repository but we might move/create follow up issues in our documentation repository.

[stephen-crawford]

@peternied could you file a transfer request for this to the documentation repository? Thank you.

[facundovictor]

Could someone introduce a summary answering Clarifying language about when and why indices: permissions need to be added to Cluster permissions (I now know that I need to do this, but I still do not understand why). or point me in the right direction?

So far what I see is that defining a role mapped to a user test:

  "test-role": {                          
    "reserved": false,                          
    "hidden": false,                            
    "description": "Test role",
    "cluster_permissions": [] 
    "index_permissions": [                      
      {                                         
        "index_patterns": [                     
          "test-*"                               
        ],                                      
        "dls": "",                              
        "fls": [],                              
        "masked_fields": [],                    
        "allowed_actions": [                    
          "crud",                               
          "create_index",                       
          "search",                             
          "indices:data/write/bulk*",           
          "indices:data/write/bulk",            
          "indices_monitor"                     
        ]                                       
      }                                         
    ],                                          
    "tenant_permissions": [],                   
    "static": false                             
  }                                             

Attempting to index a document into an index test-something returns a security_exception:

no permissions for [indices:data/write/bulk] and User [name=test, backend_roles=[], requestedTenant=null]"

But if we add indices:data/write/bulk to the cluster_permissions:

  "test-role": {                          
    "reserved": false,                          
    "hidden": false,                            
    "description": "Test role",
    "cluster_permissions": [
      "indices:data/write/bulk"
    ] 
    "index_permissions": [                      
      {                                         
        "index_patterns": [                     
          "test-*"                               
        ],                                      
        "dls": "",                              
        "fls": [],                              
        "masked_fields": [],                    
        "allowed_actions": [                    
          "crud",                               
          "create_index",                       
          "search",                             
          "indices:data/write/bulk*",           
          "indices:data/write/bulk",            
          "indices_monitor"                     
        ]                                       
      }                                         
    ],                                          
    "tenant_permissions": [],                   
    "static": false                             
  }                                             

It works! BUT we can also index documents into indexes that have other prefix! Which is missing the point of the index_patterns. For this you can change the role to have a different prefix like someotherprefix-*:

  "test-role": {                          
    "reserved": false,                          
    "hidden": false,                            
    "description": "Test role",
    "cluster_permissions": [
      "indices:data/write/bulk"
    ] 
    "index_permissions": [                      
      {                                         
        "index_patterns": [                     
          "someotherprefix-*"                               
        ],                                      
        "dls": "",                              
        "fls": [],                              
        "masked_fields": [],                    
        "allowed_actions": [                    
          "crud",                               
          "create_index",                       
          "search",                             
          "indices:data/write/bulk*",           
          "indices:data/write/bulk",            
          "indices_monitor"                     
        ]                                       
      }                                         
    ],                                          
    "tenant_permissions": [],                   
    "static": false                             
  }                                             

And attempting to index a new document into test-something (POST 'https:///test-something/_doc') works, but should not succeed.

What am I doing wrong? My expectation is to be able to define a role with write permissions to an specific set of indexes, without allowing to index documents into other indexes.

[daljitsharma]

Just curious if anyone ever figured this out. This post was open almost one year ago and I am still facing issues trying to make minimal set of permissions. I cannot find any docs that explain why cluster_permissions are needed when all I want to do is give read / write access to a single index pattern. The expectation would be that we only need to edit index_permissions section in the Role

[betabrandao]

In my config, i need add indices:admin/create and indices:admin/mapping/put to run. But it is workaround.

PUT /_opendistro/_security/api/roles/test_search_index

{
  "test_search_index": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": [
      "indices:data/write/bulk"
    ],
    "index_permissions": [
      {
        "index_patterns": [
          "test*"
        ],
        "dls": "",
        "fls": [],
        "masked_fields": [],
        "allowed_actions": [
          "indices:data/read/explain",
          "indices:data/read/field_caps",
          "indices:data/read/field_caps*",
          "indices:data/read/get",
          "indices:data/read/mget",
          "indices:data/read/mget*",
          "indices:data/read/msearch",
          "indices:data/read/msearch/template",
          "indices:data/read/mtv",
          "indices:data/read/mtv*",
          "indices:data/read/scroll",
          "indices:data/read/scroll/clear",
          "indices:data/read/search",
          "indices:data/read/search*",
          "indices:data/read/search/template",
          "indices:data/read/tv",
          "indices:data/write/bulk",
          "indices:data/write/bulk*",
          "indices:data/write/delete",
          "indices:data/write/delete/byquery",
          "indices:data/write/index",
          "indices:data/write/reindex",
          "indices:data/write/update",
          "indices:data/write/update/byquery",
          "indices:admin/create",
          "indices:admin/mapping/put"
        ]
      }
    ],
    "tenant_permissions": [],
    "static": false
  }
}

[muhammedsaidkaya]

Is there any update on the issue?

[AntonEliatra]

@hdhalter I can take this one