elastic / elasticsearch

Free and Open Source, Distributed, RESTful Search Engine
https://www.elastic.co/products/elasticsearch
Other
69.71k stars 24.67k forks source link

Privilege requirement change for searchable snapshot stats #97272

Open joeafari opened 1 year ago

joeafari commented 1 year ago

Elasticsearch Version

8.8.1

Installed Plugins

No response

Java Version

bundled

OS Version

All

Problem Description

GET _searchable_snapshots/stats, and GET _searchable_snapshots/cache/stats API seems to require the manage privilege. Documentation:

However, it looks like these API should require the monitor privilege and not manage. The cluster stats, node stats and index stats all work with the monitor privilege, so it seems strange that the searchable snapshot stats and cache stats API require the manage privilege.

Steps to Reproduce

Run _searchable_snapshots/stats or _searchable_snapshots/cache/stats with a user having a role with monitor privilege

Logs (if relevant)

{
    "error": {
        "reason": "action [cluster:admin/xpack/searchable_snapshots/cache/stats] is unauthorized for user [gregoire_RO] with roles [supervisor,viewer], this action is granted by the cluster privileges [manage,all]",
        "root_cause": [
            {
                "reason": "action [cluster:admin/xpack/searchable_snapshots/cache/stats] is unauthorized for user [gregoire_RO] with roles [supervisor,viewer], this action is granted by the cluster privileges [manage,all]",
                "type": "security_exception"
            }
        ],
        "type": "security_exception"
    },
    "status": 403
}
elasticsearchmachine commented 1 year ago

Pinging @elastic/es-distributed (Team:Distributed)