[Cloud Security Posture] ILM Delete Phase Permissions Error - [indices:admin/delete] ... [elastic/kibana]

[BenB196]

Kibana version:

8.9.1

Elasticsearch version:

8.9.1

Server OS version:

N/A

Browser version:

N/A

Browser OS version:

N/A

Original install method (e.g. download page, yum, from source, etc.):

Container

Describe the bug:

ILM has errors like:

security_exception: action [indices:admin/delete] is unauthorized for service account [elastic/kibana] on indices [.ds-logs-cloud_security_posture.findings-default-2023.01.30-000001], this action is granted by the index privileges [delete_index,manage,all]

and

security_exception: action [indices:admin/delete] is unauthorized for service account [elastic/kibana] on indices [.ds-logs-cloud_security_posture.findings-<redacted>-2023.01.30-000001], this action is granted by the index privileges [delete_index,manage,all]

Steps to reproduce:

1. Not entirely sure, but suppose a combination of Cloud Security Posture install + waiting for ILM delete phase.

Expected behavior:

I don't expect to see an ILM Delete permissions error.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[CohenIdo]

Hi @BenB196, thank for sharing. We will look into it.

[maxcold]

not sure how to estimate this one