search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.56k stars 8.08k forks source link

[Bug] Benchmark API fails when CspSettings SO is not available #188059

Open animehart opened 1 month ago

animehart commented 1 month ago

Describe the feature:

Screenshot 2024-07-11 at 1 20 55 AM Screenshot 2024-07-11 at 1 21 06 AM

Currently when a non admin user with read access to Security navigates to Benchmark page, they will encounter this 403 error (Forbidden), however after an admin go to that page (on a separate browser), the non admin user with read access to Security will be able to access that page normally.

This is currently being caused by this line https://github.com/elastic/kibana/blob/b043cf0ff1c0055c83650911bd3f8eeb69243807/x-pack/plugins/cloud_security_posture/server/routes/benchmark_rules/get_states/v1.ts#L42 where prior admin going to that page CSP Settings object has not been created and can only be created when an admin goes into that page first

We should change the logic so that it doesnt have this depedency anymorE

elasticmachine commented 1 month ago

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

animehart commented 1 month ago

@CohenIdo

CohenIdo commented 1 month ago

Once this issue is solved we should re-enable the test