Error loading indices when accessing Index Management from Kibana

Search Guard
1

If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions.

Elasticsearch version:
7.9.2
Server OS version:
Windows Server 2016
Kibana version (if relevant):
7.9.2
Browser version (if relevant):

Browser OS version (if relevant):

Describe the issue:
When I access Stack Management / Index Management / Indices tab I am getting error:
Error Loading indices. [security_exception] no permissions for [indices:admin/get] and User [name=test, backend_roles=[sq_viewer, kibanauser], requestedTenant=null]

sg_roles.yml:
SG_VIEWER_TEST:
cluster_permissions:
- SGS_CLUSTER_COMPOSIT_OPS_RO
- SGS_CLUSTER_MONITOR
index_permissions:
- index_patterns"
- “apm-*”
allowed_actions:
- SGS_READ
- SGS_SEARCH
- “indices:admin/get”

When I check DevTools in browser I see error GET http://***:5601/api/index_management/indices 403 (Forbiden)

I think I messed something with roles but not sure what roles should I use to get access in kibana Stack Management / Index Management / Indices and be able to display indices

Expected behavior:
I should be able to display indices under under kibana Stack Management / Index Management / Indices

Provide configuration:
elasticsearch/config/elasticsearch.yml
elasticsearch/plugins/search-guard-7/sgconfig/sg_config.yml
kibana/config/kibana.yml (if relevant)

Provide logs:
Elasticsearch
Kibana (if relevant)

Screenshots (if relevant):

Errors in browser console (if relevant):
Error Loading indices. [security_exception] no permissions for [indices:admin/get] and User [name=test, backend_roles=[sq_viewer, kibanauser], requestedTenant=null]

GET http://***:5601/api/index_management/indices 403 (Forbiden)Additional data:

2

Hi @erniMJ

Please try the following configurations:

SG_VIEWER_TEST:
  index_permissions:
    - index_patterns:
      - “apm-*”
      allowed_actions:
      - SGS_READ
      - SGS_SEARCH
    - index_patterns:
      - “*”
      allowed_actions:
      - “indices:admin/get”
3

@Eugene7 Thanks that helped a lot. It looks like it only will work when index_patterns is "*" and I wanted to grant it only for "amp-*" Any clue why?

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.