# INDEX action group

**URL:** https://forum.search-guard.com/t/index-action-group/2310
**Category:** Search Guard
**Created:** [April 21, 2022, 10:17am UTC](https://forum.search-guard.com/t/index-action-group/2310 "2022-04-21T10:17:30Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mikew](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mikew](https://forum.search-guard.com/u/mikew)
#### Post date: [April 21, 2022, 10:17am UTC](https://forum.search-guard.com/t/index-action-group/2310/1 "2022-04-21T10:17:30Z")

</div>

I’m trying to migrate a cluster from Elasticsearch 6 to 7 and am going through our custom roles and changing the action groups they use per [Upgrading from 6.x to 7.x | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/upgrading-6-7#migrating-to-the-new-built-in-action-groups)

We have some roles which use an action group called INDEX. E.g.

```auto
storage:
  cluster:
    - INDICES_MONITOR
    - CLUSTER_COMPOSITE_OPS
    - indices:data/read/scroll
    - indices:data/read/scroll/clear
  indices:
    'storage-*':
      '*':
        - READ
        - indices:monitor/settings/get
        - indices:admin/get
    '?kibana-storage':
      '*':
        - MANAGE
        - INDEX
        - READ
        - DELETE

```

INDEX is an action group which is defined by default in Search Guard 6. I double checked it wasn’t something I or my colleagues had made by unziping search-guard-6-6.8.22-25.6.zip and looking at sg\_action\_groups.yml and it is there,

```auto
mike@foo:tmp>unzip -q search-guard-6-6.8.22-25.6.zip
mike@foo:tmp>grep -A7 ^INDEX: sgconfig/sg_action_groups.yml 
INDEX:
  readonly: true
  permissions:
    - "indices:data/write/index*"
    - "indices:data/write/update*"
    - "indices:admin/mapping/put"
    - "indices:data/write/bulk*"

mike@foo:tmp>

```

But I cannot see INDEX mentioned at [Upgrading from 6.x to 7.x | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/upgrading-6-7#migrating-to-the-new-built-in-action-groups)  
Nor can I see it mentioned at [Action Groups | Elasticsearch Security | Search Guard](https://docs.search-guard.com/6.x-25/action-groups#pre-defined-action-groups)

Am I failing to see it or is it really not mentioned? And if it’s really not mentioned, then what do I do about this action group which is defined but undocumented?

---

<div class="post-metadata">

### Author: ![mikew](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mikew](https://forum.search-guard.com/u/mikew)
#### Post date: [April 29, 2022, 11:17am UTC](https://forum.search-guard.com/t/index-action-group/2310/2 "2022-04-29T11:17:10Z")

</div>

There appears to be an `SGS_INDEX` action group defined in Search Guard now

> **[security/src/main/resources/static\_config/static\_action\_groups.yml · master ·...](https://git.floragunn.com/search-guard/search-guard-suite/-/blob/master/security/src/main/resources/static_config/static_action_groups.yml#L175)**
>
> Search Guard - Security for Elasticsearch https://search-guard.com

So is that what I should use instead of `INDEX` ? I still can’t find any reference to `INDEX` or `SGS_INDEX` in the documentation.

---

<div class="post-metadata">

### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)
#### Post date: [April 29, 2022, 3:26pm UTC](https://forum.search-guard.com/t/index-action-group/2310/3 "2022-04-29T15:26:43Z")

</div>

@mikew You’re correct. SG\_INDEX is the same as INDEX, and both are not documented in any version of SG documentation.  
It will be reported to the dev team.

---

<div class="post-metadata">

### Author: ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)
#### Post date: [May 20, 2022, 3:26pm UTC](https://forum.search-guard.com/t/index-action-group/2310/4 "2022-05-20T15:26:48Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.
