Limiting access to ingest pipelines

Search Guard
1

  • Elasticsearch 6.1.3

  • Search Guard 6.1.3-21

We control all our access to indices based on certain name standards so that, say, developer team 1 only have access to indices named devteam01-*

If they need to use ingest pipelines it is my understanding that we must grant cluster wide access to create anything under /_ingest/pipepline/* ?

I was just wondering if there’s any way we could control the naming standards for these pipelines similar to how we control the names of indices?

So, just like we give a role access to indices named devteam01-* we would grant them access to PUT and GET pipelines as long as the pipeline names start with devteam01- ?

2

On Wednesday, 14 March 2018 16:50:56 UTC+1

  • Elasticsearch 6.1.3
  • Search Guard 6.1.3-21

We control all our access to indices based on certain name standards so that, say, developer team 1 only have access to indices named devteam01-*

If they need to use ingest pipelines it is my understanding that we must grant cluster wide access to create anything under /_ingest/pipepline/* ?

you should be able to control this via the following cluster permissions

cluster:admin/ingest/pipeline/delete
cluster:admin/ingest/pipeline/get
cluster:admin/ingest/pipeline/put
cluster:admin/ingest/pipeline/simulate

I was just wondering if there’s any way we could control the naming standards for these pipelines similar to how we control the names of indices?

So, just like we give a role access to indices named devteam01-* we would grant them access to PUT and GET pipelines as long as the pipeline names start with devteam01- ?

not possible as of now