# Restrict Admin access to index

**URL:** <https://forum.search-guard.com/t/restrict-admin-access-to-index/2209>\
**Category:** Search Guard\
**Created:** [September 2, 2021, 3:01pm UTC](https://forum.search-guard.com/t/restrict-admin-access-to-index/2209 "2021-09-02T15:01:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![leep](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@leep](https://forum.search-guard.com/u/leep)\
**Post date:** [September 2, 2021, 3:01pm UTC](https://forum.search-guard.com/t/restrict-admin-access-to-index/2209/1 "2021-09-02T15:01:09Z")

</div>

I have a sensitive index which I have restricted access to a limited number of users, Is it possible to also restrict access to the index for admin users?

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [September 2, 2021, 4:50pm UTC](https://forum.search-guard.com/t/restrict-admin-access-to-index/2209/2 "2021-09-02T16:50:16Z")

</div>

Let me rephrase to see whether I understand your requirements correctly:

When you say “admin user”, I assume this is a user that has access to all indices in your cluster. Most likely you have defined “_" as index pattern and maybe also "_” for the permissions. This means the user has full access to all indices.

Now you have one index with very sensitive data. And you want to exclude this (and only this) index from the admin role. So you need a role like “access to all indices, but not this one”.

If I understood this correctly then you can use the `exclude_index_permission` feature for your role definition. Have a look at this section in the docs which has an example how to achieve exactly that:

> **[Search Guard roles](https://docs.search-guard.com/latest/roles-permissions#permission-exclusions)**
>
> How to define role based access to Elasticsearch on index level with Search Guard.

---

<div class="post-metadata">

**Author:** ![leep](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@leep](https://forum.search-guard.com/u/leep)\
**Post date:** [September 6, 2021, 7:35am UTC](https://forum.search-guard.com/t/restrict-admin-access-to-index/2209/3 "2021-09-06T07:35:12Z")

</div>

Yes that’s correct.  
Great thanks for your help, I’ll take a look at the examples provided.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [September 27, 2021, 7:35am UTC](https://forum.search-guard.com/t/restrict-admin-access-to-index/2209/4 "2021-09-27T07:35:58Z")

</div>

Closed on September 27, 2021, 7:35am UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.