built-in-roles.asciidoc

Built-in roles

The {stack-security-features} apply a default role to all users, including anonymous users. The default role enables users to access the authenticate endpoint, change their own passwords, and get information about themselves.

There is also a set of built-in roles you can explicitly assign to users. These roles have a fixed set of privileges and cannot be updated.

apm_system

Grants access necessary for the APM system user to send system-level data (such as monitoring) to {es}.

apm_user

Grants the privileges required for APM users (such as read and view_index_metadata privileges on the apm- and .ml-anomalies indices). deprecated:[7.13.0,"See {kibana-ref}/apm-app-users.html[APM app users and privileges\] for alternatives."].

beats_admin

Grants access to the .management-beats index, which contains configuration information for the Beats.

beats_system

Grants access necessary for the Beats system user to send system-level data (such as monitoring) to {es}.

Note	This role should not be assigned to users as the granted permissions may change between releases. This role does not provide access to the beats indices and is not suitable for writing beats output to {es}.

data_frame_transforms_admin

Grants manage_data_frame_transforms cluster privileges, which enable you to manage {transforms}. This role also includes all {kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}. deprecated:[7.5.0,"Replaced by transform_admin"].

data_frame_transforms_user

Grants monitor_data_frame_transforms cluster privileges, which enable you to use {transforms}. This role also includes all {kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}. deprecated:[7.5.0,"Replaced by transform_user"].

editor

experimental:[] Grants full access to all features in {kib} (including Solutions) and read-only access to data indices.

Note	This role provides read access to any index that is not prefixed with a dot. This role automatically grants full access to new {kib} features as soon as they are released.

enrich_user

Grants access to manage all enrich indices (.enrich-) and *all operations on ingest pipelines.

ingest_admin

Grants access to manage all index templates and all ingest pipeline configurations.

Note	This role does not provide the ability to create indices; those privileges must be defined in a separate role.

kibana_dashboard_only_user

(This role is deprecated, please use {kibana-ref}/kibana-privileges.html#kibana-feature-privileges[{kib} feature privileges] instead). Grants read-only access to the {kib} Dashboard in every {kibana-ref}/xpack-spaces.html[space in {kib}]. This role does not have access to editing tools in {kib}.

kibana_system

Grants access necessary for the {kib} system user to read from and write to the {kib} indices, manage index templates and tokens, and check the availability of the {es} cluster. It also permits activating, searching, and retrieving user profiles, as well as updating user profile data for the kibana- namespace. This role grants read access to the .monitoring- indices and read and write access to the .reporting-* indices. For more information, see {kibana-ref}/using-kibana-with-security.html[Configuring Security in {kib}].

Note	This role should not be assigned to users as the granted permissions may change between releases.

kibana_admin

Grants access to all features in {kib}. For more information on {kib} authorization, see {kibana-ref}/xpack-security-authorization.html[Kibana authorization].

kibana_user

(This role is deprecated, please use the kibana_admin role instead.) Grants access to all features in {kib}. For more information on {kib} authorization, see {kibana-ref}/xpack-security-authorization.html[Kibana authorization].

logstash_admin

Grants access to the .logstash* indices for managing configurations, and grants necessary access for logstash-specific APIs exposed by the logstash x-pack plugin.

logstash_system

Grants access necessary for the Logstash system user to send system-level data (such as monitoring) to {es}. For more information, see {logstash-ref}/ls-security.html[Configuring Security in Logstash].

Note	This role should not be assigned to users as the granted permissions may change between releases. This role does not provide access to the logstash indices and is not suitable for use within a Logstash pipeline.

machine_learning_admin

Provides all of the privileges of the machine_learning_user role plus the full use of the {ml} APIs. Grants manage_ml cluster privileges, read access to .ml-anomalies*, .ml-notifications*, .ml-state*, .ml-meta* indices and write access to .ml-annotations* indices. {ml-cap} administrators also need index privileges for source and destination indices and roles that grant access to {kib}. See {ml-docs-setup-privileges}.

machine_learning_user

Grants the minimum privileges required to view {ml} configuration, status, and work with results. This role grants monitor_ml cluster privileges, read access to the .ml-notifications and .ml-anomalies* indices (which store {ml} results), and write access to .ml-annotations* indices. {ml-cap} users also need index privileges for source and destination indices and roles that grant access to {kib}. See {ml-docs-setup-privileges}.

manage_enrich

Grants privileges to access and use all of the {ref}/enrich-apis.html[enrich APIs]. Users with this role can manage enrich policies that add data from your existing indices to incoming documents during ingest.

monitoring_user

Grants the minimum privileges required for any user of {monitoring} other than those required to use {kib}. This role grants access to the monitoring indices and grants privileges necessary for reading basic cluster information. This role also includes all {kibana-ref}/kibana-privileges.html[Kibana privileges] for the {stack-monitor-features}. Monitoring users should also be assigned the kibana_admin role, or another role with {kibana-ref}/xpack-security-authorization.html[access to the {kib} instance].

remote_monitoring_agent

Grants the minimum privileges required to write data into the monitoring indices (.monitoring-). This role also has the privileges necessary to create {metricbeat} indices (metricbeat-) and write data into them.

remote_monitoring_collector

Grants the minimum privileges required to collect monitoring data for the {stack}.

reporting_user

Grants the specific privileges required for users of {reporting} other than those required to use {kib}. This role grants access to the reporting indices; each user has access to only their own reports. Reporting users should also be assigned additional roles that grant {kibana-ref}/xpack-security-authorization.html[access to {kib}] as well as read access to the indices that will be used to generate reports.

snapshot_user

Grants the necessary privileges to create snapshots of all the indices and to view their metadata. This role enables users to view the configuration of existing snapshot repositories and snapshot details. It does not grant authority to remove or add repositories or to restore snapshots. It also does not enable to change index settings or to read or update data stream or index data.

superuser

Grants full access to cluster management and data indices. This role also grants direct read-only access to restricted indices like .security. A user with the superuser role can impersonate any other user in the system.

On {ecloud}, all standard users, including those with the superuser role are restricted from performing operator-only actions.

Important

This role can manage security and create roles with unlimited privileges. Take extra care when assigning it to a user.

transform_admin

Grants manage_transform cluster privileges, which enable you to manage {transforms}. This role also includes all {kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}.

transform_user

Grants monitor_transform cluster privileges, which enable you to perform read-only operations related to {transforms}. This role also includes all {kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}.

transport_client

Grants the privileges required to access the cluster through the Java Transport Client. The Java Transport Client fetches information about the nodes in the cluster using the Node Liveness API and the Cluster State API (when sniffing is enabled). Assign your users this role if they use the Transport Client.

Note

Using the Transport Client effectively means the users are granted access to the cluster state. This means users can view the metadata over all indices, index templates, mappings, node and basically everything about the cluster. However, this role does not grant permission to view the data in all indices.

viewer

experimental:[] Grants read-only access to all features in {kib} (including Solutions) and to data indices.

Note	This role provides read access to any index that is not prefixed with a dot. This role automatically grants read-only access to new {kib} features as soon as they are available.

watcher_admin

Allows users to create and execute all {watcher} actions. Grants read access to the .watches index. Also grants read access to the watch history and the triggered watches index.

watcher_user

Grants read access to the .watches index, the get watch action and the watcher stats.