Skip to content

Commit

Permalink
Removing outdated limitations
Browse files Browse the repository at this point in the history
  • Loading branch information
ymao1 committed Mar 8, 2021
1 parent 1cc4ea3 commit 393b8a3
Showing 1 changed file with 1 addition and 18 deletions.
19 changes: 1 addition & 18 deletions docs/user/alerting/alerting-getting-started.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -212,21 +212,4 @@ If an alert requires certain privileges to run such as index privileges, keep in

For security reasons you may wish to limit the extent to which {kib} can connect to external services. <<action-settings>> allows you to disable certain <<action-types>> and allowlist the hostnames that {kib} can connect with.

[float]
[[alerting-limitations]]
=== Limitations

Users who create alerts will need the `manage_api_key` cluster privilege.

[IMPORTANT]
==============================================
Note that the `manage_own_api_key` cluster privilege is not enough - it can be used to create API keys, but cannot be used invalidate them. Alerting must be able to both create and invalidate API keys.
==============================================

When an alert is created by a user with the `manage_own_api_key` but not the `manage_api_key` cluster privilege, you will see the following error message in the {kib} logs:

```bash
[error][alerting][plugins] Failed to invalidate API Key: [security_exception] action [cluster:admin/xpack/security/api_key/invalidate] is unauthorized for user [user-name-here]
```

--
--

0 comments on commit 393b8a3

Please sign in to comment.