From 65018caacf4cb5b7416a21f2cce02977ae59d5d1 Mon Sep 17 00:00:00 2001 From: Liz Snyder Date: Mon, 11 Apr 2022 15:43:55 -0700 Subject: [PATCH 1/3] Add o11y security Signed-off-by: Liz Snyder --- .../observability-security.md | 56 +++++++++++++++++++ _replication-plugin/permissions.md | 4 +- 2 files changed, 58 insertions(+), 2 deletions(-) create mode 100644 _observability-plugin/observability-security.md diff --git a/_observability-plugin/observability-security.md b/_observability-plugin/observability-security.md new file mode 100644 index 00000000..4c2f8adf --- /dev/null +++ b/_observability-plugin/observability-security.md @@ -0,0 +1,56 @@ +--- +layout: default +title: Observability security +nav_order: 5 +has_children: false +--- + +# Observability security + +You can use the security plugin with Observability in OpenSearch to limit non-admin users to specific actions. For example, you might want some users to only view visualizations, notebooks, and other Observability objects, while others can create and modify them. + +## Basic permissions + +The security plugin has two built-in roles that cover most Observability use cases: `observability_full_access` and `observability_read_access`. For descriptions of each, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles). If you don't see these predefined roles in OpenSearch Dashboards, you can create them with the following commands: + +```json +PUT _plugins/_security/api/roles/observability_read_access +{ + "cluster_permissions": [ + "cluster:admin/opensearch/observability/get" + ] +} +``` + +```json +PUT _plugins/_security/api/roles/observability_full_access +{ + "cluster_permissions": [ + "cluster:admin/opensearch/observability/*" + ] +} +``` + +If these roles don't meet your needs, mix and match individual Observability [permissions]({{site.url}}{{site.baseurl}}/security-plugin/access-control/permissions/) to suit your use case. For example, the `cluster:admin/opensearch/observability/create` permission lets you create Observability objects (visualizations, operational panels, notebooks, etc.) + +The following is an example role that that provides access to Observability: + +```json +PUT _plugins/_security/api/roles/observability_permissions +{ + "cluster_permissions": [ + "cluster:admin/opensearch/observability/create", + "cluster:admin/opensearch/observability/update", + "cluster:admin/opensearch/observability/delete", + "cluster:admin/opensearch/observability/get" + ], + "index_permissions": [{ + "index_patterns": [".opensearch-observability"], + "allowed_actions": ["write", "read", "search"] + }], + "tenant_permissions": [{ + "tenant_patterns": ["global_tenant"], + "allowed_actions": ["opensearch_dashboards_all_write"] + }] +} +``` \ No newline at end of file diff --git a/_replication-plugin/permissions.md b/_replication-plugin/permissions.md index e4b3152c..621df260 100644 --- a/_replication-plugin/permissions.md +++ b/_replication-plugin/permissions.md @@ -1,10 +1,10 @@ --- layout: default -title: Permissions +title: Replication security nav_order: 30 --- -# Cross-cluster replication permissions +# Cross-cluster replication security You can use the [security plugin]({{site.url}}{{site.baseurl}}/security-plugin/index/) with cross-cluster replication to limit users to certain actions. For example, you might want certain users to only perform replication activity on the leader or follower cluster. From 416a3b1cea3fd9891f79d56b4bcb4ce8a47cc6a5 Mon Sep 17 00:00:00 2001 From: keithhc2 Date: Mon, 11 Apr 2022 16:08:06 -0700 Subject: [PATCH 2/3] Added observability permissions Signed-off-by: keithhc2 --- _security-plugin/access-control/permissions.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/_security-plugin/access-control/permissions.md b/_security-plugin/access-control/permissions.md index 869c2a15..82fd8f39 100644 --- a/_security-plugin/access-control/permissions.md +++ b/_security-plugin/access-control/permissions.md @@ -132,6 +132,10 @@ These permissions are for the cluster and can't be applied granularly. For examp - cluster:admin/opendistro/reports/instance/list - cluster:admin/opendistro/reports/instance/get - cluster:admin/opendistro/reports/menu/download +- cluster:admin/opensearch/observability/create +- cluster:admin/opensearch/observability/update +- cluster:admin/opensearch/observability/delete +- cluster:admin/opensearch/observability/get - cluster:admin/plugins/replication/autofollow/update - cluster:admin/reindex/rethrottle - cluster:admin/repository/delete From a558b60e8de9c2c64ca91a72b389e0c8ffd141c2 Mon Sep 17 00:00:00 2001 From: keithhc2 Date: Mon, 11 Apr 2022 16:41:09 -0700 Subject: [PATCH 3/3] Typos Signed-off-by: keithhc2 --- _observability-plugin/observability-security.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/_observability-plugin/observability-security.md b/_observability-plugin/observability-security.md index 4c2f8adf..dbbb1d8c 100644 --- a/_observability-plugin/observability-security.md +++ b/_observability-plugin/observability-security.md @@ -31,9 +31,9 @@ PUT _plugins/_security/api/roles/observability_full_access } ``` -If these roles don't meet your needs, mix and match individual Observability [permissions]({{site.url}}{{site.baseurl}}/security-plugin/access-control/permissions/) to suit your use case. For example, the `cluster:admin/opensearch/observability/create` permission lets you create Observability objects (visualizations, operational panels, notebooks, etc.) +If these roles don't meet your needs, mix and match individual Observability [permissions]({{site.url}}{{site.baseurl}}/security-plugin/access-control/permissions/) to suit your use case. For example, the `cluster:admin/opensearch/observability/create` permission lets you create Observability objects (visualizations, operational panels, notebooks, etc.). -The following is an example role that that provides access to Observability: +The following is an example role that provides access to Observability: ```json PUT _plugins/_security/api/roles/observability_permissions @@ -53,4 +53,4 @@ PUT _plugins/_security/api/roles/observability_permissions "allowed_actions": ["opensearch_dashboards_all_write"] }] } -``` \ No newline at end of file +```