StackOps default role privileges
This document lists the privileges for the StackOps default roles:
- Admin
- User
- Dashboard viewer
These roles and privileges define user access to the deployment, indices, and the Kibana UI, including spaces and dashboards.
Note: The Dashboard viewer role enables GovTechies to view dashboards for projects within GovTech, as part of the Open Data Access project.
Cluster privileges
The cluster privileges for the Admin, User, and Dashboard viewer roles are listed below:
| Privilege | Admin | User | Dashboard viewer |
|---|---|---|---|
| all | ✗ | ✗ | ✗ |
| cancel_task | ✓ | ✓ | ✗ |
| create_snapshot | ✓ | ✓ | ✗ |
| grant_api_key | ✓ | ✗ | ✗ |
| manage | ✓ | ✗ | ✗ |
| manage_api_key | ✓ | ✗ | ✗ |
| manage_ccr | ✗ | ✗ | ✗ |
| manage_ilm | ✓ | ✗ | ✗ |
| manage_index_templates | ✓ | ✗ | ✗ |
| manage_ingest_pipelines | ✓ | ✗ | ✗ |
| manage_logstash_pipelines | ✓ | ✗ | ✗ |
| manage_ml | ✓ | ✗ | ✗ |
| manage_oidc | ✗ | ✗ | ✗ |
| manage_own_api_key | ✓ | ✓ | ✗ |
| manage_pipeline | ✓ | ✗ | ✗ |
| manage_rollup | ✓ | ✗ | ✗ |
| manage_saml | ✗ | ✗ | ✗ |
| manage_security | ✗ | ✗ | ✗ |
| manage_service_account | ✗ | ✗ | ✗ |
| manage_slm | ✓ | ✗ | ✗ |
| manage_token | ✗ | ✗ | ✗ |
| manage_transform | ✓ | ✗ | ✗ |
| manage_autoscaling | ✓ | ✗ | ✗ |
| manage_data_frame_transforms | ✓ | ✗ | ✗ |
| manage_enrich | ✓ | ✗ | ✗ |
| manage_watcher | ✓ | ✗ | ✗ |
| monitor | ✓ | ✓ | ✗ |
| monitor_ml | ✓ | ✓ | ✗ |
| monitor_rollup | ✓ | ✓ | ✗ |
| monitor_snapshot | ✓ | ✓ | ✗ |
| monitor_text_structure | ✓ | ✓ | ✗ |
| monitor_transform | ✓ | ✓ | ✗ |
| monitor_watcher | ✓ | ✓ | ✗ |
| read_ccr | ✗ | ✗ | ✗ |
| read_ilm | ✓ | ✓ | ✗ |
| read_pipeline | ✓ | ✓ | ✗ |
| read_slm | ✓ | ✓ | ✗ |
| read_security | ✓ | ✓ | ✗ |
| transport_client | ✗ | ✗ | ✗ |
Index privileges
The index privileges for the Admin, User, and Dashboard viewer roles are listed below:
| Cluster | Index | Privilege | Admin | User | Dashboard viewer |
|---|---|---|---|---|---|
| All Tenants | * | all | ✓ | ✗ | ✗ |
| auto_configure | ✓ | ✗ | ✗ | ||
| create | ✓ | ✗ | ✗ | ||
| create_doc | ✓ | ✗ | ✗ | ||
| create_index | ✓ | ✗ | ✗ | ||
| delete | ✓ | ✗ | ✗ | ||
| delete_index | ✓ | ✗ | ✗ | ||
| index | ✓ | ✗ | ✗ | ||
| maintenance | ✓ | ✗ | ✗ | ||
| manage | ✓ | ✗ | ✗ | ||
| manage_follow_index | ✓ | ✗ | ✗ | ||
| manage_ilm | ✓ | ✗ | ✗ | ||
| manage_leader_index | ✓ | ✗ | ✗ | ||
| monitor | ✓ | ✓ | ✓ | ||
| read | ✓ | ✓ | ✓ | ||
| read_cross_cluster | ✓ | ✓ | ✓ | ||
| view_index_metadata | ✓ | ✓ | ✓ | ||
| write | ✓ | ✗ | ✗ |
Kibana privileges
The Kibana privileges for the Admin, User, and Dashboard viewer roles are listed below:
Spaces
| Spaces | Admin | User | Dashboard viewer |
|---|---|---|---|
| All Spaces | all | all | all |
Analytics
| Analytics | Admin | User | Dashboard viewer |
|---|---|---|---|
| Discover | all | all | none |
| Dashboard | all | all | read |
| Canvas | all | all | none |
| Maps | all | all | none |
| Machine Learning | all | all | none |
| Graph | all | all | none |
| Visualise Library | all | all | none |
Observability
| Observability | Admin | User | Dashboard viewer |
|---|---|---|---|
| Logs | all | all | none |
| Metrics | all | all | none |
| APM and User Experience | all | all | none |
| Synthetics and Uptime | all | all | none |
| Cases | all | all | none |
| SLOs | all | read | none |
| Universal Profile | all | read | none |
Security
| Security | Admin | User | Dashboard viewer |
|---|---|---|---|
| Security | all | custom* | none |
| Cases | all | all | none |
* The user role is granted custom security permissions in Kibana privileges to limit admin-level control of specfic alert management functions. You may reach out to StackOps to request admin access but these requests will be evaluated on a case by case basis.
Management
| Management | Admin | User | Dashboard viewer |
|---|---|---|---|
| Dev Tools | all | all | none |
| Advanced Settings | all | none | none |
| Data View Management | all | all | none |
| Files Management | all | none | none |
| Shared images | all | all | all |
| Saved Object Management | all | none | none |
| Tag Management | all | all | none |
| Osquery | all | all | none |
| Actions and Connectors | all | all | none |
| Cases | all | all | none |
| Setup guides | all | none | none |
| Rules Settings | all | none | none |
| Maintenance Windows | all | none | none |
| Stack Rules | all | all | none |
| Fleet | all | all | none |
| Integrations | all | all | none |
| Stack Monitoring | - | - | - |
