WARNING: Version 5.1 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Configuring Role-based Access Control Defining Roles »
Elastic Docs ›X-Pack for the Elastic Stack [5.1] ›Securing Elasticsearch and Kibana ›Configuring Role-based Access Control

Built-in Roles

edit

Built-in Roles

edit

X-Pack security applies a default role to all users, including anonymous users. The default role enables users to access the authenticate endpoint, change their own passwords, and get information about themselves.

X-Pack security also provides a set of built-in roles you can explicitly assign to users. These roles have a fixed set of privileges and cannot be updated.

superuser
Grants full access to the cluster, including all indices and data. A user with the superuser role can also manage users and roles and impersonate any other user in the system. Due to the permissive nature of this role, take extra care when assigning it to a user.
transport_client

Grants the privileges required to access the cluster through the Java Transport Client. The Java Transport Client fetches information about the nodes in the cluster using the Node Liveness API and the Cluster State API (when sniffing is enabled). Assign your users this role if they use the Transport Client.

Using the Transport Client effectively means the users are granted access to the cluster state. This means users can view the metadata over all indices, index templates, mappings, node and basically everything about the cluster. However, this role does not grant permission to view the data in all indices.

kibana_user
Grants the minimum privileges required for any user of Kibana. This role grants access to the Kibana indices and grants monitoring privileges for the cluster.
monitoring_user
Grants the minimum privileges required for any user of Monitoring other than those required to use Kibana. This role grants access to the monitoring indices. Monitoring users should also be assigned the kibana_user role.
reporting_user
Grants the specific privileges required for users of Reporting other than those required to use Kibana. This role grants access to the reporting indices. Reporting users should also be assigned the kibana_user role and a role that grants them access to the data that will be used to generate reports with.
remote_monitoring_agent
Grants the minimum privileges required for a remote monitoring agent to write data into this cluster.
ingest_admin

Grants access to manage all index templates and all ingest pipeline configurations. These privileges are necessary to to use the ingest feature in Kibana.

This role does not provide the ability to create indices; those privileges must be defined in a separate role.

« Configuring Role-based Access Control Defining Roles »