-
Notifications
You must be signed in to change notification settings - Fork 25.8k
Open
Labels
:StorageEngine/Data streamsData streams and their lifecyclesData streams and their lifecycles>enhancementTeam:StorageEngine
Description
Description
DLM uses implicit permissions so that the user doesn't have to have permission on the underlying data stream. However, it's permissions are scoped to "*" indices and a small set of allowed dot-prefixed indices:
Lines 179 to 186 in a47daee
| .indices( | |
| // System data stream for result history of fleet actions (see Fleet#fleetActionsResultsDescriptor) | |
| ".fleet-actions-results", | |
| // System data streams for storing uploaded file data for Agent diagnostics and Endpoint response actions | |
| ".fleet-fileds*", | |
| // System data stream for kibana workflows logs | |
| ".workflows-execution-data-stream-logs" | |
| ) |
In the event a dot-prefixed data stream is created that the internal DLM user doesn't not have permissions for, we should add an assert so that ES tests will catch it (as sometimes happens with Kibana-created data streams).
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
:StorageEngine/Data streamsData streams and their lifecyclesData streams and their lifecycles>enhancementTeam:StorageEngine