Grant users access to secured resources

You can use role-based access control to grant users access to secured resources. The roles that you set up depend on your organization’s security requirements and the minimum privileges required to use specific features.

Functionbeat users typically perform these main roles: they do the initial setup, publish monitoring information, and publish events. If they’re using Kibana, they view and sometimes create visualizations that access Functionbeat indices.

X-Pack security provides pre-built roles that grant some of the privileges needed by Functionbeat users. When possible, use the built-in roles to minimize the affect of future changes on your security strategy.

For privileges not granted by existing roles, create new roles. At a minimum, create a role for setting up Functionbeat, a role for publishing events, and a role for reading Functionbeat indices. Assign these new roles, along with the pre-built roles, to grant the full set of privileges required by Functionbeat users.

The following sections describe the privileges and roles required to perform specific job roles.

Privileges needed for initial setup

edit

Users who set up Functionbeat typically need to load mappings, dashboards, and other objects used to index data into Elasticsearch and visualize it in Kibana. The privileges required depend on the setup tasks users need to perform.

These instructions assume that you are using the default name for Functionbeat indices. If you are using a custom name, modify the privileges to match your index naming pattern.

Task	Required privileges and roles
Set up index templates	`manage_index_templates` and `monitor` on cluster
	`manage_ilm` on cluster (if cluster supports index lifecycle management)
	`manage` on `functionbeat-*` indices (if cluster supports index lifecycle management)
Set up machine learning job configurations	`manage_ml` and `monitor` on cluster
	`read` on `functionbeat-*` indices
	`kibana_user` role
Set up index lifecycle policies	`manage_ilm`, `manage_index_templates`, and `monitor` on cluster
Set up index lifecycle policies	`manage` on `functionbeat-*` indices

Privileges needed to publish and view monitoring information

edit

X-Pack security provides the functionbeat_system built-in user and functionbeat_system built-in role for sending monitoring information. You can use the built-in user, or create a user who has the privileges needed to send monitoring information. If you use the functionbeat_system user, make sure you set the password.

Task	Required privileges and roles
Send monitoring info	`monitor` on cluster
Use Stack Monitoring in Kibana to monitor Functionbeat	`monitoring_user` and `kibana_user` roles

Privileges needed to publish events

edit

Users who publish events to Elasticsearch need to create and read from Functionbeat indices. The privileges required for this role depend on the tasks users need to perform:

Task	Required privileges and roles
Send data to a secured cluster without index lifecycle management	`monitor` on cluster
	`create_index` and `index` on `functionbeat-*` indices
	also requires privileges to set up index templates unless you’ve disabled automatic template loading
Send data to a secured cluster that supports index lifecycle management	`manage_index_templates`,`manage_ilm` ^[1], and `monitor` on cluster
	`index` and `manage` on `functionbeat-*` indices

Privileges needed by Kibana users

edit

Kibana users typically need to view dashboards and visualizations that contain Functionbeat data. These users might also need to create and edit dashboards and visualizations.

The privileges required for Kibana users depend on the tasks they need to perform:

Task	Required privileges and roles
View Functionbeat dashboards	`read` on `functionbeat-*` indices
View Functionbeat dashboards	`kibana_dashboard_only_user` role
View and edit Functionbeat dashboards	`read` on `functionbeat-*` indices
View and edit Functionbeat dashboards	`kibana_user` role

Learn more about users and roles

edit

Want to learn more about creating users and roles? See Securing the Elastic Stack. Also see:

Security privileges for a description of available privileges
Built-in roles for a description of roles that you can assign to users

^[1] Use read_ilm instead of manage_ilm if you pre-loaded the lifecycle policy

« Configure Functionbeat to use X-Pack security Configure authentication credentials »