Writer role
editWriter role
editTo minimize the privileges required by the writer role, use the setup role to enable Monitor Management. This section assumes another user has already enabled Monitor Management.
For users who need to create, modify, and delete monitors, provide write access. Two types of write access are outlined below:
- General write access: For most users, you can use General write access, which grants write access to all Kibana apps and requires little configuration.
- Limited write access: If you want to limit write access to the Synthetics app only, you can use Limited write access, which requires additional configuration.
General write access
editCreate a writer role, called something like synthetics_writer
:
-
Start with the
editor
built-in role. This role grants full access to all features in Kibana (including the Observability solution) and read-only access to data indices.The
editor
built-in role will grant write access to all Kibana apps. If you want to limit write access to the Synthetics app only, refer to Limited write access. -
If the user should have permission to create, modify, and delete project monitors, they will need an API key that can be used to
push
monitors. To create API keys, the user will also need at least one of the following privileges in addition to the privileges included in theeditor
built-in role:Type Privilege Purpose manage_own_api_key
Allows access to all security-related operations on Elasticsearch API keys that are owned by the current authenticated user.
manage_security
Allows access to all security-related operations such as CRUD operations on users and roles and cache clearing.
manage_api_key
Allows access to all security-related operations on Elasticsearch API keys.
Limited write access
editIf you want to limit write access to the Synthetics app only, do not use the
editor
built-in role.
Instead to you can create a writer role, called something like synthetics_writer_limited
,
and start by granting the following privileges:
Type | Privilege | Purpose |
---|---|---|
|
Read-only access to synthetics indices. |
|
|
Read-only access to synthetics alert indices. |
|
|
Access to the Synthetics app in Kibana. |
Additional privileges will depend on the factors below.
To restrict using Elastic’s global managed infrastructure
editTo restrict users assigned this role from using monitors hosted on Elastic’s global managed infrastructure:
-
Expand
Synthetics and Uptime
in the list of Kibana privileges. - Toggle Customize sub-feature privileges.
- Uncheck Elastic managed locations enabled.
If using Private Locations
editThe user who initially sets up a new Private Location needs additional privileges. Users who create or update monitors hosted on that Private Location do not need any additional permissions.
The user who is setting up a new Private Location will need the following privileges when creating the agent policy in Fleet:
Type | Privilege | Purpose |
---|---|---|
|
Access to Fleet in Kibana. |
|
|
Access to Integrations in Kibana. |
If using projects
editIf the user should be able to create and update monitors using projects, add at least one of following privileges:
Type | Privilege | Purpose |
---|---|---|
|
Allows access to all security-related operations on Elasticsearch API keys that are owned by the current authenticated user. |
|
|
Allows access to all security-related operations such as CRUD operations on users and roles and cache clearing. |
|
|
Allows access to all security-related operations on Elasticsearch API keys. |