From db2b8e93e6687999a3c3a30c0bee8433c93b4d90 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Mon, 26 Apr 2021 14:54:51 -0700 Subject: [PATCH 1/2] docs: remove apm_user --- docs/apm/apm-app-users.asciidoc | 92 ++++++---- .../apm-app-reader/content.asciidoc | 45 +++++ .../apm-app-reader/widget.asciidoc | 40 +++++ .../central-config-users/content.asciidoc | 53 ++++++ .../central-config-users/widget.asciidoc | 40 +++++ docs/apm/tab-widgets/code.asciidoc | 166 ++++++++++++++++++ 6 files changed, 403 insertions(+), 33 deletions(-) create mode 100644 docs/apm/tab-widgets/apm-app-reader/content.asciidoc create mode 100644 docs/apm/tab-widgets/apm-app-reader/widget.asciidoc create mode 100644 docs/apm/tab-widgets/central-config-users/content.asciidoc create mode 100644 docs/apm/tab-widgets/central-config-users/widget.asciidoc create mode 100644 docs/apm/tab-widgets/code.asciidoc diff --git a/docs/apm/apm-app-users.asciidoc b/docs/apm/apm-app-users.asciidoc index 3f0a42251304c..dd0d870604484 100644 --- a/docs/apm/apm-app-users.asciidoc +++ b/docs/apm/apm-app-users.asciidoc @@ -10,7 +10,7 @@ Users and privileges ++++ -You can use role-based access control to grant users access to secured +Use role-based access control to grant users access to secured resources. The roles that you set up depend on your organization's security requirements and the minimum privileges required to use specific features. @@ -24,6 +24,13 @@ In general, there are three types of privileges you'll work with: * **Elasticsearch index privileges**: Control access to the data in specific indices your cluster. * **Kibana space privileges**: Grant users write or read access to features and apps within Kibana. +Select your use-case to get started: + +* <> +* <> +* <> +* <> + //// *********************************** *********************************** //// @@ -36,13 +43,30 @@ In general, there are three types of privileges you'll work with: Create an APM reader user ++++ +APM reader users typically need to view the APM app and dashboards and visualizations that use APM data. +These users might also need to create and edit dashboards, visualizations, and machine learning jobs. + [[apm-app-reader-full]] -==== Full APM reader +==== APM reader -APM reader users typically need to view the APM app, dashboards, and visualizations that contain APM data. -These users might also need to create and edit dashboards, visualizations, and machine learning jobs. +To create an APM reader user: + +. Create a new role, named something like `read-apm`, and assign the following privileges: ++ +-- +include::./tab-widgets/apm-app-reader/widget.asciidoc[] +-- ++ +TIP: Using the {apm-server-ref-v}/apm-integration.html[APM integration for Elastic Agent]? +Add the privileges under the **Data streams** tab. -. Assign the following built-in roles: +If your APM data is being sent to APM Server, you're using classic APM indices. + +If your APM data is ingested into `apm-*` indices, you're using classic APM indices. +If you're + +. Assign the `read-apm` role created in the previous step, and the following built-in roles to +any APM reader users: + [options="header"] |==== @@ -51,9 +75,6 @@ These users might also need to create and edit dashboards, visualizations, and m |`kibana_admin` |Grants access to all features in Kibana. -|`apm_user` -|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices - |`machine_learning_admin` |Grants the privileges required to create, update, and view machine learning jobs |==== @@ -63,14 +84,14 @@ These users might also need to create and edit dashboards, visualizations, and m In some instances, you may wish to restrict certain Kibana apps that a user has access to. -. Assign the following built in roles: +. Create a new role, named something like `read-apm-partial`, and assign the following privileges: + -[options="header"] -|==== -|Role | Purpose -|`apm_user` -|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices -|==== +-- +include::./tab-widgets/apm-app-reader/widget.asciidoc[] +-- ++ +TIP: Using the {apm-server-ref-v}/apm-integration.html[APM integration for Elastic Agent]? +Add the privileges under the **Data streams** tab. . Assign space privileges to any Kibana space that the user needs access to. Here are two examples: @@ -98,6 +119,8 @@ Here are two examples: |Grants the privileges required to create, update, and view machine learning jobs |==== +include::./tab-widgets/code.asciidoc[] + //// *********************************** *********************************** //// @@ -138,7 +161,7 @@ and assign the following privileges: ^1^ +\{ANNOTATION_INDEX\}+ should be the index name you've defined in <>. -. Assign the `annotation_user` created previously, and the built-in roles necessary to create +. Assign the `annotation_user` created previously, and the roles and privileges necessary to create a <> or <> APM reader to any users that need to view annotations in the APM app [[apm-app-annotation-api]] @@ -163,17 +186,17 @@ See <>. Central configuration users need to be able to view, create, update, and delete Agent configurations. -. Assign the following built-in roles: +. Create a new role, named something like `central-config-manager`, and assign the following privileges: + -[options="header"] -|==== -|Role | Purpose - -|`apm_user` -|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices -|==== +-- +include::./tab-widgets/central-config-users/widget.asciidoc[] +-- ++ +TIP: Using the {apm-server-ref-v}/apm-integration.html[APM integration for Elastic Agent]? +Add the privileges under the **Data streams** tab. -. Assign the following Kibana space privileges: +. Assign the `central-config-manager` role created in the previous step, and the following Kibana space privileges to +anyone who needs to manage central configurations: + [options="header"] |==== @@ -190,16 +213,17 @@ Central configuration users need to be able to view, create, update, and delete In some instances, you may wish to create a user that can only read central configurations, but not create, update, or delete them. -. Assign the following built-in roles: +. Create a new role, named something like `central-config-reader`, and assign the following privileges: + -[options="header"] -|==== -|Role | Purpose -|`apm_user` -|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices -|==== +-- +include::./tab-widgets/central-config-users/widget.asciidoc[] +-- ++ +TIP: Using the {apm-server-ref-v}/apm-integration.html[APM integration for Elastic Agent]? +Add the privileges under the **Data streams** tab. -. Assign the following Kibana space privileges: +. Assign the `central-config-reader` role created in the previous step, and the following Kibana space privileges to +anyone who needs to read central configurations: + [options="header"] |==== @@ -215,6 +239,8 @@ but not create, update, or delete them. See <>. +include::./tab-widgets/code.asciidoc[] + //// *********************************** *********************************** //// diff --git a/docs/apm/tab-widgets/apm-app-reader/content.asciidoc b/docs/apm/tab-widgets/apm-app-reader/content.asciidoc new file mode 100644 index 0000000000000..6b9c996035f6c --- /dev/null +++ b/docs/apm/tab-widgets/apm-app-reader/content.asciidoc @@ -0,0 +1,45 @@ +// tag::classic-indices[] +[options="header"] +|==== +|Type |Privilege |Purpose + +|Index +|`read` on `apm-*` +|Read-only access to `apm-*` data + +|Index +|`view_index_metadata` on `apm-*` +|Read-only access to `apm-*` index metadata +|==== +// end::classic-indices[] + +// tag::data-streams[] +[options="header"] +|==== +|Type |Privilege |Purpose + +|Index +|`read` on `logs-apm*` +|Read-only access to `logs-apm*` data + +|Index +|`view_index_metadata` on `logs-apm*` +|Read-only access to `logs-apm*` index metadata + +|Index +|`read` on `metrics-apm*` +|Read-only access to `metrics-apm*` data + +|Index +|`view_index_metadata` on `metrics-apm*` +|Read-only access to `metrics-apm*` index metadata + +|Index +|`read` on `traces-apm*` +|Read-only access to `traces-apm*` data + +|Index +|`view_index_metadata` on `traces-apm*` +|Read-only access to `traces-apm*` index metadata +|==== +// end::data-streams[] diff --git a/docs/apm/tab-widgets/apm-app-reader/widget.asciidoc b/docs/apm/tab-widgets/apm-app-reader/widget.asciidoc new file mode 100644 index 0000000000000..51c01367786b6 --- /dev/null +++ b/docs/apm/tab-widgets/apm-app-reader/widget.asciidoc @@ -0,0 +1,40 @@ +++++ +
+
+ + +
+
+++++ + +include::content.asciidoc[tag=classic-indices] + +++++ +
+ +
+++++ \ No newline at end of file diff --git a/docs/apm/tab-widgets/central-config-users/content.asciidoc b/docs/apm/tab-widgets/central-config-users/content.asciidoc new file mode 100644 index 0000000000000..0945050d9a861 --- /dev/null +++ b/docs/apm/tab-widgets/central-config-users/content.asciidoc @@ -0,0 +1,53 @@ +// tag::classic-indices[] +[options="header"] +|==== +|Type |Privilege |Purpose + +|Index +|`read` on `apm-*` +|Read-only access to `apm-*` data + +|Index +|`view_index_metadata` on `apm-*` +|Read-only access to `apm-*` index metadata +|==== +// end::classic-indices[] + +// tag::data-streams[] +[options="header"] +|==== +|Type |Privilege |Purpose + +|Index +|`read` on `apm-agent-configuration` +|Read-only access to `apm-agent-configuration` data + +|Index +|`view_index_metadata` on `apm-agent-configuration` +|Read-only access to `apm-agent-configuration` index metadata + +|Index +|`read` on `logs-apm*` +|Read-only access to `logs-apm*` data + +|Index +|`view_index_metadata` on `logs-apm*` +|Read-only access to `logs-apm*` index metadata + +|Index +|`read` on `metrics-apm*` +|Read-only access to `metrics-apm*` data + +|Index +|`view_index_metadata` on `metrics-apm*` +|Read-only access to `metrics-apm*` index metadata + +|Index +|`read` on `traces-apm*` +|Read-only access to `traces-apm*` data + +|Index +|`view_index_metadata` on `traces-apm*` +|Read-only access to `traces-apm*` index metadata +|==== +// end::data-streams[] diff --git a/docs/apm/tab-widgets/central-config-users/widget.asciidoc b/docs/apm/tab-widgets/central-config-users/widget.asciidoc new file mode 100644 index 0000000000000..68bef4e50c549 --- /dev/null +++ b/docs/apm/tab-widgets/central-config-users/widget.asciidoc @@ -0,0 +1,40 @@ +++++ +
+
+ + +
+
+++++ + +include::content.asciidoc[tag=classic-indices] + +++++ +
+ +
+++++ \ No newline at end of file diff --git a/docs/apm/tab-widgets/code.asciidoc b/docs/apm/tab-widgets/code.asciidoc new file mode 100644 index 0000000000000..6a30cf55c8dbb --- /dev/null +++ b/docs/apm/tab-widgets/code.asciidoc @@ -0,0 +1,166 @@ +// Defining styles and script here for simplicity. +++++ + + + +++++ \ No newline at end of file From 2b27ba98ecf0f02cbd8da49c0ce50d1a371a4257 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Mon, 26 Apr 2021 14:57:39 -0700 Subject: [PATCH 2/2] cleanup --- docs/apm/apm-app-users.asciidoc | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/apm/apm-app-users.asciidoc b/docs/apm/apm-app-users.asciidoc index dd0d870604484..9b8a9c64ac43b 100644 --- a/docs/apm/apm-app-users.asciidoc +++ b/docs/apm/apm-app-users.asciidoc @@ -60,11 +60,6 @@ include::./tab-widgets/apm-app-reader/widget.asciidoc[] TIP: Using the {apm-server-ref-v}/apm-integration.html[APM integration for Elastic Agent]? Add the privileges under the **Data streams** tab. -If your APM data is being sent to APM Server, you're using classic APM indices. - -If your APM data is ingested into `apm-*` indices, you're using classic APM indices. -If you're - . Assign the `read-apm` role created in the previous step, and the following built-in roles to any APM reader users: +