Grant permission for anonymous user for Security Analytics plugin (#107)

* add access to cluster for security analytics Signed-off-by: Lu Yu <[email protected]> * remove unexpected prop Signed-off-by: Lu Yu <[email protected]> * remove cluster permission Signed-off-by: Lu Yu <[email protected]> * add more permission Signed-off-by: Lu Yu <[email protected]> * add more permissions Signed-off-by: Lu Yu <[email protected]> * add same permission for preview and prod Signed-off-by: Lu Yu <[email protected]> * give read permission for google user for security analytics and also add sql scroll permission for anonymous user Signed-off-by: Lu Yu <[email protected]> Signed-off-by: Lu Yu <[email protected]>
opensearch-project · Nov 18, 2022 · 18371b0 · 18371b0
1 parent ae97ec1
commit 18371b0
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 3 deletions.
diff --git a/config/playground/helm/dev/helm-opensearch-dashboards.yaml b/config/playground/helm/dev/helm-opensearch-dashboards.yaml
@@ -78,9 +78,6 @@ config:
     # Use the consolidated menu and global header bar
     opensearchDashboards.branding.useExpandedHeader: false
 
-    # Enable wizard feature
-    wizard.enabled: true
-
     #Content security policy(csp) settings
     csp.rules: [ "connect-src 'self' www.google-analytics.com maps.opensearch.org;" ]
     csp.warnLegacyBrowsers: false

diff --git a/config/playground/helm/dev/helm-opensearch.yaml b/config/playground/helm/dev/helm-opensearch.yaml
@@ -692,6 +692,14 @@ securityConfig:
             - cluster:admin/opendistro/rollup/get
             - cluster:admin/opendistro/transform/explain
             - cluster:admin/opendistro/transform/get
+            # To enable read access to security analytics
+            - cluster:admin/opensearch/securityanalytics/rule/search
+            - cluster:admin/opensearch/securityanalytics/detector/search
+            - cluster:admin/opensearch/securityanalytics/findings/get
+            - cluster:admin/opensearch/securityanalytics/alerts/get
+            - cluster:admin/opensearch/securityanalytics/detector/get
+            # For using sql join query
+            - "indices:data/read/scroll*"
           index_permissions:
             - index_patterns:
               - ".kibana"

diff --git a/config/playground/helm/preview/helm-opensearch.yaml b/config/playground/helm/preview/helm-opensearch.yaml
@@ -706,6 +706,14 @@ securityConfig:
             - cluster:admin/opendistro/rollup/get
             - cluster:admin/opendistro/transform/explain
             - cluster:admin/opendistro/transform/get
+            # To enable read access to security analytics
+            - cluster:admin/opensearch/securityanalytics/rule/search
+            - cluster:admin/opensearch/securityanalytics/detector/search
+            - cluster:admin/opensearch/securityanalytics/findings/get
+            - cluster:admin/opensearch/securityanalytics/alerts/get
+            - cluster:admin/opensearch/securityanalytics/detector/get
+            # For using sql join query
+            - "indices:data/read/scroll*"
           index_permissions:
             - index_patterns:
               - ".kibana"
@@ -770,6 +778,12 @@ securityConfig:
             - cluster:admin/opendistro/rollup/get
             - cluster:admin/opendistro/transform/explain
             - cluster:admin/opendistro/transform/get
+            # To enable read access to security analytics
+            - cluster:admin/opensearch/securityanalytics/rule/search
+            - cluster:admin/opensearch/securityanalytics/detector/search
+            - cluster:admin/opensearch/securityanalytics/findings/get
+            - cluster:admin/opensearch/securityanalytics/alerts/get
+            - cluster:admin/opensearch/securityanalytics/detector/get
             # For using sql join query
             - "indices:data/read/scroll*"
           index_permissions:

diff --git a/config/playground/helm/prod/helm-opensearch.yaml b/config/playground/helm/prod/helm-opensearch.yaml
@@ -693,6 +693,14 @@ securityConfig:
             - cluster:admin/opendistro/rollup/get
             - cluster:admin/opendistro/transform/explain
             - cluster:admin/opendistro/transform/get
+            # To enable read access to security analytics
+            - cluster:admin/opensearch/securityanalytics/rule/search
+            - cluster:admin/opensearch/securityanalytics/detector/search
+            - cluster:admin/opensearch/securityanalytics/findings/get
+            - cluster:admin/opensearch/securityanalytics/alerts/get
+            - cluster:admin/opensearch/securityanalytics/detector/get
+            # For using sql join query
+            - "indices:data/read/scroll*"
           index_permissions:
             - index_patterns:
               - ".kibana"