Alerting security

    The security plugin has three built-in roles that cover most alerting use cases: , alerting_ack_alerts, and alerting_full_access. For descriptions of each, see Predefined roles.

    If these roles don’t meet your needs, mix and match individual alerting to suit your use case. Each action corresponds to an operation in the REST API. For example, the cluster:admin/opensearch/alerting/destination/delete permission lets you delete destinations.

    Monitors run with the permissions of the user who created or last modified them. For example, consider the user jdoe, who works at a chain of retail stores. jdoe has two roles. Together, these two roles allow read access to three indices: store1-returns, store2-returns, and store3-returns.

    Later, the user psantos wants to edit the monitor to run every two hours, but only has access to store1-returns. To make the change, psantos has two options:

    • Ask an administrator for read access to the other two indices.

    After making the change, the monitor now runs with the same permissions as psantos, including any document-level security queries, , and masked fields. If you use an extraction query to define your monitor, use the Run button to ensure that the response includes the fields you need.

    Out of the box, the alerting plugin has no concept of ownership. For example, if you have the cluster:admin/opensearch/alerting/monitor/write permission, you can edit all monitors, regardless of whether you created them. If a small number of trusted users manage your monitors and destinations, this lack of ownership generally isn’t a problem. A larger organization might need to segment access by backend role.

    Next, enable the following setting:

    Now when users view alerting resources in OpenSearch Dashboards (or make REST API calls), they only see monitors and destinations that are created by users who share at least one backend role. For example, consider three users who all have full access to alerting: jdoe, jroe, and psantos.

    jdoe and jroe are on the same team at work and both have the backend role. psantos has the human-resources backend role.