Role-based access control in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this role definition query?

Given the following Elasticsearch role definition, what will be the effective cluster privileges for the role named data_analyst?

Elasticsearch

{
  "data_analyst": {
    "cluster": ["monitor"],
    "indices": [
      {
        "names": ["sales-*"],
        "privileges": ["read", "view_index_metadata"]
      }
    ]
  }
}

A ["all"]

B ["monitor"]

C ["monitor", "read", "view_index_metadata"]

D ["read", "view_index_metadata"]

💡 Hint

Cluster privileges and index privileges are separate in Elasticsearch roles.

The cluster field defines cluster-wide privileges, here only monitor. The indices field defines index-level privileges, which do not affect cluster privileges.

❓ Predict Output

intermediate

What error occurs when assigning an invalid privilege?

Consider this role definition snippet in Elasticsearch. What error will Elasticsearch return when trying to create this role?

Elasticsearch

{
  "invalid_role": {
    "cluster": ["invalid_privilege"],
    "indices": [
      {
        "names": ["logs-*"],
        "privileges": ["read"]
      }
    ]
  }
}

A 400 Bad Request with message 'unknown cluster privilege [invalid_privilege]'

B Role created successfully with no errors

C 500 Internal Server Error

D 403 Forbidden error

💡 Hint

Elasticsearch validates privileges strictly when creating roles.

Elasticsearch returns a 400 error if an unknown cluster privilege is specified, indicating the privilege is invalid.

🚀 Application

advanced

How to restrict a role to only write access on specific indices?

You want to create a role that allows users to only write data to indices starting with app-logs- but no read or delete access. Which role definition below achieves this?

A

{
  "write_only_role": {
    "cluster": [],
    "indices": [
      {
        "names": ["app-logs-*"],
        "privileges": ["write", "read"]
      }
    ]
  }
}

B

{
  "write_only_role": {
    "cluster": [],
    "indices": [
      {
        "names": ["app-logs-*"],
        "privileges": ["create", "index"]
      }
    ]
  }
}

C

{
  "write_only_role": {
    "cluster": ["write"],
    "indices": [
      {
        "names": ["app-logs-*"],
        "privileges": ["write"]
      }
    ]
  }
}

D

{
  "write_only_role": {
    "cluster": [],
    "indices": [
      {
        "names": ["app-logs-*"],
        "privileges": ["write"]
      }
    ]
  }
}

💡 Hint

Cluster privileges are not needed for index write access. Use only index privileges.

Option D grants only the write privilege on the specified indices, which allows writing but not reading or deleting. Other options either add read or invalid cluster privileges.

🔧 Debug

advanced

Why does this role fail to grant read access on indices?

This role is intended to allow read access on indices named user-data-*, but users report they cannot read those indices. What is the cause?

Elasticsearch

{
  "user_reader": {
    "cluster": ["monitor"],
    "indices": [
      {
        "names": ["user-data-*"],
        "privileges": ["read"]
      }
    ]
  }
}

A Cluster privileges must include 'read' to allow index reading

B The 'privileges' field is missing 'view_index_metadata'

C The 'names' field should be a list, not a string

D The role name 'user_reader' is reserved and cannot be used

💡 Hint

Check the data type of the 'names' field in the indices array.

The 'names' field must be an array of strings. Using a string causes the role to be invalid and not grant privileges.

🧠 Conceptual

expert

What is the effect of overlapping roles with conflicting privileges?

If a user is assigned two roles: one grants read access on logs-* indices, and another denies read access on logs-2023-* indices, what will be the user's effective access to logs-2023-01?

A The user will be denied read access because deny privileges take precedence

B The user will have read access because allow privileges override deny

C The user will have read access only if the roles are merged manually

D The user will have no access because conflicting roles cause an error

💡 Hint

In Elasticsearch, deny rules override allow rules when conflicts occur.

Elasticsearch uses a deny-overrides policy. If any role denies access to a resource, that denial takes precedence over any allow.