[Solved] You want to create a role that allows a user to read from all indexes starting with prod- but only write to prod-logs. Which role definition is correct? | Elasticsearch

Elasticsearch - Security

You want to create a role that allows a user to read from all indexes starting with prod- but only write to prod-logs. Which role definition is correct?

A{ "cluster": ["all"], "indices": [ {"names": ["prod-logs"], "privileges": ["read", "write"]} ] }

B{ "cluster": ["monitor"], "indices": [ {"names": ["prod-logs"], "privileges": ["read", "write"]}, {"names": ["prod-*"], "privileges": ["read", "write"]} ] }

C{ "cluster": ["monitor"], "indices": [ {"names": ["prod-*"], "privileges": ["read"]}, {"names": ["prod-logs"], "privileges": ["write"]} ] }

D{ "cluster": ["monitor"], "indices": [ {"names": ["prod-*"], "privileges": ["write"]} ] }

Step-by-Step Solution

Solution:

Step 1: Understand the requirement
User needs read access on all 'prod-*' indexes and write only on 'prod-logs'.
Step 2: Check each option
{ "cluster": ["monitor"], "indices": [ {"names": ["prod-*"], "privileges": ["read"]}, {"names": ["prod-logs"], "privileges": ["write"]} ] } correctly assigns 'read' to 'prod-*' and 'write' to 'prod-logs'. { "cluster": ["all"], "indices": [ {"names": ["prod-logs"], "privileges": ["read", "write"]} ] } gives full cluster 'all' which is too broad. { "cluster": ["monitor"], "indices": [ {"names": ["prod-logs"], "privileges": ["read", "write"]}, {"names": ["prod-*"], "privileges": ["read", "write"]} ] } incorrectly grants 'read' and 'write' to all 'prod-*' indexes. { "cluster": ["monitor"], "indices": [ {"names": ["prod-*"], "privileges": ["write"]} ] } wrongly gives 'write' to all 'prod-*' indexes.
Final Answer:
{ "cluster": ["monitor"], "indices": [ {"names": ["prod-*"], "privileges": ["read"]}, {"names": ["prod-logs"], "privileges": ["write"]} ] } -> Option C
Quick Check:
Read on prod-* + write on prod-logs = correct role [OK]

Quick Trick: Use wildcard for read, specific index for write [OK]

Common Mistakes:

MISTAKES

Giving write privilege to all prod-* indexes
Using cluster 'all' unnecessarily
Mixing up index names and privileges

Master "Security" in Elasticsearch

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More Elasticsearch Quizzes

You want to create a role that allows a user to read from all indexes starting with prod- but only write to prod-logs. Which role definition is correct?

Step 1: Understand the requirement

Step 2: Check each option

Final Answer:

Quick Check:

Want More Practice?