[Fleet] Roles and privileges table: Agent policies "All" does not allow editing package policies on its own

Open Beginner friendly
  • Is something wrong?
#9,085 1 comment 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Domain
documentation

Research direction

Find the Fleet roles and privileges sub-features table at the linked documentation page and review its related text. Clarify that package policy creation, editing, deletion, and upgrades require both Agent policies: All and Integrations: All; reading requires Agent policies: Read or higher and Integrations: Read or higher. The issue says Integrations: All also permits package management, so preserve that limitation in the wording.

Written by the indexing model from the issue text.

Description

Team:SKI triaged

Problem

The Fleet roles and privileges sub-features table says the Agent policies: All sub-feature also allows editing the package policies (integration policies) associated with the agent policy.

That is not accurate. A user with only Fleet Agent policies: All cannot create, update, delete, or upgrade package policies. Those operations also require the Integrations: All privilege.

Verified in code (Kibana)

  • writeIntegrationPolicies = fleet.agentPolicies.all && integrations.all in x-pack/platform/plugins/shared/fleet/common/authz.ts.
  • readIntegrationPolicies = fleet.agentPolicies.read && (integrations.all || integrations.read) (same file).
  • PUT /api/fleet/package_policies/{id} requires writeIntegrationPolicies (server/services/security/route_required_authz.ts).
  • Package policy delete and upgrade routes require both AGENT_POLICIES.ALL and INTEGRATIONS.ALL. Create is checked in the service with the same combination.

Requested docs change

Update the sub-features table (and any related text) so that:

  • Agent policies: All does not claim to grant package policy edits on its own.
  • It states that creating, editing, deleting, and upgrading package policies requires Agent policies: All together with Integrations: All.
  • Reading package policies requires Agent policies: Read (or higher) together with Integrations: Read (or higher).

Notes

  • The Integrations feature has no sub-features today, so Integrations: All also grants installing, upgrading, removing, and uploading packages. Users cannot currently be allowed to edit integration policies without also being able to manage packages. A product enhancement to split these is tracked separately in Kibana. This issue is only about correcting the documentation.
  • Reported by a customer who observed that package policies were editable only when Integrations: All was also assigned.
Dominant language
No language data
Stars
50
Forks
268
Avg merge
4d 5h
Merged PRs (30d)
210

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from elastic/docs-content

All issues in elastic/docs-content

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.