SLO roles privileges changed (#4300)

* SLO roles privileges changed to match 8.16 release * editor builtin role information added * wording and order of privileges options changed * minor wording changes * serverless required role updated * rephrasing permissions Co-authored-by: Arianna Laudazzi <[email protected]> * removing future tense Co-authored-by: Arianna Laudazzi <[email protected]> * Update docs/en/observability/slo-privileges.asciidoc change see by check Co-authored-by: Arianna Laudazzi <[email protected]> --------- Co-authored-by: Arianna Laudazzi <[email protected]>
elastic · Oct 16, 2024 · bb910be · bb910be
1 parent c33dd95
commit bb910be
Show file tree

Hide file tree

Showing 6 changed files with 26 additions and 14 deletions.
diff --git a/docs/en/observability/images/slo-es-priv-all.png b/docs/en/observability/images/slo-es-priv-all.png
diff --git a/docs/en/observability/images/slo-es-priv-editor.png b/docs/en/observability/images/slo-es-priv-editor.png
diff --git a/docs/en/observability/images/slo-es-priv-read.png b/docs/en/observability/images/slo-es-priv-read.png
diff --git a/docs/en/observability/images/slo-es-priv-viewer.png b/docs/en/observability/images/slo-es-priv-viewer.png
diff --git a/docs/en/observability/slo-privileges.asciidoc b/docs/en/observability/slo-privileges.asciidoc
@@ -7,10 +7,21 @@
 
 IMPORTANT: To create and manage SLOs, you need an {subscriptions}[appropriate license].
 
-You can create the following roles for your SLOs:
+You can enable access to SLOs in two different ways:
 
-* <<slo-all-access,*SLO All*>> — Create, edit, and manage SLOs and their historical summaries.
-* <<slo-read-access,*SLO Read*>> — See SLOs and their historical summaries.
+* Creating the following roles, depending on the type of access needed:
+** <<slo-all-access,*SLO Editor*>> — Create, edit, and manage SLOs and their historical summaries.
+** <<slo-read-access,*SLO Viewer*>> — Check SLOs and their historical summaries.
+
+* Using the `editor` {ref}/built-in-roles.html[built-in role]. This role grants full access to all features in {kib} (including the {observability} solution)
+and read-only access to data indices. Users assigned to this role can create, edit, and manage SLOs.
++
+[NOTE]
+====
+The `editor` {ref}/built-in-roles.html[built-in role] grants write access
+to _all_ {kib} apps. If you want to limit access to the SLOs only, you have
+to manually create and assign the mentioned roles.
+====
 
 To create a role:
 
@@ -20,37 +31,38 @@ To create a role:
 
 [discrete]
 [[slo-all-access]]
-== Create an SLO All role
+== Create an SLO Editor role
 
-Set the following privileges for the SLO All role:
+Set the following privileges for the SLO Editor role:
 
-. Under *Cluster privileges* in the *Elasticsearch* section, add `manage_transform` and `manage_ingest_pipelines`.
-. Under *Index privileges*, add `.slo-*` to the *Indices* field and `all` to the *Privileges* field.
+. Under *Index privileges* in the *Elasticsearch* section, add `.slo-observability-*` to the *Indices* field and `read`, `view_index_metadata`, `write`, and `manage` to the *Privileges* field.
 . Click *Add index privilege*.
-. Add indices you plan to create SLOs for to the *Indices* field, and add *read* and *view_index_metadata* to the *Privileges* field. The following example shows `logs-*`, but you can specify any indices.
+. In the *Indices* field, add the indices for which you plan to create SLOs. Then, add `read` and `view_index_metadata` to the *Privileges* field. The following example shows `logs-*`, but you can specify any indices.
 +
 [role="screenshot"]
-image::images/slo-es-priv-all.png[Cluster and index privileges for SLO All role]
+image::images/slo-es-priv-editor.png[Cluster and index privileges for SLO Editor role]
 . In the *Kibana* section, click *Add Kibana privilege*.
 . From the *Spaces* dropdown, either select any specific spaces you want the role to apply to, or select *All Spaces*.
 . Set *Observability → SLOs* to `All`.
 +
 [role="screenshot"]
 image::images/slo-kibana-priv-all.png[SLO Kibana all privileges,75%]
+. Click *Create Role* at the bottom of the page and assign the role to the relevant users.
 
 [discrete]
 [[slo-read-access]]
-== Create an SLO Read role
+== Create an SLO Viewer role
 
 Set the following privileges for the SLO Read role:
 
-. Under *Index privileges* in the *Elasticsearch* section, add `.slo-*` to the *Indices* field and `read` to the *Privileges* field.
+. Under *Index privileges* in the *Elasticsearch* section, add `.slo-observability-*` to the *Indices* field and `read` and `view_index_metadata` to the *Privileges* field.
 +
 [role="screenshot"]
-image::images/slo-es-priv-read.png[Index privileges for SLO Read role]
+image::images/slo-es-priv-viewer.png[Index privileges for SLO Viewer role]
 . In the *Kibana* section, click *Add Kibana privilege*.
 . From the *Spaces* dropdown, either select any specific spaces you want the role to apply to, or select *All Spaces*.
 . Set *Observability → SLOs* to `Read`.
 +
 [role="screenshot"]
-image::images/slo-kibana-priv-read.png[SLO Kibana read privileges,75%]
+image::images/slo-kibana-priv-read.png[SLO Kibana read privileges,75%]
+. Click *Create Role* at the bottom of the page and assign the role to the relevant users.
diff --git a/docs/en/serverless/slos/create-an-slo.mdx b/docs/en/serverless/slos/create-an-slo.mdx
@@ -9,7 +9,7 @@ tags: [ 'serverless', 'observability', 'how-to' ]
 
 import Roles from '../partials/roles.mdx'
 
-<Roles role="Admin" goal="create SLOs" />
+<Roles role="Editor" goal="create SLOs" />
 
 To create an SLO, in your ((observability)) project, go to **Observability** → **SLOs**: