Minimum permission for running support diagnostics

[Leaf-Lin]

In the support diagnostics doc, it mentioned that

The superuser role is recommended unless you are familar enough with the calls being made to tailor your own accounts and roles.

(BTW, there's a typo on familiar.)

It might be useful to spell out exact what permissions are required especially for security conscientious users.

Here's a proposal role as the minimum permission for support diagnostics:

PUT _security/role/support_diagnostics_role
{
  "cluster": [
    "monitor",
    "monitor_enrich",
    "monitor_snapshot",
    "read_ilm",
    "read_pipeline",
    "read_security",
    "manage_autoscaling",
    "manage_ccr",
    "manage_logstash_pipelines",
    "manage_slm",
    "manage_transform"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "view_index_metadata",
        "monitor"
      ],
      "allow_restricted_indices": false
    }
  ],
   "transient_metadata": {
    "enabled": true
  }
}

Using the above role, there will still be a few APIs that are unable to run. But I think those APIs are not essential for understanding cluster issues. And the additional privileges required (see the list below) may cause potential security issues thus better to have those not included.

APIs	Privileges required	Use	Note
/_cat/count	indices [read,all]	Provides quick access to a document count for a data stream, an index, or an entire cluster.
/_count	indices [read,all]	Gets the number of matches for a search query.
/_dangling?human	cluster [manage,all]	Lists dangling indices.
/_internal/desired_balance	cluster [manage,all]	Show balancing stats such as distribution of shards, disk and ingest forecasts across nodes and data tiers (based on the current cluster state)	Direct use is not supported
/_nodes/shutdown	cluster [manage,all]	Retrieves the status of a node that’s being prepared for shutdown.	Direct use is not supported
/_searchable_snapshots/cache/stats?human	cluster [manage,all]	Retrieves statistics about the shared cache for partially mounted indices.