Model User Roles within ChaosSearch

The following table describes some high level ChaosSearch groups/user roles that can be deployed at a customer that uses the file name prefix model. The process to map or associate these groups to users/subaccounts will vary based on the customer's authentication methods and IdP, and is managed by the customer. These roles can be modified and additional roles created in the future as required by the customer.

Type	Description	Scope	Accompanying RBAC Policy Permissions Template
superadmin	This group has all privileges on all tabs. Visibility and permitted actions are not constrained by any prefix.	One overall	rbac-template-120821-superadmin.json
admin	This group has access to the Storage, Refinery, and Analytics areas. This group can perform any and all actions available. Within each area, the visibility and permitted actions are restricted to the team's predetermined prefix.	One group per customer team	rbac-template-120821-admin.json
normal	This group has access to the Refinery and Analytics areas. This group can perform any and all actions available. Within each area, visibility and permitted actions are restricted to the team's predetermined prefix.	One group per customer team	rbac-template-120821-normal.json
readonly	This group has access to the Analytics area. This group can run queries and access dashboards, but cannot create or edit any OpenSearch Dashboards objects. Visibility and permitted actions are restricted to the team's predetermined prefix.	One group per customer team	rbac-template-120821-readonly.json

Modifying the Group Bucket and Prefix Settings

Within the sample RBAC policy definitions, there are references and placeholder strings for buckets, object groups, indexes, views, and OpenSearch Dashboards saved objects. Customer administrators should update the references for the correct values that they have planned for their environment and group setup. In the accompanying templates, search for the terms bucketnamechangeme and prefixchangeme. The following table lists the references and the context where they are defined.

Type	Reference
Buckets in Conditions	`"s3:bucket/attributes.name": "bucketnamechangeme"`
Buckets in Resources	`"arn:aws:s3:::bucketnamechangeme"`
Object Groups in Conditions	`"chaos:object_group/attributes.name": "prefixchangeme-"`
Object Groups in Resources	`"crn:object_group:::prefixchangeme-*"`
Views in Conditions	`"chaos:view/attributes.name": "prefixchangeme-"`
Views in Resources	`"crn:view:::prefixchangeme-*"`
Indexes in Conditions (note the starting underscore)	`"chaos:index/attributes.name": "_prefixchangeme-"`
Monitors in Resources	`"crn:monitor:::prefixchangeme-*"`
Alerts in Resources	`"crn:alert:::prefixchangeme-*"`
Destinations in Resources	`"crn:destination:::prefixchangeme-*"`
OpenSearch Dashboards (Kibana) Saved Objects In Conditions	`"chaos:document/attributes.title": "prefixchangeme"`

rbac-template-120821-superadmin.json

[
    {
      "Actions": [
        "*"
      ],
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    }
  ]

rbac-template-120821-admin.json

[
  {
    "Actions": [
      "ui:analytics",
      "ui:refinery",
      "ui:storage"
    ],
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "chaos:*",
      "chaos:replica:*",
      "chaos:query:*"
    ],
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:*",
      "elastic:*",
      "elastic-opendistro:*",
      "kibana:*",
      "kibana:query",
      "kibana:saved-objects:create",
      "kibana:saved-objects:update",
      "kibana:saved-objects:delete",
      "kibana:saved-objects:read",
      "kibana-management:*",
      "kibana-management:import:*",
      "kibana-management:export:*",
      "kibana-settings:read",
      "kibana-opendistro:*",
      "kibana-opendistro:alerting",
      "kibana-opendistro:alerting:alerts:read",
      "kibana-opendistro:alerting:alerts:update",
      "kibana-opendistro:alerting:destinations:create",
      "kibana-opendistro:alerting:destinations:update",
      "kibana-opendistro:alerting:destinations:delete",
      "kibana-opendistro:alerting:destinations:read",
      "kibana-opendistro:alerting:monitors:create",
      "kibana-opendistro:alerting:monitors:update",
      "kibana-opendistro:alerting:monitors:delete",
      "kibana-opendistro:alerting:monitors:execute",
      "kibana-opendistro:alerting:monitors:read"
    ],
    "Effect": "Allow",
    "Resources": [
      "crn:view:::prefixchangeme-*",
      "crn:monitor:::prefixchangeme-*",
      "crn:alert:::prefixchangeme-*",
      "crn:destination:::prefixchangeme-*",
      "crn:view:::.opendistro*",
      "crn:view:::.opendistro-alerting-alerts"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "kibana:*",
      "kibana:saved-objects:read"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "chaos:document/attributes.title": "prefixchangeme"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "crn:view:::.kibana"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBuckets"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "s3:bucket/attributes.name": "bucketnamechangeme"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "arn:aws:s3:::*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBuckets"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "chaos:object_group/attributes.name": "prefixchangeme-"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "crn:object_group:::*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBuckets"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "chaos:view/attributes.name": "prefixchangeme-"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "crn:view:::*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBuckets"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "chaos:index/attributes.name": "_prefixchangeme-"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBucket",
      "s3:chaos:field_caps",
      "s3:chaos:field_samples",
      "s3:chaos:metadata",
      "s3:chaos:partition_keys"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "s3:bucket/attributes.name": "bucketnamechangeme"
          }
        },
        {
          "StartsWith": {
            "chaos:object_group/attributes.name": "prefixchangeme-"
          }
        },
        {
          "StartsWith": {
            "chaos:view/attributes.name": "prefixchangeme-"
          }
        },
        {
          "StartsWith": {
            "chaos:index/attributes.name": "_prefixchangeme-"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:view:create"
    ],
    "Effect": "Allow",
    "Resources": [
      "crn:view:::prefixchangeme-*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:view:update"
    ],
    "Effect": "Allow",
    "Resources": [
      "crn:view:::prefixchangeme-*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:GetObject",
      "s3:aws:GetObjectTagging",
      "s3:aws:GetBucketTagging",
      "s3:chaos:metadata"
    ],
    "Effect": "Allow",
    "Resources": [
      "arn:aws:s3:::bucketnamechangeme",
      "arn:aws:s3:::bucketnamechangeme/*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:ListBucket",
      "s3:chaos:field_samples"
    ],
    "Effect": "Allow",
    "Resources": [
      "arn:aws:s3:::bucketnamechangeme",
      "arn:aws:s3:::bucketnamechangeme/*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:object_group:create"
    ],
    "Effect": "Allow",
    "Resources": [
      "arn:aws:s3:::bucketnamechangeme",
      "crn:object_group:::prefixchangeme-*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:object_group:update"
    ],
    "Effect": "Allow",
    "Resources": [
      "crn:object_group:::prefixchangeme-*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:model"
    ],
    "Effect": "Allow",
    "Resources": [
      "crn:object_group:::prefixchangeme-*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:inspect"
    ],
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:chaos:discover"
    ],
    "Condition": {
      "Conditions": [
        {
          "Equals": {
            "s3:bucket/attributes.name": "bucketnamechangeme"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "chaos:user:credentials",
      "chaos:user:apikeys",
      "kibana-settings:write"
    ],
    "Effect": "Deny",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  },
  {
    "Actions": [
      "s3:aws:DeleteBucket"
    ],
    "Condition": {
      "Conditions": [
        {
          "StartsWith": {
            "s3:bucket/attributes.name": "bucketnamechangeme"
          }
        },
        {
          "StartsWith": {
            "chaos:object_group/attributes.name": "prefixchangeme"
          }
        },
        {
          "StartsWith": {
            "chaos:view/attributes.name": "prefixchangeme-"
          }
        },
        {
          "StartsWith": {
            "chaos:index/attributes.name": "_prefixchangeme-"
          }
        }
      ]
    },
    "Effect": "Allow",
    "Resources": [
      "*"
    ],
    "Version": "1.0"
  }
]

rbac-template-120821-normal.json

[
    {
      "Actions": [
        "ui:analytics",
        "ui:refinery"
      ],
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "chaos:*",
        "chaos:replica:*",
        "chaos:query:*"
      ],
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:*",
        "elastic:*",
        "elastic-opendistro:*",
        "kibana:*",
        "kibana:query",
        "kibana:saved-objects:create",
        "kibana:saved-objects:update",
        "kibana:saved-objects:delete",
        "kibana:saved-objects:read",
        "kibana-management:*",
        "kibana-management:import:*",
        "kibana-management:export:*",
        "kibana-settings:read",
        "kibana-opendistro:*",
        "kibana-opendistro:alerting",
        "kibana-opendistro:alerting:alerts:read",
        "kibana-opendistro:alerting:alerts:update",
        "kibana-opendistro:alerting:destinations:create",
        "kibana-opendistro:alerting:destinations:update",
        "kibana-opendistro:alerting:destinations:delete",
        "kibana-opendistro:alerting:destinations:read",
        "kibana-opendistro:alerting:monitors:create",
        "kibana-opendistro:alerting:monitors:update",
        "kibana-opendistro:alerting:monitors:delete",
        "kibana-opendistro:alerting:monitors:execute",
        "kibana-opendistro:alerting:monitors:read"
      ],
      "Effect": "Allow",
      "Resources": [
        "crn:view:::prefixchangeme-*",
        "crn:monitor:::prefixchangeme-*",
        "crn:alert:::prefixchangeme-*",
        "crn:destination:::prefixchangeme-*",
        "crn:view:::.opendistro*",
        "crn:view:::.opendistro-alerting-alerts"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "kibana:*",
        "kibana:saved-objects:read"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "chaos:document/attributes.title": "prefixchangeme"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "crn:view:::.kibana"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:ListBuckets"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "s3:bucket/attributes.name": "bucketnamechangeme"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "arn:aws:s3:::*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:ListBuckets"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "chaos:object_group/attributes.name": "prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "crn:object_group:::*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:ListBuckets"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "chaos:view/attributes.name": "prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "crn:view:::*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:ListBuckets"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "chaos:index/attributes.name": "_prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:ListBucket",
        "s3:chaos:field_caps",
        "s3:chaos:field_samples",
        "s3:chaos:metadata",
        "s3:chaos:partition_keys"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "s3:bucket/attributes.name": "bucketnamechangeme"
            }
          },
          {
            "StartsWith": {
              "chaos:object_group/attributes.name": "prefixchangeme-"
            }
          },
          {
            "StartsWith": {
              "chaos:view/attributes.name": "prefixchangeme-"
            }
          },
          {
            "StartsWith": {
              "chaos:index/attributes.name": "_prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:chaos:view:create"
      ],
      "Effect": "Allow",
      "Resources": [
        "crn:view:::prefixchangeme-*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:chaos:view:update"
      ],
      "Effect": "Allow",
      "Resources": [
        "crn:view:::prefixchangeme-*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:GetObject",
        "s3:aws:GetObjectTagging",
        "s3:aws:GetBucketTagging",
        "s3:chaos:metadata"
      ],
      "Effect": "Allow",
      "Resources": [
        "arn:aws:s3:::bucketnamechangeme",
        "arn:aws:s3:::bucketnamechangeme/*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "chaos:user:credentials",
        "chaos:user:apikeys",
        "kibana-settings:write"
      ],
      "Effect": "Deny",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:aws:DeleteBucket"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "s3:bucket/attributes.name": "bucketnamechangeme"
            }
          },
          {
            "StartsWith": {
              "chaos:view/attributes.name": "prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    }
  ]

rbac-template-120821-readonly.json

[
    {
      "Actions": [
        "ui:analytics"
      ],
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "chaos:*",
        "chaos:replica:*",
        "chaos:query:*"
      ],
      "Effect": "Allow",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "s3:*",
        "elastic:*",
        "elastic-opendistro:*",
        "kibana:*",
        "kibana:query",
        "kibana:saved-objects:read",
        "kibana-management:*",
        "kibana-management:export:*",
        "kibana-settings:read",
        "kibana-opendistro:*",
        "kibana-opendistro:alerting",
        "kibana-opendistro:alerting:alerts:read",
        "kibana-opendistro:alerting:destinations:read",
        "kibana-opendistro:alerting:monitors:execute",
        "kibana-opendistro:alerting:monitors:read"
      ],
      "Effect": "Allow",
      "Resources": [
        "crn:view:::prefixchangeme-*",
        "crn:monitor:::prefixchangeme-*",
        "crn:alert:::prefixchangeme-*",
        "crn:destination:::prefixchangeme-*",
        "crn:view:::.opendistro*",
        "crn:view:::.opendistro-alerting-alerts"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "kibana:*",
        "kibana:saved-objects:read"
      ],
      "Condition": {
        "Conditions": [
          {
            "StartsWith": {
              "chaos:document/attributes.title": "prefixchangeme-"
            }
          }
        ]
      },
      "Effect": "Allow",
      "Resources": [
        "crn:view:::.kibana"
      ],
      "Version": "1.0"
    },
    {
      "Actions": [
        "chaos:user:credentials",
        "chaos:user:apikeys",
        "kibana:saved-objects:create",
        "kibana:saved-objects:update",
        "kibana:saved-objects:delete",
        "kibana-opendistro:alerting:alerts:update",
        "kibana-opendistro:alerting:destinations:create",
        "kibana-opendistro:alerting:destinations:update",
        "kibana-opendistro:alerting:destinations:delete",
        "kibana-opendistro:alerting:monitors:create",
        "kibana-opendistro:alerting:monitors:update",
        "kibana-opendistro:alerting:monitors:delete",
        "kibana-settings:write",
        "kibana-management:import:*"
      ],
      "Effect": "Deny",
      "Resources": [
        "*"
      ],
      "Version": "1.0"
    }
  ]