Manage users and roles

Use named identities and least-privilege roles. Do not use the built-in elastic superuser for routine ingestion, dashboards, or read-only access.

Design access

For each persona, identify:

• required indices or data streams;
• read, write, create, delete, or lifecycle operations;
• required Kibana spaces and features;
• any cluster-level operation;
• access owner and review date.

Separate data ingestion, data exploration, content administration, and cluster administration roles.

Create and test a role

1. Sign in to Kibana with an authorized security administrator.
2. Open Roles using Kibana navigation search.
3. Create a role with only the required cluster, index, and Kibana privileges.
4. Restrict index patterns and Kibana spaces.
5. Save the role.
6. Create or select a named user and assign the role.
7. Sign in with a test identity and verify both permitted and denied actions.
8. Record the owner and review date outside the password or token store.

Protect credentials

• Store service credentials and API keys in an approved secret manager.
• Prefer short-lived or scoped credentials.
• Rotate credentials when ownership changes or exposure is suspected.
• Never include authentication headers, passwords, or API keys in tickets.
• Disable unused accounts rather than sharing them.

For product behavior, see Elastic user authentication.