API Keys access version 3.7.0

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue: Upgraded to 3.7.0. When log-in as user can’t see API key option in UI. Is this only limited to Admin?

Configuration:

Relevant Logs or Screenshots:

2

@hitesh303 Welcome to the forum!

According to the documentation: “Only security administrators can create, list, and revoke API keys”

Are you referring to option in “Security” → “API Keys”?

Is your user mapped to all_access role to access the “Security” section? Or is one of the roles its mapped to listed in plugins.security.restapi.roles_enabled?

3

Hi Anthony,

Thanks for quick response and doc. As Admin we can see the option but not as user.

4

@hitesh303 yes, this is by design, as per the documentation.

5

Hi Anthony,

I have created api key with below permissions:
POST /_plugins/_security/api/apitokens
{
“name”: “hp-api-new6”,
“cluster_permissions”: [“cluster_monitor”],
“index_permissions”: [
{
“index_pattern”: [
“logs-*“,””
],
“allowed_actions”: [
“*”
]
}
],
“duration_seconds”: 2592000
}

But when I search the index I’m not getting any documents in postman get call:

{
“took”: 3,
“timed_out”: false,
“_shards”: {
“total”: 1,
“successful”: 1,
“skipped”: 0,
“failed”: 0
},
“hits”: {
“total”: {
“value”: 0,
“relation”: “eq”
},
“max_score”: null,
“hits”:
}
}