# Dashboard only role

**URL:** <https://forum.opensearch.org/t/dashboard-only-role/18573>\
**Category:** OpenSearch Dashboards\
**Tags:** security-issue\
**Created:** [March 26, 2024, 1:20pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573 "2024-03-26T13:20:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![goldenc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/goldenc/32/7067_2.png) [@goldenc](https://forum.opensearch.org/u/goldenc)\
**Post date:** [March 26, 2024, 1:20pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/1 "2024-03-26T13:20:55Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.5

**Describe the issue** :  
I want to be able to setup a user in OSD that only has access to the “Opensearch Dashboards” part of the accordion on the left hand menu.

OpenSearch Plugins and Management we would like to hide from the user.

**Configuration** :

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/0aef89346e93a6a99588e2daf7abddf9822f47f7.png)

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 26, 2024, 4:00pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/2 "2024-03-26T16:00:52Z")

</div>

Hi @goldenc,

I do not think you can hide menu options explicitly, as far as I am aware.  
Have you checked the below for setting up a read-only user in OpenSearch Dashboards:

> **[Users and roles](https://opensearch.org/docs/2.12/security/access-control/users-roles/#set-up-a-read-only-user-in-opensearch-dashboards)**
>
> Users and roles

Best,  
mj

---

<div class="post-metadata">

**Author:** ![goldenc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/goldenc/32/7067_2.png) [@goldenc](https://forum.opensearch.org/u/goldenc)\
**Post date:** [March 26, 2024, 4:09pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/3 "2024-03-26T16:09:39Z")

</div>

thanks, its not so much a read only user I need. Just want the user to be be able to only edit/change things in the context of dashboards and vizualisations

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 26, 2024, 4:27pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/4 "2024-03-26T16:27:03Z")

</div>

in this case (if I understand your issue correctly) you will need a role(s) for your user with read-only permission on your indices, see a sample below:

```auto
"sample_read_only_roles": {
  "reserved": false,
  "hidden": false,
  "cluster_permissions": [],
  "index_permissions": [
    {
      "index_patterns": [
        "list_of_indices_paterns"
      ],
      "dls": "",
      "fls": [],
      "masked_fields": [],
      "allowed_actions": [
        "read"
      ]
    }
  ]
}

```

You might, as well, be interested in OpenSearch Dashboards multi-tenancy for more granular access control of your dashboards: [OpenSearch Dashboards multi-tenancy - OpenSearch Documentation](https://opensearch.org/docs/latest/security/multi-tenancy/tenant-index/)

Best,  
mj

---

<div class="post-metadata">

**Author:** ![goldenc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/goldenc/32/7067_2.png) [@goldenc](https://forum.opensearch.org/u/goldenc)\
**Post date:** [March 26, 2024, 4:51pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/5 "2024-03-26T16:51:35Z")

</div>

I have tried experimenting with roles and while I can see the correct list of indexes limited for the user they still get to see all the management stuff in the UI which we want to avoid.

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 27, 2024, 12:11pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/6 "2024-03-27T12:11:24Z")

</div>

Hi @goldenc,

I have done some more testing and it looks like you can hide elements in UI by using `opensearch_security.readonly_mode.roles: ["read_only", "list_of_roles"]` in your `opensearch-dashboards.yml`

You can add a user to the “read\_only” role (once the above is added to the config) or add roles to the `opensearch_security.readonly_mode.roles:`

It is briefly mentioned here: [Users and roles - OpenSearch Documentation](https://opensearch.org/docs/latest/security/access-control/users-roles/#predefined-roles)

note: some roles like `admin` will overwrite `read-only`.

Let me know if you need more info.

Best,  
mj

---

<div class="post-metadata">

**Author:** ![goldenc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/goldenc/32/7067_2.png) [@goldenc](https://forum.opensearch.org/u/goldenc)\
**Post date:** [March 27, 2024, 2:54pm UTC](https://forum.opensearch.org/t/dashboard-only-role/18573/7 "2024-03-27T14:54:47Z")

</div>

Thanks, that seems to be too restrictive as I don’t want to be read only in terms of the dashboard. I want to be able to create vizualisations etc.

in this role I can only see the dashboards

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/4416aa75efc9bed95d446f4d6809baf261b75bd8.png)