Exclude index patterns

Security
1

is it possible to apply exclude index patterns to an index permission?
For example

 "index_permissions": [
        {
            "index_patterns": [
                "*",
                "~documents*"
            ],
            "fls": [],
            "masked_fields": [],
            "allowed_actions": [
                "read"
            ]
        }
    ]

I tried this but it didn’t work

2

Were you able to solve this? What version are you running?

3

When defining roles you’d typically declare what permissions (or action_gourps) are granted at the cluster or index level; and with more recent versions, you could also define what permissions (or action_groups) are excluded both at the cluster and index level as well.

In roles.yml you’d have something similar to this:

complex-role:
  cluster_permissions:
  - ...
  exclude_cluster_permissions:
  - ...
  index_permissions:
  - index_patterns:
    - ...
    allowed_actions:
    - ...
  exclude_index_permissions:
  - index_patterns:
    - ...
    actions:
    - ...

Using these “excluded” permissions, you could define one or more roles to restrict access to your indices.