# ISM and security permissions **URL:** \ **Category:** Security\ **Tags:** configure\ **Created:** [August 5, 2024, 2:25pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678 "2024-08-05T14:25:43Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![CarolynR](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@CarolynR](https://forum.opensearch.org/u/CarolynR)\ **Post date:** [August 5, 2024, 2:25pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/1 "2024-08-05T14:25:43Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 2.11.1 **Describe the issue** : I have assigned the index\_permissions to a role and assigned the role to an ID. From roles.yml, the permissions are: index\_permissions: - index\_patterns: - ‘.opendistro-alerting\*’ - ‘.opendistro-reports\*’ - ‘.opendistro-ism\*’ allowed\_actions: - ‘manage\_aliases’ - ‘indices\_monitor’ - ‘indices:admin/aliases’ - ‘indices:admin/get’ - ‘indices:admin/create’ - ‘indices:admin/template/get’ - ‘indices:admin/index\_template/get\*’ - ‘indices:admin/data\_stream/get\*’ - ‘indices:admin/aliases/get\*’ But when I use this ID to try to access templates, data-stream, or aliases, I see the error message: [security\_exception] no permissions for [indices:admin/index\_template/get] … What other permissions am I missing? **Configuration** : Linux Chrome **Relevant Logs or Screenshots** : ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 6, 2024, 3:32pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/2 "2024-08-06T15:32:01Z")
Hi @CarolynR , Could you please try changing `indices:admin/index_template/get*` to `indices:admin/index_template/get` ? ---
**Author:** ![CarolynR](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@CarolynR](https://forum.opensearch.org/u/CarolynR)\ **Post date:** [August 6, 2024, 3:50pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/3 "2024-08-06T15:50:49Z")
I am pretty sure I have tried that in the past, but just tried it again and still see the same problem. I get similar messages when an ID with this roles tries to access details for data streams and aliases. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 6, 2024, 3:58pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/4 "2024-08-06T15:58:41Z")
Could you please send an example of your request? How did you install OpenSearch? ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 6, 2024, 4:03pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/5 "2024-08-06T16:03:03Z")
Could you please share the output of the following command? `GET _plugins/_security/api/roles/` ---
**Author:** ![CarolynR](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@CarolynR](https://forum.opensearch.org/u/CarolynR)\ **Post date:** [August 6, 2024, 8:10pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/6 "2024-08-06T20:10:19Z")
The output of the command: GET \_plugins/\_security/api/roles/zdapui\_admin is: { “zdapui\_admin”: { “reserved”: true, “hidden”: false, “cluster\_permissions”: [ “cluster\_composite\_ops”, “cluster\_monitor”, “cluster:admin/opendistro/alerting/_", "cluster:admin/opendistro/reports/_”, “cluster:admin/opensearch/notifications/_", “cluster:admin/opensearch/ql/datasources/read”, “cluster:admin/opendistro/ism/policy/search”, “cluster:admin/opendistro/ism/policy/get”, “cluster:admin/opendistro/ism/managedindex/explain”, “cluster:admin/component\_template/get”, "cluster:admin/opendistro/rollup/get/_”, “cluster:admin/opendistro/transform/get/_" ], “index\_permissions”: [ { “index\_patterns”: [ ".opendistro-alerting_”, “.opendistro-reports\*”, “.opendistro-ism\*” ], “fls”: , “masked\_fields”: , “allowed\_actions”: [ “indices\_monitor”, “indices:admin/get”, “indices:admin/create”, “indices:admin/index\_template/get”, “indices:admin/data\_stream/get”, “indices:admin/aliases/get” ] } ], “tenant\_permissions”: , “static”: false } } ---
**Author:** ![CarolynR](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@CarolynR](https://forum.opensearch.org/u/CarolynR)\ **Post date:** [August 6, 2024, 8:14pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/7 "2024-08-06T20:14:07Z")
OpenSearch is installed in a docker container. After assigning the zdapui\_admin role to the id, I go to the ISM dashboard and click on Data streams. The message [security\_exception] no permissions for [indices:admin/data\_stream/get] … is then displayed. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 13, 2024, 4:23pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/8 "2024-08-13T16:23:55Z")
Hi @CarolynR, Could you please send an example URL or a screenshot of your ISM dashboard? What OpenSearch logs do you have when this message is displayed? Also, please check if your indexes are in the list of system indexes: > **[System indexes](https://opensearch.org/docs/latest/security/configuration/system-indices/)** > > System indexes ---
**Author:** ![CarolynR](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@CarolynR](https://forum.opensearch.org/u/CarolynR)\ **Post date:** [August 15, 2024, 5:34pm UTC](https://forum.opensearch.org/t/ism-and-security-permissions/20678/9 "2024-08-15T17:34:56Z")
I found that the specified index permissions only apply to the specified index patterns. If I need general index permissions for a role, they need to be specified in a different manner. Also, I found that despite that name the “indices:admin/index\_template/get” needs to be specified as a cluster permission. May I request that the documentation for the permissions be reviewed and fleshed out more?