Control which Kibana features are available using spaces and role-based access control.

<p>We've continued to add new applications and features to Kibana with each release of the Elastic Stack. One of the common requests we've received is to have control over which features are available to which users.
</p><p>Want to hide Dev Tools from the left navigation? Show Stack Monitoring only to admins? Or, maybe you want certain users to only have access to Dashboard and Canvas? Starting in Kibana 7.2, you can customize which features are available in each space, and you can control who has access to each feature using role-based access control.
</p><p>Previously, hiding features could only be accomplished by disabling them in your <code>kibana.yml</code> file. This setting applied to all spaces, and all users. Now with feature controls, you have the ability to curate the Kibana experience for individual spaces and users.
</p><h2>Customizing available features using Spaces</h2><p>
	You can now tailor the experience of individual spaces within Kibana. For example, you might choose to hide Dev Tools within your Marketing space if your marketing users don’t need the capabilities offered by Dev Tools.
</p><p>
	Disabling features within spaces is primarily a usability feature, and applies to all users of the space. This works both with and without Kibana security. Enabling security allows you to secure access based on user role (see 
	<a href="#granting-access-with-security">Granting access to features using security</a> below). If this sounds interesting to you, give security a try — <a href="https://www.elastic.co/blog/security-for-elasticsearch-is-now-free">it’s free</a>! If you’re not using security, then keep in mind that hiding features within a space will not prevent users from accessing the APIs directly.
</p><p>
	<em>Upgrade tip:</em> All existing spaces have all features enabled by default, but you can update your existing spaces at any time.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltf01c5181778c7a01/5d09313adc3c021053899965/1-customize-feature-display.png" data-sys-asset-uid="bltf01c5181778c7a01" alt="Custom feature display">
</p><p><a id="granting-access-with-security"></a>
</p><h2>Granting access to features using security</h2><p>Prior to version 7.2, administrators could only grant read/all privileges on a per-space granularity. With feature controls, you can now grant read/all privileges at the feature level. This is a very powerful capability that allows administrators to specify fine-grained access policies for their Kibana features.
</p><p>
	<em>Upgrade tip:</em> All existing roles will have access to all features. You can update your custom roles at any time to take advantage of feature controls.
</p><h3>Privilege types</h3><p>There are a number of ways to grant access to Kibana features. If you’re upgrading from a previous version, some of these concepts will look familiar.
</p><h4>Base privileges</h4><p>Base privileges are quick “shortcuts” that grant either read or all access to every feature. This extends to any feature that may be introduced in future versions of Kibana. The two available base privileges are “Read” and “All”:
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt34a51592b5ac2161/5d09314e96d2d1b65a982242/2-security-base-privileges.png" data-sys-asset-uid="blt34a51592b5ac2161" alt="Base privileges">
</p><h4>Custom privileges</h4><p>Custom privileges allow you to define which features are available to each user. Additionally, you can specify whether the user should have read or all access to each feature:
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt5bed22ac907c6819/5d093377561b9b0b537f7751/3-security-custom-privileges.png" data-sys-asset-uid="blt5bed22ac907c6819" alt="Custom privileges">
</p><h3>Granting privileges</h3><p>You can choose to grant these privileges in one of two ways: globally or per space.
Defining privileges globally allows users to access the specified features within every space. This includes spaces that you might create in the future.&nbsp;
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt06a50a61a9cd6b80/5d0933a15fe8e2af5a55a3e4/4-security-global-privileges.png" data-sys-asset-uid="blt06a50a61a9cd6b80" alt="Global privileges" "="">
</p><p>Defining privileges at the per-space level allows users to access the specified features only within the spaces you designate.
</p><p>Roles are additive in nature. Users will receive the sum of all privileges granted to their assigned roles. This also applies to feature controls. For example, if you were to grant all access globally and then grant read access to an individual space, the rule that is specified globally takes precedence.
</p><p>The role management interface guides you so that it’s clear you can’t revoke privileges that are granted globally. It also displays your effective privileges in the summary, so it’s obvious what you’re actually granting the user access to.
</p><p>The interface will not protect you from specifying contradicting privileges across different roles, so take care  when assigning roles to users. For example, if the “role1” role has Read privileges to the Discover application, but the “role2” role has no privileges to Discover, then a user assigned both of these roles would end up with read-only access to the Discover application.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1ccd04c673926fa9/5d09318096d2d1b65a982248/5-security-privilege-summary.png" data-sys-asset-uid="blt1ccd04c673926fa9" alt="Security privilege summary">
</p><h2>Interaction of spaces and security</h2><p>You can use both spaces and security at the same time to control access to features. You can  hide features at the space level, and additionally secure access to features using role-based access control.
</p><p>When used together, features are only available when they are visible in the space, and when the user is authorized for the feature:&nbsp;
</p><table>
<tbody>
<tr>
	<th>Space Config
	</th>
	<th>Role Config
	</th>
	<th>Result
	</th>
</tr>
<tr>
	<td>Feature hidden
	</td>
	<td>Feature disabled
	</td>
	<td>Feature not available
	</td>
</tr>
<tr>
	<td>Feature hidden
	</td>
	<td>Feature enabled
	</td>
	<td>Feature not available
	</td>
</tr>
<tr>
	<td>Feature visible
	</td>
	<td>Feature disabled
	</td>
	<td>Feature not available
	</td>
</tr>
<tr>
	<td>Feature visible
	</td>
	<td>Feature enabled
	</td>
	<td><strong>Feature available</strong>
	</td>
</tr>
</tbody>
</table><h2>Conclusion</h2><p>Go forth and customize your Kibana experience! You can now adjust it  appropriately to allow multiple groups to use the same instance, and to allow different types of users to have different levels of access. If you're not ready to upgrade but want to give it a try, spin up an <a href="/cloud/elasticsearch-service">Elasticsearch Service</a> cluster for free for 14 days. And while you're there, give our other premium <a href="https://www.elastic.co/elastic-stack">features</a> a try.
</p><p>Let us know how things go! We are actively working on improving the user experience around feature controls, so your input is valuable. Check out the <a href="https://www.elastic.co/guide/en/kibana/7.2/kibana-role-management.html">documentation</a>, ask questions on <a href="https://discuss.elastic.co/c/kibana">Discuss</a>, and create <a href="https://github.com/elastic/kibana/issues">feature requests on GitHub</a>.
</p>

kibana-feature-controls-banner.jpg

kibana-feature-controls-thumb.jpg

Introducing Kibana feature controls: Curating and securing feature access

Organize your dashboards, visualizations, and other saved objects with Kibana Spaces.

<h2>Organize your work with Kibana spaces</h2><p>Version 6.5 introduces our new Spaces feature. Spaces allows you to organize your dashboards, visualizations, and other saved objects into meaningful categories. Each space is independent, so objects that exist in one space don’t clutter other spaces.<br>
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt3f7340454ff7c4a4/5c304d98c0508d076e1712f5/kibana-space-selector.png" data-sys-asset-uid="blt3f7340454ff7c4a4" alt="Your list of spaces is displayed when you enter Kibana" "="">
</p><figcaption>Your list of spaces is displayed when you enter Kibana</figcaption><h3>Getting started</h3><p>Kibana automatically creates the “Default” space for you. This is where you’ll find your existing saved objects if you are upgrading from a previous version.
</p><p>Your current space is always visible in the bottom left of the Kibana navigation bar. You can also&nbsp;navigate to Spaces management&nbsp;UI directly from there to create a new space.&nbsp;Click the “Create space” button.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blte41d22fd7d62b3aa/5c304bea3fdf8ce26f0c0833/spaces-gif.gif" data-sys-asset-uid="blte41d22fd7d62b3aa" alt="spaces-gif.gif">
</p><figcaption>The Spaces management screen. From here, you can create, edit, and delete spaces.</figcaption><p>Now give it a name, and customize the avatar to your liking:
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt9e31490774d4687a/5c304d8fe71ce40c6e4ad97d/kibana-create-space.png" data-sys-asset-uid="blt9e31490774d4687a" alt="The Create space screen." "="">
</p><figcaption>The Create space screen.</figcaption><h4>A note on the URL Identifier</h4><p>This identifier becomes part of Kibana’s URL. You can customize the URL when creating a space, but once you create it, you are not allowed to update it.
</p><h3>Where am I?</h3><p>You can always see your current space by looking at the Kibana navigation bar. Clicking the space avatar reveals a menu, which allows you to change to a different space.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1a906e1a56d3f267/5c304d8c25a401fc6fe4f4b9/kibana-space-navigation.png" data-sys-asset-uid="blt1a906e1a56d3f267" alt="The space selector is always one click away, so changing spaces is simple!" "="">
</p><figcaption>The space selector is always one click away, so changing spaces is simple!</figcaption><h3>Deleting a space</h3><p>If you want to delete a space, head over to the Management &gt; Spaces screen. From here, click the trash can next to the space you want to delete.
</p><p>Be careful! Deleting a space deletes all saved objects inside of that space, and cannot be undone!
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt8b34b5ba5256811b/5c304d87760e7f7a666d68cb/kibana-delete-space-warning.png" data-sys-asset-uid="blt8b34b5ba5256811b" alt="Kibana requires confirmation when deleting a space." "="">
</p><figcaption>Kibana requires confirmation when deleting a space.</figcaption><h3>Moving objects between spaces</h3><p>You can move saved objects from one space to another via import/export. The <a href="/blog/how-to-migrate-to-kibana-spaces">Migrating to Spaces</a> blog will teach you everything that you need to know.
</p><h2>Securing access to spaces</h2><p>You can control which roles have access to each space. To get started, navigate to the Management &gt; Roles screen.
</p><p>Access to spaces is governed by a concept called “Minimum Privilege”. There are three options for the minimum privilege:
</p><table><colgroup><col width="156"><col width="468"></colgroup>
<tbody>
<tr>
	<td>
		<p><strong>Minimum Privilege</strong>
		</p>
	</td>
	<td>
		<p><strong>Description</strong>
		</p>
	</td>
</tr>
<tr>
	<td>
		<p>all
		</p>
	</td>
	<td>
		<p>Users will have read/write access to all spaces in Kibana. Additionally, they will be able to create, edit, and delete any space in Kibana. This extends to spaces that are created in the future.
		</p>
	</td>
</tr>
<tr>
	<td>
		<p>read
		</p>
	</td>
	<td>
		<p>Users will have read-only access to all spaces in Kibana. This extends to spaces that are created in the future.
		</p>
	</td>
</tr>
<tr>
	<td>
		<p>none
		</p>
	</td>
	<td>
		<p>Users cannot access any space in Kibana.
		</p>
	</td>
</tr>
</tbody>
</table><p>Once a minimum privilege is set, you can customize access to specific spaces.
</p><h3>Examples of securing spaces</h3><h4>Example: Full access to all spaces</h4><p>Setting the minimum privilege to "all" grants access to all spaces. This setting prevents you from customizing access to specific spaces.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt38d05ac4f2719b38/5c304d84ad674d236e76488a/kibana-access-all-spaces.png" data-sys-asset-uid="blt38d05ac4f2719b38" alt="Setting the minimum privilege to “all” grants full access to Kibana" "="">
</p><figcaption>Setting the minimum privilege to “all” grants full access to Kibana</figcaption><h4>Example: Read-only access to all spaces, with full access to the Marketing space</h4><p>Setting the minimum privilege to "read" grants read-only access to all spaces. This setting allows you to grant "all" access to specific spaces as needed, but you are not able to revoke access to a specific space.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltaadd1a19196ce41f/5c304d7bb2b2be79676e83ba/kibana-secure-specific-space.png" data-sys-asset-uid="bltaadd1a19196ce41f" alt="Setting the minimum privilege to “read” grants read-only access to all spaces. Additionally, the space privilege for Marketing allows full access to that space." "="">
</p><figcaption>Setting the minimum privilege to “read” grants read-only access to all spaces. Additionally, the space privilege for Marketing allows full access to that space.</figcaption><h4>Example: Read-only access to just the Executive space</h4><p>Setting the minimum privilege to “none” prevents access to any space. Additionally, the space privilege for Executive allows read-only access to that space.
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltc7af81dd99d4ff57/5c304d7f682c4c4866a79832/kibana-secure-spaces.png" data-sys-asset-uid="bltc7af81dd99d4ff57" alt="kibana-secure-spaces.png">
</p><h2>Viewing all space privileges</h2><p>To see what access a role has to all spaces in Kibana, click the “View summary of spaces privileges” link:
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blta84e769cb0d22213/5c304d73e5b78fdd0bed3567/kibana-view-space-privileges.png" data-sys-asset-uid="blta84e769cb0d22213" alt="kibana-view-space-privileges.png">
</p><h2>Wrapping up</h2><p>Spaces is a powerful new feature in Kibana. Organize your dashboards and visualizations like never before. Take it a step further and secure access using our completely redesigned role management interface. To get&nbsp;started,&nbsp;be sure to&nbsp;check our <a href="/blog/how-to-migrate-to-kibana-spaces">How to Migrate to Kibana Spaces</a> blog.
</p><hr><p><em><strong>Editor's Note:</strong> Starting with Elastic Stack 6.8 and 7.1, <a href="https://www.elastic.co/blog/security-for-elasticsearch-is-now-free">role-based access control is free</a>&nbsp;in&nbsp;the default distribution, and no longer requires a Gold or Platinum license. This blog has been updated to reflect this change.</em></p>

Articles by Larry Gregory

Introducing Kibana feature controls: Curating and securing feature access

Introducing Kibana Spaces for Organization and Security

Products & Solutions

Company

Resources

Solutions

Elastic (ELK) Stack

Register Today

Featured topics

News

Articles by Larry Gregory

Introducing Kibana feature controls: Curating and securing feature access

Introducing Kibana Spaces for Organization and Security