User roles and privilegesedit

Within an organization, users can have one or more roles and each role grants specific privileges. Organization owners can manage all roles within the organization, while Admins can manage roles that apply to the deployments for which they are authorized.

  • Organization owner - The role assigned by default to the person who created the organization. Has all privileges to deployments, organization-level details and properties, billing details and subscription levels. Organization owners are able to sign on to deployments with superuser privileges.
  • Billing admin - Can manage an organization’s billing details such as credit card information, subscription and invoice history. Cannot manage other organization or deployment details and properties.
  • Admin - Can manage deployment details, properties and security privileges, and is able to sign on to the deployment with superuser privileges. This role can be scoped to one or more deployments. In order to prevent scope expansion, only Admins on all deployments can create new deployments.
  • Editor - Has the same rights as Admin, except from deployment creation and management of security privileges. Editors are able to sign on to the deployment with the “editor” stack role. This role can be scoped to one or more deployments.
  • Viewer - Can view deployments, and can sign on to the deployment with the viewer Stack role. This role can be scoped to one or more deployments.

Within the same organization, all members share the same set of default permissions. From the Elasticsearch Service main page you can:

  • See the organization details.
  • Modify your Profile under your avatar in the upper right corner.
  • Leave the organization.

The Cloud UI navigation and access to components is based on user privileges.

Role scopingedit

Roles are assigned to every member of an organization and can refer (or be scoped) to one or more specific deployments, or all deployments. When a role is scoped to all deployments it grants permissions on all existing and future deployments.

This list describes the scope of the different roles:

  • Organization owner - This role is always scoped to administer all deployments.
  • Billing admin - This role does not refer to any deployment.
  • Admin, Editor, and Viewer - These roles can be scoped to either all deployments, or specific deployments.

Members are only able to see the role assignments of other members under the organization they belong to, for role assignments they are able to manage. Members with the Organization owner role assigned are able to see the role assignments of every member of their organization.

Members with the Admin role assigned are able to see role assignments for deployments within their scope. For example, Admins of all deployments are able to see role assignments scoped to all and specific deployments in the organization, while Admins of specific deployments only see role assignments scoped to those specific deployments. This ensures that members assigned to specific deployments do not try to remove role assignments from other members, and that the existence of other deployments are not revealed to these members.