Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML.
Manage Elasticsearch role-based access control end to end: native users, custom roles, role assignment, role mappings for external realms, and document- and field-level security. The skill is built to translate natural-language access requests, for example create a user with read-only access to logs-*, into discrete, ordered tasks. It first identifies the components (who the user is, what indices or Kibana features are involved, the access level, the scope, whether Kibana is mentioned, and the deployment type), then checks whether an existing role already grants the access before creating anything, derives and creates a role if needed, and finally creates or updates the user. A key decision it encodes is choosing the right API: the Elasticsearch role API (PUT /_security/role/{name}) is the default for roles needing only cluster and indices privileges, while the Kibana role API (PUT /api/security/role/{name}) is required whenever Kibana feature or space privileges are in play, such as Discover, Dashboards, Maps, or Canvas. If the Kibana endpoint is unavailable it can fall back to setting just the cluster and index portion and warn that Kibana privileges were not applied. Native user operations (create, update, change password, enable, disable, get, delete) are covered for self-managed and ECH deployments, with Serverless routed to the companion cloud-access-management skill because its user model differs. For finer control it addresses document-level security to restrict which documents a user sees, field-level security to hide sensitive fields like PII, and attribute-based access control using Mustache-templated role queries, plus role mappings that match SAML, LDAP, or PKI realm attributes to roles. Prerequisites are the Elasticsearch URL, a Kibana URL when setting Kibana privileges, valid credentials, and the manage_security cluster privilege. Authentication methods and API key management are deferred to the companion elasticsearch-authn skill, and detailed endpoints live in the bundled API reference.
Elasticsearch RBAC: native users, custom roles, role assignment, role mappings for external realms, and document- and field-level security.
Use the Elasticsearch API (PUT /_security/role/{name}) for roles with only cluster and indices privileges; use the Kibana role API (PUT /api/security/role/{name}) whenever Kibana feature or space privileges (Discover, Dashboards, Maps, Canvas, and similar) are involved.
manage_security is required for user and role management operations.
Create a role mapping that matches the external realm user's attributes to a role; you can also derive assignments dynamically with Mustache templates.
On Serverless, users are managed at the organization level rather than as native users; use the companion cloud-access-management skill to assign a predefined role or a custom role via the Cloud API.
Quick Setup:
.claude/skills/Repository
elastic/agent-skills