Configure privileges for cross-cluster replication

Configure privileges for cross-cluster replication

The cross-cluster replication user requires different cluster and index privileges on the remote cluster and local cluster. Use the following requests to create separate roles on the local and remote clusters, and then create a user with the required roles.

Remote cluster

On the remote cluster that contains the leader index, the cross-cluster replication role requires the read_ccr cluster privilege, and monitor and read privileges on the leader index.

If requests are authenticated with an API key, the API key requires the above privileges on the local cluster, instead of the remote.

If requests are issued on behalf of other users, then the authenticating user must have the run_as privilege on the remote cluster.

The following request creates a remote-replication role on the remote cluster:

  1. resp = client.security.put_role(
  2.     name="remote-replication",
  3.     cluster=[
  4.         "read_ccr"
  5.     ],
  6.     indices=[
  7.         {
  8.             "names": [
  9.                 "leader-index-name"
  10.             ],
  11.             "privileges": [
  12.                 "monitor",
  13.                 "read"
  14.             ]
  15.         }
  16.     ],
  17. )
  18. print(resp)
  1. const response = await client.security.putRole({
  2.   name: "remote-replication",
  3.   cluster: ["read_ccr"],
  4.   indices: [
  5.     {
  6.       names: ["leader-index-name"],
  7.       privileges: ["monitor", "read"],
  8.     },
  9.   ],
  10. });
  11. console.log(response);
  1. POST /_security/role/remote-replication
  2. {
  3.   "cluster": [
  4.     "read_ccr"
  5.   ],
  6.   "indices": [
  7.     {
  8.       "names": [
  9.         "leader-index-name"
  10.       ],
  11.       "privileges": [
  12.         "monitor",
  13.         "read"
  14.       ]
  15.     }
  16.   ]
  17. }

Local cluster

On the local cluster that contains the follower index, the remote-replication role requires the manage_ccr cluster privilege, and monitor, read, write, and manage_follow_index privileges on the follower index.

The following request creates a remote-replication role on the local cluster:

  1. resp = client.security.put_role(
  2.     name="remote-replication",
  3.     cluster=[
  4.         "manage_ccr"
  5.     ],
  6.     indices=[
  7.         {
  8.             "names": [
  9.                 "follower-index-name"
  10.             ],
  11.             "privileges": [
  12.                 "monitor",
  13.                 "read",
  14.                 "write",
  15.                 "manage_follow_index"
  16.             ]
  17.         }
  18.     ],
  19. )
  20. print(resp)
  1. const response = await client.security.putRole({
  2.   name: "remote-replication",
  3.   cluster: ["manage_ccr"],
  4.   indices: [
  5.     {
  6.       names: ["follower-index-name"],
  7.       privileges: ["monitor", "read", "write", "manage_follow_index"],
  8.     },
  9.   ],
  10. });
  11. console.log(response);
  1. POST /_security/role/remote-replication
  2. {
  3.   "cluster": [
  4.     "manage_ccr"
  5.   ],
  6.   "indices": [
  7.     {
  8.       "names": [
  9.         "follower-index-name"
  10.       ],
  11.       "privileges": [
  12.         "monitor",
  13.         "read",
  14.         "write",
  15.         "manage_follow_index"
  16.       ]
  17.     }
  18.   ]
  19. }

After creating the remote-replication role on each cluster, use the create or update users API to create a user on the local cluster cluster and assign the remote-replication role. For example, the following request assigns the remote-replication role to a user named cross-cluster-user:

  1. resp = client.security.put_user(
  2.     username="cross-cluster-user",
  3.     password="l0ng-r4nd0m-p@ssw0rd",
  4.     roles=[
  5.         "remote-replication"
  6.     ],
  7. )
  8. print(resp)
  1. const response = await client.security.putUser({
  2.   username: "cross-cluster-user",
  3.   password: "l0ng-r4nd0m-p@ssw0rd",
  4.   roles: ["remote-replication"],
  5. });
  6. console.log(response);
  1. POST /_security/user/cross-cluster-user
  2. {
  3.   "password" : "l0ng-r4nd0m-p@ssw0rd",
  4.   "roles" : [ "remote-replication" ]
  5. }

You only need to create this user on the local cluster.