Alerts needs stricter ownership

Issue by oscarkraemer
Thursday Nov 19, 2020 at 10:21 GMT
Originally opened as https://github.com/opendistro-for-elasticsearch/alerting/issues/302

Is your feature request related to a problem? Please describe.
Alerts are hard to managed since the ownership seems to based on all the roles a user belongs to. If a user belongs to many roles then a lot of users will see the alerts that the user creates.

Describe the solution you'd like
Alerts should be owned by tenants and/or alerts should be tightly coupled with a specific role.

Describe alternatives you've considered

• Only allow users that only have one role.
• Not using alerting.

Additional context
Assumes that this is configured: “opendistro.alerting.filter_by_backend_roles": "true”

Our example organisation:
network-admins belongs to network-role
database-admins belongs to database-role
Senior-admins - belongs to network-role and database-role

In this kind of setup senior-admins can’t create an alerts that only network-admins have access, since all alerts senior-admin creates both network-admins and database-admins will have access to.

Start by reviewing how the opendistro.alerting.filter_by_backend_roles setting determines alert visibility and how tenants and backend roles are represented. Compare the senior-admins example with the requested tenant- or role-specific ownership; done means alerts created by a user with multiple roles can be restricted to the intended group.