Skip to content

[Synthetics] Add global params privileges #4966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mdbirnstiehl merged 2 commits into from
Jan 6, 2026
Merged

[Synthetics] Add global params privileges #4966

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b19a3b0
[Synthetics] Add global params privileges
mdbirnstiehl Dec 29, 2025
53c6534
Update docs/en/observability/synthetics-params-secrets.asciidoc
mdbirnstiehl Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions docs/en/observability/synthetics-params-secrets.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,24 @@ In the {synthetics-app}:
[role="screenshot"]
image::images/synthetics-params-secrets-kibana-define.png[Global parameters tab on the Synthetics Settings page in {kib}]

[discrete]
[[synthetics-view-global-params]]
== Allow users to view global parameter values

By default, custom user roles do not have access to global parameter values. Administrators can grant read access to global parameters by adding the Synthetics *Can read global parameter values* {kib} sub-feature privilege to a role.
When added, users can view a global parameter value using the https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-parameters[*Get parameters*] API or by selecting the *show data* icon.

To add the *Can read global parameter values* {kib} privilege to a role:

. Go to the **Roles** management page in the navigation menu or use the global search field.
. Edit an existing role or select *Create role*.
. From the *Kibana* section, select *Add Kibana privilege*.
. Expand `Synthetics and Uptime` in the list of {kib} privileges.
. Turn on *Customize sub-feature privileges*.
. Turn on *Can read global parameter values*.

Refer to {cloud}/ec-user-privileges.html[User roles and privileges] for more on creating custom roles.

[discrete]
[[synthetics-dynamic-configs]]
== Project config file
Expand Down Expand Up @@ -150,8 +168,7 @@ Your synthetics scripts may require the use of passwords or other sensitive secr

[WARNING]
====
Params are viewable in plain-text by administrators and other users with `all` privileges for
the Synthetics app.
Params are viewable in plain-text by administrators and users with the *Can read global parameter values*.
Also note that synthetics scripts have no limitations on accessing these values, and a malicious script author could write a
synthetics journey that exfiltrates `params` and other data at runtime.
Do *not* to use truly sensitive passwords (for example, an admin password or a real credit card)
Expand Down