How to fix AccessDeniedException: action [cluster:admin/settings/update] is unauthorized in Elasticsearch

ElasticsearchINTERMEDIATEHIGHUpdated Dec 29, 2025· 100 views

This error occurs when a user lacks the required cluster-level permissions to modify Elasticsearch cluster settings. The error indicates that the user's role does not have the cluster:admin/settings/update privilege, which is needed to change dynamic cluster settings like monitoring configuration or transient settings.

Quick fix

Fixes AccessDeniedException: action [cluster:admin/settings/update] is unauthorized

GET /_security/user/{username}
  1. Identify the user's current roles
  2. Grant cluster:admin/settings/update privilege
  3. Verify the monitoring setup (if monitoring is the goal)
  4. For ILM policy failures, ensure index-level permissions
elasticsearch — error
GET /_security/user/{username}
AccessDeniedException: action [cluster:admin/settings/update] is unauthorized

What this error means

Elasticsearch has role-based access control (RBAC) that restricts which users can perform cluster-level administrative operations. The cluster:admin/settings/update action is a privileged operation that allows users to modify dynamic cluster settings. When a user without this permission attempts to change cluster settings (for example, enabling monitoring or adjusting transient settings), Elasticsearch throws an AccessDeniedException. This is a security feature designed to prevent unauthorized configuration changes.

Typical symptoms

  • Unable to enable monitoring collection via Kibana UI (shows 403 Forbidden error)
  • Cluster settings API calls fail with AccessDeniedException
  • Index Lifecycle Management (ILM) policies fail during rollover or update operations
  • System indices (like .kibana, .apm) cannot have their settings modified
  • Transient cluster settings cannot be updated by non-admin users

Common causes

  1. User role is missing the cluster:admin/settings/update privilege
  2. Built-in roles like remote_monitoring_user or kibana_monitoring do not include cluster settings update permissions
  3. System indices have restricted permissions that prevent even superusers from modifying certain settings without explicit privileges
  4. Custom role was created without including the necessary cluster admin privileges
  5. Attempting to perform administrative operations with a read-only or monitoring-only role

How to fix "AccessDeniedException: action [cluster:admin/settings/update] is unauthorized"

1Identify the user's current roles

First, determine which user is encountering the error and what roles they are assigned. You can check this in Kibana:

1. Go to Management > Stack Management > Security > Users
2. Click on the user experiencing the error
3. Note the roles listed in the Roles section

Alternatively, use the Elasticsearch API:

bash
GET /_security/user/{username}
2Grant cluster:admin/settings/update privilege

Add the cluster:admin/settings/update privilege to the user's role. In Kibana:

1. Go to Management > Stack Management > Security > Roles
2. Click on the role assigned to the user
3. Under Cluster privileges, add cluster:admin/settings/update
4. Save the role

Or use the Elasticsearch API to create or update a role:

bash
POST /_security/role/custom_admin_role
{
  "cluster": ["cluster:admin/settings/update", "cluster:monitor"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["manage", "read", "write"]
    }
  ]
}
3Verify the monitoring setup (if monitoring is the goal)

If this error occurred while enabling monitoring, ensure the user has both cluster:admin/settings/update and the ability to manage monitoring. Create a monitoring role with:

bash
POST /_security/role/monitoring_admin
{
  "cluster": [
    "cluster:admin/settings/update",
    "cluster:monitor",
    "cluster:manage/logstash/pipeline/get"
  ],
  "indices": [
    {
      "names": [".monitoring-*"],
      "privileges": ["manage", "read", "write"]
    }
  ]
}
4For ILM policy failures, ensure index-level permissions

If the error occurs during ILM policy rollover or updates, the user needs both cluster and index-level permissions:

bash
POST /_security/role/ilm_admin
{
  "cluster": ["manage_ilm", "cluster:admin/settings/update"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["manage", "manage_ilm"]
    }
  ]
}
5Test the fix

After updating the role, verify that the user can now perform the operation. Test by:

1. Logging out and back in as the affected user
2. Attempting the operation that previously failed
3. Checking Kibana > Stack Management > Monitoring to confirm monitoring is now enabled (if applicable)
4. Running a cluster settings API call:

bash
GET /_cluster/settings
PUT /_cluster/settings
{
  "transient": {
    "xpack.monitoring.collection.enabled": true
  }
}

Advanced notes

System indices (like .kibana, .apm, .monitoring-*) have special restrictions even for users with broad cluster privileges. To modify system index settings, the role must include both the cluster:admin/settings/update privilege and explicit index-level manage permissions on those system indices. Some versions of Elasticsearch require the modify_system_indices cluster privilege in addition to standard admin privileges. When using custom plugins that need to update cluster settings, ensure the service account or user running the plugin has sufficient cluster privileges. For highly restrictive security setups, use attribute-based access control (ABAC) to grant permissions based on specific attributes rather than blanket role assignment.

Frequently asked questions

What does "AccessDeniedException: action [cluster:admin/settings/update] is unaut" mean?
Elasticsearch has role-based access control (RBAC) that restricts which users can perform cluster-level administrative operations. The cluster:admin/settings/update action is a privileged operation that allows users to modify dynamic cluster settings. When a user without this permission attempts to change cluster settings (for example, enabling monitoring or adjusting transient settings), Elasticsearch throws an AccessDeniedException.
How do I fix "AccessDeniedException: action [cluster:admin/settings/update] is unaut"?
This error occurs when a user lacks the required cluster-level permissions to modify Elasticsearch cluster settings. The error indicates that the user's role does not have the cluster:admin/settings/update privilege, which is needed to change dynamic cluster settings like monitoring configuration or transient settings.
What causes "AccessDeniedException: action [cluster:admin/settings/update] is unaut"?
User role is missing the cluster:admin/settings/update privilege Built-in roles like remote_monitoring_user or kibana_monitoring do not include cluster settings update permissions System indices have restricted permissions that prevent even superusers from modifying certain settings without explicit privileges
Is the "AccessDeniedException: action [cluster:admin/settings/update] is unaut" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading