[Security Solution] Make savedQueryManagement feature explicit in Serverless

[semd]

Summary

Remove the implicit grant of the savedQueryManagement feature with the Security Solution basic feature (ID: siemV2) in Serverless.

This is a follow-up of #202863

Feature siemV2

This change only affects new roles created with the siemV2 feature, introduced recently here.
This change will align the Roles UI in Serverless and ESS, both requiring the savedQueryManagement feature to be explicitly granted to be able to manage saved queries.

Feature siem

Roles using the deprecated siem feature will still implicitly receive the savedQueryManagement feature (via an implicit grant of discover, dashboard, visualize, and maps) + migration to their *v2 features which include savedQueryManagement. So there's no behavior change for existing roles using the old siem feature (no breaking change).

Screenshots

The siem/siemV2 feature toggle:

The savedQueryManagement feature toggle:

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[SiddharthMantri]

Hi @semd - we've noticed an issue when testing this. cc: @azasypkin @jeramysoucy

• On creating a role that grants feature_siem.all , we would expect to see Saved Query Management granted implicitly for that role and then see that as toggled in the UI. However, this is what we see - Saved Query Management is not granted. ⚠️ Is this expected?
  

• If we create a role granting feature_maps.all, we do however see the Saved Query Management privilege being granted:
  

• On creating a role that grants feature_siemV2.all, we see the UI working as expected, i.e, Saved Query Management is not granted.
  

[semd]

@SiddharthMantri

• On creating a role that grants feature_siem.all , we would expect to see Saved Query Management granted implicitly for that role and then see that as toggled in the UI. However, this is what we see - Saved Query Management is not granted. ⚠️ Is this expected?

Yes, this is expected with the deprecated siem feature, this feature implicitly grants the savedQueryManagement feature. This means that users will have the privileges to go and manage saved queries, even when they do not have the "Saved Query Management" feature explicitly enabled.

This is exactly what we are trying to prevent for siemV2 in this PR, for siem we don't want to change the behavior because that would become a breaking change.

If we create a role granting feature_maps.all, we do however see the Saved Query Management privilege being granted:

This happens because feature_maps.all is replacedBy to maps_v2 + savedQueryManagement via migration (kibana config deprecation), there's no feature override involved.

For the siem feature, on the other hand, the maps is implicitly granted via override:

kibana/config/serverless.security.yml

Lines 64 to 88 in 0e7c608

	siem:
	privileges:
	### Security's `All` feature privilege should implicitly grant `All` access to Discover, Dashboard, Maps, and
	### Visualize features.
	all.composedOf:
	- feature: "discover"
	privileges: [ "all" ]
	- feature: "dashboard"
	privileges: [ "all" ]
	- feature: "visualize"
	privileges: [ "all" ]
	- feature: "maps"
	privileges: [ "all" ]
	# Security's `Read` feature privilege should implicitly grant `Read` access to Discover, Dashboard, Maps, and
	# Visualize features. Additionally, it should implicitly grant privilege to create short URLs in Discover,
	### Dashboard, and Visualize apps.
	read.composedOf:
	- feature: "discover"
	privileges: [ "read" ]
	- feature: "dashboard"
	privileges: [ "read" ]
	- feature: "visualize"
	privileges: [ "read" ]
	- feature: "maps"
	privileges: [ "read" ]

Then maps is converted to maps_v2 + savedQueryManagement, but Roles UI ignores everything granted via override. If you remove the maps_v2.hidden: true you will also see it disabled.
I assume that's the expected behavior because we have the convention to set hidden: true for these features as well. We could discuss that with @azasypkin.

In summary, this feature is causing weird behavior in the Roles UI, as you see, that's what we are trying to fix for the siemV2 feature

[SiddharthMantri]

@semd Thank you for the detailed explanation. I also confirmed with @azasypkin that this is as expected. Everything else looks good to me!

[semd]

The PR also fixes a bug detected by MKI tests here, related to the deprecated siem feature override, the composed features were not properly migrated to v2 after the override. To fix that we directly grant the v2 features + savedQueryManagement instead of the deprecated ones.

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: d3b2e31
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-208911-d3b2e31e2b9b

Failed CI Steps

• Jest Tests #3
• Jest Tests #3

Test Failures

• [job] [logs] Jest Tests #3 / FileDeleteButton isIcon clicking delete button opens the confirmation modal
• [job] [logs] Jest Tests #3 / FileDeleteButton isIcon clicking delete button opens the confirmation modal

Metrics [docs]

✅ unchanged

History

• 💛 Build #272012 was flaky 9b70b4f
• 💔 Build #271923 failed d7df63f

cc @semd

[kibanamachine]

Starting backport for target branches: 8.18, 9.0

https://github.com/elastic/kibana/actions/runs/13075186306

[kibanamachine]

💔 Some backports could not be created

Status	Branch	Result
❌	8.18	Backport failed because of merge conflicts
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 208911

Questions ?

Please refer to the Backport tool documentation