[Cloud Security] Fix for Deprecated error message

[animehart]

This PR is to address Deprecated error message that pops out on Kibana logs
The error/warning message is the following:

Elasticsearch deprecation: 299 Elasticsearch-98a36b3b3ec96c544f06a986349e42dcad88a232 \"the index privilege [index] allowed the update mapping action [indices:admin/mapping/auto_put] on index [logs-cloud_security_posture.scores-default], this privilege will not permit mapping updates in the next major release - users who require access to update mappings must be granted explicit privileges

the fix involves adding privileges to the affected index
more details of this is in this ticket and it will also resolve that ticket

[animehart]

/ci

[jeramysoucy]

@animehart Just want to clarify my understanding. The auto_put mapping privilege is being added because in v9.0, it will no longer be implicitly included/allowed with just the index privilege. And the auto_put mapping privilege is needed here to be able to update existing index templates when these ("logs-cloud_security_posture.findings_latest-default*", "logs-cloud_security_posture.scores-default*", "logs-cloud_security_posture.vulnerabilities_latest-default*") indices are created. Is that correct?

[animehart]

Hi, per my understanding based on the discussion here, yes

This solution was firstly suggested by @maxcold , lemme know if I miss anything

[maxcold]

Yes, this is correct. However, we only experience the deprecation warning with logs-cloud_security_posture.scores-default*, so it might be a good idea to add auto_put only to this index pattern.

[jeramysoucy]

we only experience the deprecation warning with logs-cloud_security_posture.scores-default*, so it might be a good idea to add auto_put only to this index pattern

++ on this
If we can limit where the additional privilege is granted then we should.