Elasticsearch Version

main

Installed Plugins

No response

Java Version

bundled

OS Version

Darwin Kernel Version 21.6.0

Problem Description

When the user configures remote index in their transform but does not have permissions to access it, _preview request will fail with error message: "Source indices have been deleted or closed.".
However, such a transform can be created via PUT and started via _start. It should not be possible.

Reported by @yangwan

Steps to Reproduce

1. Configure a transform that accesses remote index.
2. Set up permissions so that the user cannot access the remote index.
3. Run GET _transform/_preview
4. Run PUT _transform/my-transform with the same config
5. Observe the difference between steps 3. and 4.

Logs (if relevant)

No response