[aws] Enable Identity Federation on all agentless policy templates#20302
Open
seanrathier wants to merge 2 commits into
Open
[aws] Enable Identity Federation on all agentless policy templates#20302seanrathier wants to merge 2 commits into
seanrathier wants to merge 2 commits into
Conversation
Remove the hide_in_var_group_options credential_type gates from all 23 agentless inputs and point iac_template_url at the new federated-identity-aws CloudFormation template (cloudbeat#7422), which unconditionally grants the read-only permissions required by every agentless-enabled AWS integration. Users deploy one stack and paste the Role ARN + External ID back into Kibana regardless of which integrations they select. Bumps the package to 7.1.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
seanrathier
force-pushed
the
aws/federated-identity-all-agentless
branch
from
July 22, 2026 20:30
89d00a4 to
cc6f9da
Compare
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
seanrathier
marked this pull request as draft
July 22, 2026 20:41
seanrathier
marked this pull request as ready for review
July 22, 2026 20:41
andrewkroh
added
Integration:aws
Remove hand-rolled SigV4 transforms (X-Amz-Date header, Authorization header, pagination re-signing) from inspector, securityhub_findings, securityhub_findings_full_posture, and securityhub_insights httpjson streams. Add auth.aws block (matching the guardduty pattern from elastic#19828) so the agent handles AWS auth natively and use_cloud_connectors works. Revert identity federation enablement on aws.config: the CEL program implements SigV4 inline and explicitly rejects non-key credentials; cloud connectors cannot inject temporary creds as template variables, so the option would silently fail at runtime. Restore hide_in_var_group_options until the CEL program is rewritten. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
✅ All changelog entries have the correct PR link. |
Contributor
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
History
cc @seanrathier |
andrewkroh
added
the
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Contributor
|
@vera-review-bot review The earlier review attempt on this PR failed with a gateway authentication error during an LLM credential rotation on our side — nothing to do with the changes here. The new credential is in place, so re-triggering the initial review. Comment posted with 🤖 Cursor/Claude Opus 5 under my supervision. |
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Remove the
hide_in_var_group_options: credential_type: [identity_federation]gates from all 23 agentless inputs and pointiac_template_urlat the newfederated-identity-awsCloudFormation template (elastic/cloudbeat#7422), which unconditionally grants the read-only permissions required by every agentless-enabled AWS integration. Users deploy one stack and paste the Role ARN + External ID back into Kibana regardless of which integrations they select. Bumps the package to 7.1.0.Background
Part of https://github.com/elastic/ingest-dev/issues/8887.
When var_groups landed in 7.0.0 (#19828), the Identity Federation setup access option was hidden on every agentless input except GuardDuty's API input, because the published CloudFormation template (
cloud-connectors-guardduty-9.4.0.yml) only granted GuardDuty permissions.elastic/cloudbeat#7422 adds
federated-identity-aws.yml: a single static template whose read-only role covers all agentless-enabled AWS policy templates (transport, metrics, security findings, and per-service inventory permissions). With that template as the quick-create target, the gates are no longer needed — Identity Federation becomes selectable on awshealth, billing, cloudwatch, config, dynamodb, ebs, ec2, ecs, elb, lambda, rds, s3, sns, sqs, transitgateway, securityhub, inspector, and guardduty.No Kibana changes are required: the existing var_group
iac_template_url→ quick-create URL flow handles the new template as-is.Depends on elastic/cloudbeat#7422 merging and the template being published to
s3://elastic-cspm-cft/before this ships.Checklist
changelog.ymlfile.🤖 Generated with Claude Code