[Cloud Asset Inventory] Add extra resource fields #1 by kubasobon · Pull Request #6991 · elastic/cloudbeat

kubasobon · 2026-06-26T12:28:14Z

Summary

Follow-up to InfoSec's review of #6991. Adds the remaining EC2 and ELB
fields InfoSec needs to retire their custom AWS CLI scripts for the FedRAMP
asset inventory. All new fields land in entity.attributes.* (non-ECS,
UpperCamelCase) — no ECS mapping change required.

Tracking: https://github.com/elastic/security-team/issues/17750

Changes

EC2 (entity.attributes):

ImageId, Platform, VpcId, SubnetId, State, RoleArn
Owner, CostCenter — resolved case-insensitively from instance tags

ELB v1 + v2 (entity.attributes):

LoadBalancerType — v2 reports the real type; v1 reports classic
AccountID
State — v2 only (State.Code); classic ELB exposes no state field
IPAddresses — NLB static IPs; ALB/classic are DNS-only (empty)
OwnerTag — required adding DescribeTags to both ELB Client
interfaces and providers (batched to the 20-item AWS limit)

Notes

No elastic/integrations change: entity.attributes is flattened, so
new keys need no mapping and there's no migration.
No new asset classifications, so ASSETS.md is unchanged. Route53 and
EKS (also requested in the review) are separate follow-up PRs.
Mocks regenerated; unit tests cover EC2 attributes and the ELB
Type/State/IPAddresses/OwnerTag flow end-to-end.

- gci: align map key spacing in fetcher_elb.go - prealloc: preallocate routes slice in rds/provider.go - revive: remove trailing empty line in azurefetcher groups loop - revive: add default case to type switch in fetcher_resource_graph.go Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Follow-up to InfoSec review of the missing-AWS-fields PR. Surfaces additional EC2 and ELB fields into entity.attributes (non-ECS, UpperCamelCase) so the Asset Discovery integration can replace the custom AWS CLI scripts. EC2: - ImageId, Platform, VpcId, SubnetId, State, RoleArn from the instance - Owner, CostCenter looked up case-insensitively from tags ELB v1 + v2: - LoadBalancerType (v2 real type; v1 "classic"), AccountID - State (v2 only; classic ELB has no state field) - IPAddresses (NLB static IPs; ALB/classic are DNS-only) - OwnerTag via new DescribeTags plumbing on both providers

romulets

Biggest question is about the lifecycle event which we don't extract

romulets · 2026-07-06T13:28:07Z

+	}
+	if i.IamInstanceProfile != nil {
+		if v := pointers.Deref(i.IamInstanceProfile.Arn); v != "" {
+			attrs["RoleArn"] = v


Is IamInstanceProfile.Arn directly understandable from a ec2 instance attributes.RoleArn? Isn't it better perhaps to be more explicit on the naming?

Just asking, I'm ok with your call.

IamInstanceProfile.Arn is a not strictly a Role ARN, according to AWS docs - it's a Identity Profile attached to the EC2 (which contains the role).

romulets · 2026-07-06T13:52:41Z


+// Lifecycle holds non-ECS lifecycle timestamps for an asset (non-ECS fields use UpperCamelCase).
+type Lifecycle struct {
+	CreatedAt *time.Time `json:"CreatedAt,omitempty"`


https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/entity_store/common/domain/definitions/common_fields.ts#L140-L156

This field is not extracted. If we extract, I'm not sure we should have it capitalised, it doesn't follow the other fields

Yes, I'm aware. It's an untracked non-ECS, but I'm adding it to the integration on InfoSec's ask. It's not entity's creation date, but the resource's.

romulets · 2026-07-06T13:54:18Z

+// timestamp. Values may arrive as time.Time (from typed SDK providers) or as RFC3339 strings
+// (from the Resource Graph JSON response). Returns nil when no creation time is found.
+func extractAzureCreatedAt(properties map[string]any) *time.Time {
+	for _, key := range []string{"createdTime", "timeCreated", "creationTime", "creationDate"} {


this is interesting lol. I won't challenge because I know how azure is, but not super ideal haha

Well, that's just Azure being Azure 😅

romulets · 2026-07-06T13:56:32Z

 		if err != nil {
 			p.log.Errorf("Could not get route table for subnet %s of DB %s. Error: %v", *subnet.SubnetIdentifier, *dbInstance.DBInstanceIdentifier, err)
 		} else {
 			routes := make([]Route, 0, len(routeTableForSubnet.Routes))


memory thanks you

mergify · 2026-07-06T15:59:53Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

…elastic#7183) ## Summary Follow-up to InfoSec's review of elastic#6991: adds two AWS asset types the FedRAMP inventory needs but cloudbeat didn't emit — **Route53 DNS records** and **EKS clusters**. Both are greenfield providers + fetchers. All resource-specific fields land in `entity.attributes.*` (non-ECS, flattened), so no integration mapping change is required. Tracking: elastic/security-team#17750 Merge after: elastic#6991 ## Route53 (`awslib/route53`) - New global provider (`ListHostedZones` → `ListResourceRecordSets`, paginated); one asset per record set, carrying its parent zone. - `entity.attributes`: `Type`, `ResourceRecords`, `Weight`, `Region`, `ZoneID`, `ZoneName`, `AliasTargetDNS`, `AliasTargetZoneId`, `HealthCheckId`. - Classification: `{Infrastructure, "AWS Route53 DNS Record"}`. Region reported as `global`. Records have no creation time in the SDK, so no `CreatedAt`. ## EKS (`awslib/eks`) - New regional provider (`ListClusters` → `DescribeCluster` per cluster); one asset per cluster. - `entity.attributes`: `Status`, `Version`, `Endpoint`, `RoleArn`, `PlatformVersion`, `EndpointPublicAccess`, `EndpointPrivateAccess`, `OwnerTag`; plus `entity.lifecycle.CreatedAt`. - Classification: `{Orchestrator, "AWS EKS Cluster"}` (consistent with GCP GKE). ## Notes - **Dependency bump:** adding the EKS SDK pulled a core bump — `aws-sdk-go-v2` 1.41.1→1.42.1, `smithy-go` 1.24.0→1.27.3, and two indirect internal modules. Whole repo builds and tests pass. - **ASSETS.md / spreadsheet:** regenerated (AWS coverage 21→23/85). The `cloud_assets.xlsx` "EKS Cluster" row was moved from Infrastructure to Orchestrator to match the classification (and GKE); the Route53 and EKS "Updated Type" cells were filled so the generator marks them implemented. - **No `elastic/integrations` change:** `entity.attributes` is flattened (arbitrary keys) and `entity.lifecycle.CreatedAt` + `entity.type`/`sub_type` are already mapped by the 1.7.0 PR (#19795). --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

asset_inventory: additional detail

fa4c500

kubasobon requested a review from a team as a code owner June 26, 2026 12:28

kubasobon mentioned this pull request Jun 26, 2026

[Cloud Asset Inventory] Support additional AWS fields and Route53/EKS asset types elastic/integrations#19795

Merged

mergify Bot assigned kubasobon Jun 26, 2026

This comment was marked as resolved.

Sign in to view

kubasobon added the backport-v9.4.0 label Jun 26, 2026

kubasobon and others added 3 commits June 26, 2026 17:12

just: re-generate mocks

96e14ae

kubasobon changed the title ~~[Cloud Asset Inventory] Add extra resource fields~~ Jul 3, 2026

This was referenced Jul 3, 2026

[Cloud Asset Inventory] Add extra resource fields #2 #7182

Closed

[Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53) #7183

Merged

romulets reviewed Jul 6, 2026

View reviewed changes

kubasobon added 2 commits July 6, 2026 16:31

fix: plug CreatedAt gaps in AWS

7015a70

fix: extract common function to helpers

3fc6b9e

kubasobon requested a review from romulets July 6, 2026 15:00

kubasobon added 2 commits July 6, 2026 17:17

fix: resolve RoleARN from ProfileInstance

9df70bc

fix: move CreatedAt to attributes

898aa5d

romulets approved these changes Jul 6, 2026

View reviewed changes

kubasobon added this pull request to the merge queue Jul 6, 2026

Merged via the queue into elastic:main with commit a25d3cb Jul 6, 2026
12 checks passed

kubasobon deleted the asset-discovery/missing-aws-fields branch July 6, 2026 16:46

mergify Bot mentioned this pull request Jul 6, 2026

[9.4](backport #6991) [Cloud Asset Inventory] Add extra resource fields #1 #7187

Closed

mergify Bot mentioned this pull request Jul 7, 2026

[9.4](backport #7183) [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53) #7236

Closed

Navigation Menu

Uh oh!

[Cloud Asset Inventory] Add extra resource fields #1 - #6991

[Cloud Asset Inventory] Add extra resource fields #1#6991
kubasobon merged 8 commits into
elastic:mainfrom
kubasobon:asset-discovery/missing-aws-fields

kubasobon commented Jun 26, 2026 •

edited

Loading

This comment was marked as resolved.

romulets left a comment

romulets Jul 6, 2026

kubasobon Jul 6, 2026 •

edited

Loading

romulets Jul 6, 2026

kubasobon Jul 6, 2026

romulets Jul 6, 2026

kubasobon Jul 6, 2026

Uh oh!

romulets Jul 6, 2026

mergify Bot commented Jul 6, 2026

Uh oh!

Labels

2 participants

Uh oh!

Conversation

kubasobon commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Notes

This comment was marked as resolved.

romulets left a comment

Choose a reason for hiding this comment

romulets Jul 6, 2026

Choose a reason for hiding this comment

kubasobon Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

romulets Jul 6, 2026

Choose a reason for hiding this comment

kubasobon Jul 6, 2026

Choose a reason for hiding this comment

romulets Jul 6, 2026

Choose a reason for hiding this comment

kubasobon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

romulets Jul 6, 2026

Choose a reason for hiding this comment

mergify Bot commented Jul 6, 2026

Uh oh!

Labels

2 participants

kubasobon commented Jun 26, 2026 •

edited

Loading

kubasobon Jul 6, 2026 •

edited

Loading