Skip to content

[aws][security_hub_findings] - Fix Security Hub findings date filter - #19101

Merged
ShourieG merged 3 commits into
elastic:mainfrom
ShourieG:aws/security_hub_7155
May 20, 2026
Merged

[aws][security_hub_findings] - Fix Security Hub findings date filter#19101
ShourieG merged 3 commits into
elastic:mainfrom
ShourieG:aws/security_hub_7155

Conversation

@ShourieG

@ShourieG ShourieG commented May 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Type of change

  • Bug

Proposed commit message

aws: fix Security Hub findings date filter

Restore a stable UpdatedAt end bound for Security Hub findings
requests. AWS rejects DateFilter entries with Start alone, while a
static far-future End preserves a stable request body across pagination
and avoids reintroducing NextToken invalidation from dynamic now values.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@ShourieG
aws: fix Security Hub findings date filter
ab3c242 
Restore a stable UpdatedAt end bound for Security Hub findings
requests. AWS rejects DateFilter entries with Start alone, while a
static far-future End preserves a stable request body across pagination
and avoids reintroducing NextToken invalidation from dynamic now values.
@ShourieG ShourieG self-assigned this May 20, 2026
@ShourieG
ShourieG requested review from a team as code owners May 20, 2026 14:00
@ShourieG ShourieG added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:aws_securityhub AWS Security Hub Team:security-siem-conduit Security SIEM Conduit team [ Previously Security Data Experience - Cloud Services team ] labels May 20, 2026
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented May 20, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
kcreddy
kcreddy approved these changes May 20, 2026
View reviewed changes

@kcreddy kcreddy left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after merge conflicts are fixed. A similar change must be verified if required for Inspector and Guardduty: as the regression got introduced in #18830
@github-actions

github-actions Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

TL;DR

Buildkite failed before running test steps because the PR branch could not be merged with main during checkout. Resolve merge conflicts in packages/aws/changelog.yml and packages/aws/manifest.yml, then re-run CI.

Remediation

  • Rebase/merge main into ShourieG:aws/security_hub_7155 and resolve both conflicts:
    • Keep the new changelog entry for 6.17.1 at the top of packages/aws/changelog.yml.
    • Keep version: 6.17.1 in packages/aws/manifest.yml.
  • Push the resolved branch and re-run Buildkite to confirm the pipeline upload step proceeds.
Investigation details

Root Cause

This is a configuration/integration merge conflict during repository checkout, not a failing test.

Buildkite’s post-checkout hook attempts to merge PR head into main and fails with conflicts in:

  • packages/aws/changelog.yml (top-of-file version block, around lines 1-7)
  • packages/aws/manifest.yml (package version line, around lines 1-5)

The PR introduces:

  • packages/aws/changelog.yml new 6.17.1 entry at the top
  • packages/aws/manifest.yml version bump 6.17.0 -> 6.17.1

Those same areas were touched on main, producing an auto-merge conflict in CI checkout.

Evidence

  • Build: https://buildkite.com/elastic/integrations/builds/43161
  • Job/step: :pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml
  • Key log excerpt:
    • CONFLICT (content): Merge conflict in packages/aws/changelog.yml
    • CONFLICT (content): Merge conflict in packages/aws/manifest.yml
    • Automatic merge failed; fix conflicts and then commit the result.

Verification

  • Not run locally; failure occurs before test/build stages in checkout/merge hook.

Follow-up

After resolving conflicts, a fresh Buildkite run should validate whether any downstream checks need attention.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
@ShourieG
ShourieG enabled auto-merge (squash) May 20, 2026 15:08
@andrewkroh andrewkroh added Integration:aws AWS and removed Integration:aws_securityhub AWS Security Hub labels May 20, 2026
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package aws 👍(14) 💚(3) 💔(5)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
route53_resolver_logs 7462.69 5405.41 -2057.28 (-27.57%) 💔
s3access 5102.04 4329 -773.04 (-15.15%) 💔
waf 10309.28 7575.76 -2733.52 (-26.52%) 💔
config 6289.31 3891.05 -2398.26 (-38.13%) 💔
ec2_logs 66666.67 38461.54 -28205.13 (-42.31%) 💔

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented May 20, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @ShourieG
@ShourieG
ShourieG merged commit 6f3b899 into elastic:main May 20, 2026
8 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

Package aws - 6.17.1 containing this change is available at https://epr.elastic.co/package/aws/6.17.1/
@ShourieG
ShourieG deleted the aws/security_hub_7155 branch May 20, 2026 18:32
herrBez pushed a commit to herrBez/integrations that referenced this pull request Jun 1, 2026
@ShourieG @herrBez
[aws][security_hub_findings] - Fix Security Hub findings date filter (e…
f1ede6f 
…lastic#19101)

aws: fix Security Hub findings date filter

Restore a stable UpdatedAt end bound for Security Hub findings
requests. AWS rejects DateFilter entries with Start alone, while a
static far-future End preserves a stable request body across pagination
and avoids reintroducing NextToken invalidation from dynamic now values.
@Omolola-Akinleye Omolola-Akinleye mentioned this pull request Jun 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:security-siem-conduit Security SIEM Conduit team [ Previously Security Data Experience - Cloud Services team ]

4 participants

@ShourieG @elasticmachine @kcreddy @andrewkroh