[Cloud Asset Inventory] Support additional AWS fields and Route53/EKS asset types

[kubasobon]

Support additional AWS fields and new asset types from cloudbeat

What

Updates the cloud_asset_inventory package to cover the additional AWS fields and two new asset types that cloudbeat now emits, as part of the InfoSec FedRAMP field-catalog follow-up (security-team#17750).

All of the new data flows through the existing entity.attributes field, which is mapped as flattened. A flattened field accepts arbitrary new keys without a mapping change, and the new asset types only set entity.type / entity.sub_type (already keyword). No new field mappings are required — this PR only broadens the entity.attributes documentation and bumps the version.

Fields & asset types covered (all under entity.attributes.*)

• EC2: ImageId, Platform, VpcId, SubnetId, State, InstanceProfileArn, RoleArn, plus Owner / CostCenter tags
• ELB: LoadBalancerType, State, IPAddresses, OwnerTag, AccountID (in addition to existing DNSName / PubliclyAccessible)
• RDS: Engine, EngineVersion
• Route53 (new asset type): DNS record Type, ResourceRecords, ZoneID, ZoneName, AliasTargetDNS, HealthCheckId, …
• EKS (new asset type): Status, Version, Endpoint, RoleArn, PlatformVersion, EndpointPublicAccess, EndpointPrivateAccess, …
• All asset types: CreatedAt — a normalized resource-creation timestamp (stored as a keyword under entity.attributes, not a date type)

Corresponding cloudbeat changes

• [Cloud Asset Inventory] Add extra resource fields #1 cloudbeat#6991 — missing EC2/ELB/RDS fields + CreatedAt
• [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53) cloudbeat#7183 — Route53 + EKS asset types

Notes

• Supersedes/consolidates the separate Route53/EKS integrations PR ([Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53) #19963) — everything now lands in a single 1.7.0 bump.
• CreatedAt is a keyword string rather than a date type, since flattened fields store all leaves as keywords. This is an accepted trade-off of keeping it in entity.attributes rather than a dedicated typed field.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[jeniawhite]

Please sync with PR: #20024.
I can see that it didn't merge, maybe we can consider closing it and basing the bump on your PR instead of rebasing?

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[kubasobon]

@jeniawhite Sure. I've rolled #20024 into this PR. PTAL

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 829f415

History

• 💚 Build #45992 succeeded 9bfb4f1
• 💚 Build #45861 succeeded fdd5dab
• 💚 Build #45698 succeeded d99643c
• 💚 Build #45643 succeeded 664ff0a
• 💚 Build #45548 succeeded d601d8d
• 💚 Build #45116 succeeded 07d3ce4

cc @kubasobon

[elastic-vault-github-plugin-prod]

Package cloud_asset_inventory - 1.7.0 containing this change is available at https://epr.elastic.co/package/cloud_asset_inventory/1.7.0/

[elastic-vault-github-plugin-prod]

Package cloud_security_posture - 3.5.0 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.5.0/