Skip to content

[aws/config]: Skip service-linked rules and tolerate per-rule errors - #19803

Merged
ShourieG merged 2 commits into
elastic:mainfrom
ShourieG:bugfix/aws_7309
Jun 26, 2026
Merged

[aws/config]: Skip service-linked rules and tolerate per-rule errors#19803
ShourieG merged 2 commits into
elastic:mainfrom
ShourieG:bugfix/aws_7309

Conversation

@ShourieG

@ShourieG ShourieG commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Type of change

  • Bug

Proposed commit message

aws/config: skip service-linked rules and tolerate per-rule errors

The AWS Config data stream listed every Config rule and then called
GetComplianceDetailsByConfigRule for each one. AWS owns service-linked
rules and blocks that call for them with an AccessDeniedException, which
aborted the whole collection cycle and degraded the input so no rules
were ingested.

Filter out service-linked rules in the DescribeConfigRules response by
dropping any rule with a populated CreatedBy field, which AWS sets only
for service-linked rules, so the blocked call is never attempted. As a
defence-in-depth measure, treat a per-rule GetComplianceDetailsByConfigRule
failure as non-fatal: emit the error as an advancing event and continue
with the remaining rules instead of stopping the cycle. Thread the
resource url through every output state branch so the program stays
self-contained across evaluations.

Add a service-linked rule and a matching AccessDeniedException fixture to
the system-test mock to confirm the rule is filtered and never queried,
and bump the package to 6.20.2.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@ShourieG
aws/config: skip service-linked rules and tolerate per-rule errors
0c4dfa4 
The AWS Config data stream listed every Config rule and then called
GetComplianceDetailsByConfigRule for each one. AWS owns service-linked
rules and blocks that call for them with an AccessDeniedException, which
aborted the whole collection cycle and degraded the input so no rules
were ingested.

Filter out service-linked rules in the DescribeConfigRules response by
dropping any rule with a populated CreatedBy field, which AWS sets only
for service-linked rules, so the blocked call is never attempted. As a
defence-in-depth measure, treat a per-rule GetComplianceDetailsByConfigRule
failure as non-fatal: emit the error as an advancing event and continue
with the remaining rules instead of stopping the cycle. Thread the
resource url through every output state branch so the program stays
self-contained across evaluations.

Add a service-linked rule and a matching AccessDeniedException fixture to
the system-test mock to confirm the rule is filtered and never queried,
and bump the package to 6.20.2.
@ShourieG ShourieG self-assigned this Jun 26, 2026
@ShourieG ShourieG added Integration:aws AWS bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jun 26, 2026
@ShourieG
ShourieG marked this pull request as ready for review June 26, 2026 15:45
@ShourieG
ShourieG requested review from a team as code owners June 26, 2026 15:45
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jun 26, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@github-actions

github-actions Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.
@vera-review-bot

vera-review-bot Bot commented Jun 26, 2026

Copy link
Copy Markdown

👀 I have started reviewing the PR
@vera-review-bot

vera-review-bot Bot commented Jun 26, 2026

Copy link
Copy Markdown

Vera Review Bot

For the current commit state, I did not find any issues.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.
kcreddy
kcreddy approved these changes Jun 26, 2026
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Comment thread packages/aws/data_stream/config/agent/stream/cel.yml.hbs
Comment on lines +195 to +196
// ("An AWS service owns ServiceLinkedConfigRule"). They are identified by a
// populated CreatedBy field, which AWS sets only for service-linked rules.

@kcreddy kcreddy Jun 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They are identified by a
// populated CreatedBy field, which AWS sets only for service-linked rules.

It would be nice to add a documentation link to confirm this. Not a blocker though.

@ShourieG ShourieG Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will add it as a follow-up PR as doing it here would trigger another 2.5 hr wait for the aws tests.

@ShourieG ShourieG Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just as a ref: It's in this doc here
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jun 26, 2026

Copy link
Copy Markdown

💚 Build Succeeded

cc @ShourieG
@mergify

mergify Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request
@ShourieG
ShourieG merged commit 5fa62a7 into elastic:main Jun 26, 2026
12 checks passed
@ShourieG
ShourieG deleted the bugfix/aws_7309 branch June 26, 2026 18:13
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Package aws - 6.20.2 containing this change is available at https://epr.elastic.co/package/aws/6.20.2/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@ShourieG @narph @kcreddy