[aws] Add var_groups for credential type selection with Identity Federation - #19828
Conversation
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
🚀 Benchmarks reportTo see the full report comment with |
8863ece to
c616bd9
Compare
This comment has been minimized.
This comment has been minimized.
c616bd9 to
feb0a03
Compare
This comment has been minimized.
This comment has been minimized.
51f64b7 to
9dea76e
Compare
andrewkroh
changed the title
This comment has been minimized.
This comment has been minimized.
7aa1477 to
7710222
Compare
|
The PR's |
7710222 to
8f9dffa
Compare
TL;DR
Remediation
Investigation detailsRoot CauseThis PR introduces an Elastic Agent version condition in With that condition present, Fleet can report a version-suffixed agent policy ID such as The upstream fix changes The PR head also points at this same failure mode in Evidence
The pre-fetched Buildkite log starts at stack teardown/artifact upload, so it does not include the earlier script-test timeout text. The root-cause trace above is based on the PR-head AWS files, the linked VerificationNot run locally; Docker-backed Follow-upIf this remains red after the fixed What is this? | From workflow: PR Buildkite Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
8f9dffa to
b883d62
Compare
…ration Bump format_version to 3.6.0 and version to 7.0.0. Reorganize AWS credential configuration into a `Setup Access` var_groups selector with six options: Identity Federation, Direct Access Keys, Temporary Access Keys, Assume Role, Assume Role with External ID, and Shared Credentials. Key changes: - format_version: 3.4.0 → 3.6.0 - version: 6.20.3 → 7.0.0 - kibana.version: "^8.19.4 || ^9.2.1" → "^9.4.0" - agent.version: "^9.4.0" - var_groups: credential_type selector with 6 options - external_id is now secret: true - New vars: assume_role_duration, assume_role_expiry_window, supports_identity_federation - hide_in_var_group_options for 13 inputs across services that don't support Identity Federation - GuardDuty httpjson stream: switch to auth.aws: block and add Identity Federation policy tests - Add conditions.agent.version: ^9.4.0 because guardduty now requires it. Source: elastic#19278 (Omolola-Akinleye/integrations)
73d8d1b to
7d13726
Compare
andrewkroh
added
the
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
![vera-review-bot[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| @@ -1,7 +1,7 @@ | |||
| format_version: 3.4.0 | |||
| format_version: 3.6.0 | |||
There was a problem hiding this comment.
Severity: 🟠 High confidence: medium path: packages/aws/manifest.yml:1
format_version is set to 3.6.0 but the package uses var_groups/hide_in_var_group_options, which package-spec introduced at 3.6.1 — bump format_version to 3.6.1.
Details
This PR adds a root-level var_groups block and hide_in_var_group_options entries on many policy-template inputs. Per the package-spec changelog, var_groups support at policy-template and input levels in integration packages was added in spec 3.6.1 (PR #1120); spec 3.6.0 (issue #1054) only added the base var_groups schema. The spec versioning model requires a package at format_version: x.y.z to validate against the x.y.z spec, so declaring 3.6.0 while relying on 3.6.1-level var_groups support risks an elastic-package check failure against the 3.6.0 spec. The only other integration in this repo that uses var_groups (okta) declares format_version: "3.6.1", and this repo's package-spec feature reference lists var_groups (policy template and input levels) as requiring 3.6.1. (Note: the current head of package-spec's schema only patches var_groups out before 3.6.0, which is why confidence is medium — but the changelog and the okta precedent both point to 3.6.1 as the correct minimum.)
Recommendation:
Declare the minimum spec version that supports the var_groups features used:
format_version: 3.6.1🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
The package uses hide_in_var_group_options on policy-template inputs, which package-spec documents at 3.6.1.
|
No issues across the latest commits 33eb83e. Review summaryIssues found across earlier commits 7d13726 — 1 high
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
|
Tick the box to add this pull request to the merge queue (same as
|
Add hide_in_var_group_options: { credential_type: [identity_federation] }
to the agentless-supported CloudWatch, EBS, EC2, ECS, and S3 metric/log
inputs. Only the GuardDuty API (httpjson) input supports identity
federation, so the others should not be offered when that setup access
option is selected. aws-s3 inputs and non-agentless policy templates are
already hidden in agentless mode, so they don't need the rule.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
✅ All changelog entries have the correct PR link. |
…effects Newer integrations (e.g. the AWS integration in elastic/integrations#19828) renamed the cloud-connector support flag var from `supports_cloud_connectors` to `supports_identity_federation`. The var_group policy effects hardcoded the old name, so selecting/deselecting a cloud-connector option never set the flag for those integrations. Add SUPPORTS_IDENTITY_FEDERATION_VAR_NAME and a findSupportFlagVarName() helper that prefers the new name and falls back to the legacy one (CSPM / Asset Discovery pre-migration). The fallback is tech debt to be removed once elastic/security-team#15405 is complete. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
💚 Build Succeeded
History
|
|
Package aws - 7.0.0 containing this change is available at https://epr.elastic.co/package/aws/7.0.0/ |
Remove hand-rolled SigV4 transforms (X-Amz-Date header, Authorization header, pagination re-signing) from inspector, securityhub_findings, securityhub_findings_full_posture, and securityhub_insights httpjson streams. Add auth.aws block (matching the guardduty pattern from elastic#19828) so the agent handles AWS auth natively and use_cloud_connectors works. Revert identity federation enablement on aws.config: the CEL program implements SigV4 inline and explicitly rejects non-key credentials; cloud connectors cannot inject temporary creds as template variables, so the option would silently fail at runtime. Restore hide_in_var_group_options until the CEL program is rewritten. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
4 participants
Proposed commit message
Summary
This PR carries the var_groups / Identity Federation work from #19278 forward on top of the processor-tags pre-landing from #19824.
What changed
format_versionfrom 3.4.0 to 3.6.1 and packageversionfrom 6.20.3 to 7.0.0.^9.4.0for thevar_groupsUI feature andauth.awsruntime support.credential_typevar_groups selector with Identity Federation, Direct Access Keys, Temporary Access Keys, Assume Role, Assume Role with External ID, and Shared Credentials options.assume_role_duration,assume_role_expiry_window, andsupports_cloud_connectorsvariables.external_idas secret.auth.awsblock.Related
Checklist
changelog.ymlfile.