[Crowdstrike] Mask AWS access_key_id policy variable as secret

[moxarth-rathod]

Proposed commit message

  crowdstrike: Mask FDR access_key_id as a secret policy variable.

  Mask the FDR aws-s3 `access_key_id` policy variable as secret by changing
  `type` from `text` to `password` and `secret` from `false` to `true`, so AWS
  access key IDs are masked in Fleet like `secret_access_key` and
  `session_token`.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

• Closes crowdstrike: Mask AWS access_key_id policy variables as secret #20571

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[vera-review-bot]

Severity: 🟡 Medium confidence: high path: packages/crowdstrike/changelog.yml:6

The changelog link for 4.7.0 points to elastic/integrations#​1, an unrelated PR placeholder; update it to this PR (#​20615) so the entry is traceable.

Details

The new 4.7.0 entry links to #1 instead of the PR that introduces the change. elastic-package lint only rejects a non-positive number (pull/0), so this passes validation and would ship a changelog entry pointing at an unrelated 2020-era PR. Every other entry in this file (e.g. 4.6.0 -> pull/20241) links to its own PR.

Recommendation:

Point the link at this PR (20615) so the released changelog is traceable to the change that made access_key_id a secret. Use pull/99999 only as a temporary development placeholder, never a low real PR number.

Suggested change

	link: https://github.com/elastic/integrations/pull/1
	link: https://github.com/elastic/integrations/pull/20615

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Please add a policy test to cover this.

[vera-review-bot]

🟢 No issues across the latest commits 0b926c6.

Review summary

Issues found across earlier commits 7de5ec1 — 1 medium

• 🟡 The changelog link for 4.7.0 points to elastic/integrations#​1, an unrelated PR placeholder (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 0b926c6

History

• 💔 Build #47482 failed 7de5ec1

cc @moxarth-rathod

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package crowdstrike - 4.7.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/4.7.0/