From ec24a13b25573356f142413f04c24db83f069caa Mon Sep 17 00:00:00 2001
From: Sean Rathier <sean.rathier@elastic.co>
Date: Fri, 31 Jul 2026 16:15:53 -0400
Subject: [PATCH] Add aws Config permissions to the Federated Identity template
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirror the AWS Config permission set from the patch files in
elastic/integrations#20240 into the incremental Federated Identity
template: config:DescribeConfigRules and
config:GetComplianceDetailsByConfigRule, the two operations the
Config data stream's CEL program calls (elastic/integrations#20437).

config:DescribeComplianceByConfigRule from the #20240 patch set is
deliberately omitted — the program never calls it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../cloudformation/federated-identity-aws.yml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml
index e30c36812a..f31df1b91e 100644
--- a/deploy/cloudformation/federated-identity-aws.yml
+++ b/deploy/cloudformation/federated-identity-aws.yml
@@ -48,6 +48,26 @@ Resources:
         # from the shipped cloud-connectors-guardduty template.
         - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess
 
+  # aws/config: rule listing and per-rule compliance reads for the AWS
+  # Config data stream. Mirrors the permission set from the patch files in
+  # elastic/integrations#20240, minus config:DescribeComplianceByConfigRule,
+  # which the CEL program never calls (see elastic/integrations#20437).
+  ElasticAwsConfig:
+    Type: AWS::IAM::Policy
+    Properties:
+      PolicyName: ElasticAwsConfig
+      Roles:
+        - !Ref ElasticFederatedIdentityRole
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: ElasticAwsConfigRead
+            Effect: Allow
+            Action:
+              - config:DescribeConfigRules
+              - config:GetComplianceDetailsByConfigRule
+            Resource: '*'
+
 Outputs:
   RoleArn:
     Description: The ARN of the IAM Role. Paste this into Kibana.