Add AWS CloudWatch permissions to the Federated Identity CFT - #7622
Closed
seanrathier wants to merge 6 commits into
Closed
Add AWS CloudWatch permissions to the Federated Identity CFT#7622seanrathier wants to merge 6 commits into
seanrathier wants to merge 6 commits into
Conversation
Introduces federated-identity-aws.yml — a single CFT with one Enable* boolean parameter per AWS integration. CloudFormation Conditions attach only the IAM policies needed for the selected data streams, keeping the role minimal. Transport-layer policies (S3/SQS, CloudWatch Logs, Metrics) are auto-derived so users never need to think about them. Adds the template to publish_cft.sh so it is uploaded to S3 alongside the existing cloud-connectors templates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…nally Drops the 24 Enable* parameters and all CloudFormation Conditions in favor of a single static read-only role. Every IAM policy needed by the agentless-enabled AWS policy templates is always attached, so Kibana only needs to pass ElasticResourceId in the quick-create URL and users never have to update the stack when they add integrations later. Policies are grouped into four inline policy resources (transport, metrics, security findings, service inventory) plus the GuardDuty managed policy. Trust policy, ExternalId derivation, and outputs are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extends the federated identity role to cover CSPM, Cloud Asset Inventory, and KSPM-EKS: attaches the SecurityAudit managed policy and adds an ElasticSecurityPosture inline policy with the supplemental config, organizations, access-analyzer, account, cross-account sts:AssumeRole, and EKS read permissions declared in the per-package IaC patches of elastic/integrations#20240. CNVM is deliberately excluded: its scan operations (snapshot create/delete, RunInstances/TerminateInstances, iam:PassRole) require write access, and this role stays read-only. CNVM keeps its dedicated template. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cross-checked every inline action against the provider_permissions declarations in elastic/integrations#19405 (the AWS package's per-datastream permission manifest) and added the missing actions the agentless data streams require at runtime: - ec2:DescribeInstanceStatus (ec2_metrics) - ecs:DescribeClusters (ecs_metrics) - elasticloadbalancing:DescribeTargetHealth (elb_metrics) - lambda:GetFunction (lambda) - rds:DescribeDBClusters (rds) - health:DescribeAffectedEntities (awshealth) - securityhub:BatchGetSecurityControls, GetInsightResults (securityhub_findings_full_posture, securityhub_insights) securityhub:ListInsights, declared by #19405, is NOT added: cfn-lint confirms no such IAM action exists — listing insights is securityhub:GetInsights, which was already granted. Also corrects the Config grant: the aws.config data stream polls rule compliance (DescribeConfigRules, DescribeComplianceByConfigRule, GetComplianceDetailsByConfigRule), not resource inventory; the inventory-style Config reads moved to the SecurityPosturePolicy with the rest of the Asset Inventory permission set. Actions not declared by #19405 are retained when another primary source documents them (e.g. iam:ListAccountAliases in the package README); services whose policy templates are not agentless-enabled (apigateway, natgateway, vpn, emr, kafka, kinesis, redshift, s3_storage_lens) stay out of scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the all-at-once grant (five inline policies + SecurityAudit covering every agentless-enabled AWS integration upfront) with an incremental model: the template carries only the permissions of integrations that are actually federated, one block per integration, mirroring the provider_permissions declared in that integration's package manifest in elastic/integrations. Never grant ahead of a declaration. The baseline is GuardDuty only — the single integration federated in production today. Its AmazonGuardDutyReadOnlyAccess grant is carried over verbatim from the shipped cloud-connectors-guardduty template, pre-dating provider_permissions; it converts to a mirrored block when the aws package gains declarations. Per-integration additions land as separate PRs stacked on this one, each paired with the elastic/integrations PR that declares the permissions it mirrors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds ElasticAwsCloudwatch inline policy with permissions for both cloudwatch_logs and cloudwatch_metrics data streams: - logs:DescribeLogGroups, logs:FilterLogEvents (aws-cloudwatch input) - cloudwatch:ListMetrics, cloudwatch:GetMetricData (aws/metrics input) Paired integrations PR: elastic/integrations#20525 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
This pull request does not have a backport label. Could you fix it @seanrathier? 🙏
|
Contributor
Author
|
Closing in favour of a single combined cloudbeat PR covering all remaining CFT permissions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
ElasticAwsCloudwatchinline IAM policy to the federated identity CloudFormation template, covering both log and metric collection for the AWS CloudWatch policy template:logs:DescribeLogGroups+logs:FilterLogEvents— forcloudwatch_logsvia theaws-cloudwatchBeats inputcloudwatch:ListMetrics+cloudwatch:GetMetricData— forcloudwatch_metricsvia theaws/metricsBeats inputPaired integrations PR: elastic/integrations#20525
Base: sibling of #7422 (same baseline commit as #7589 and #7590 — each adds one policy, whichever merges last rebases over a trivial same-resource conflict)
E2E test plan
cloudwatch_logs— confirm logs land inlogs-aws.cloudwatch_logs-*and Fleet shows noDEGRADEDstatuscloudwatch_metrics— confirm metrics land inmetrics-aws.cloudwatch_metrics-*AccessDeniedExceptionerrors forDescribeLogGroups,FilterLogEvents,ListMetrics, orGetMetricDatain the agent logs