diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml
new file mode 100644
index 0000000000..628fcb44f7
--- /dev/null
+++ b/deploy/cloudformation/federated-identity-aws.yml
@@ -0,0 +1,91 @@
+AWSTemplateFormatVersion: "2010-09-09"
+
+Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for the Elastic AWS integrations that support Federated Identity, accumulated per integration from each package's declared provider_permissions.
+
+Parameters:
+  ElasticResourceId:
+    Description: The Elastic resource ID (deployment component ID or serverless project ID) that the role will trust.
+    Type: String
+
+  ElasticRoleARN:
+    Description: Elastic's super-role ARN. Change only for test environments.
+    Type: String
+    Default: arn:aws:iam::254766567737:role/cloud_connectors
+
+Resources:
+
+  # Grants live in two places, both mirroring the provider_permissions
+  # declared in each integration's package manifest (elastic/integrations):
+  # managed policies (`roles`) go on the role's ManagedPolicyArns; inline
+  # permissions get one AWS::IAM::Policy resource per federated integration.
+  # Add grants only when an integration gains Federated Identity support —
+  # never ahead of a declaration.
+  ElasticFederatedIdentityRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub ElasticFederatedIdentity-${AWS::StackName}
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Ref ElasticRoleARN
+            Action: sts:AssumeRole
+            Condition:
+              StringEquals:
+                sts:ExternalId: !Join
+                  - '-'
+                  - - !Ref ElasticResourceId
+                    - !Select
+                      - 2
+                      - !Split
+                        - /
+                        - !Ref AWS::StackId
+      Path: /
+      ManagedPolicyArns:
+
+        # aws/guardduty: pre-dates provider_permissions; grant carried over
+        # from the shipped cloud-connectors-guardduty template.
+        - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess
+
+  # aws/cloudwatch: cloudwatch_logs (aws-cloudwatch input) and cloudwatch_metrics (aws/metrics input)
+  ElasticAwsCloudwatch:
+    Type: AWS::IAM::Policy
+    Properties:
+      PolicyName: !Sub ElasticAwsCloudwatch-${AWS::StackName}
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Action:
+
+              # cloudwatch_logs — aws-cloudwatch input calls DescribeLogGroups and FilterLogEvents
+              - logs:DescribeLogGroups
+              - logs:FilterLogEvents
+
+              # cloudwatch_metrics — aws/metrics cloudwatch metricset calls ListMetrics and GetMetricData
+              - cloudwatch:ListMetrics
+              - cloudwatch:GetMetricData
+            Resource: '*'
+      Roles:
+        - !Ref ElasticFederatedIdentityRole
+
+Outputs:
+  RoleArn:
+    Description: The ARN of the IAM Role. Paste this into Kibana.
+    Value: !GetAtt ElasticFederatedIdentityRole.Arn
+
+  ExternalId:
+    Description: The External ID used in the trust policy. Paste this into Kibana.
+    Value: !Join
+      - '-'
+      - - !Ref ElasticResourceId
+        - !Select
+          - 2
+          - !Split
+            - /
+            - !Ref AWS::StackId
+
+  StackId:
+    Description: Store this in Kibana to construct stack-update URLs later.
+    Value: !Ref AWS::StackId
diff --git a/scripts/publish_cft.sh b/scripts/publish_cft.sh
index d3e44198bd..271e20b829 100755
--- a/scripts/publish_cft.sh
+++ b/scripts/publish_cft.sh
@@ -60,3 +60,6 @@ upload_file deploy/asset-inventory-cloudformation/cloud-connectors-remote-role-o
 upload_file deploy/cloudformation/cloud-connectors-guardduty.yml \
     "cloudformation-cloud-connectors-guardduty" \
     "${version}"
+upload_file deploy/cloudformation/federated-identity-aws.yml \
+    "cloudformation-federated-identity-aws" \
+    "${version}"