Add all remaining aws package permissions to the Federated Identity CFT - #7637
Open
seanrathier wants to merge 9 commits into
Open
Add all remaining aws package permissions to the Federated Identity CFT#7637seanrathier wants to merge 9 commits into
seanrathier wants to merge 9 commits into
Conversation
Introduces federated-identity-aws.yml — a single CFT with one Enable* boolean parameter per AWS integration. CloudFormation Conditions attach only the IAM policies needed for the selected data streams, keeping the role minimal. Transport-layer policies (S3/SQS, CloudWatch Logs, Metrics) are auto-derived so users never need to think about them. Adds the template to publish_cft.sh so it is uploaded to S3 alongside the existing cloud-connectors templates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…nally Drops the 24 Enable* parameters and all CloudFormation Conditions in favor of a single static read-only role. Every IAM policy needed by the agentless-enabled AWS policy templates is always attached, so Kibana only needs to pass ElasticResourceId in the quick-create URL and users never have to update the stack when they add integrations later. Policies are grouped into four inline policy resources (transport, metrics, security findings, service inventory) plus the GuardDuty managed policy. Trust policy, ExternalId derivation, and outputs are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extends the federated identity role to cover CSPM, Cloud Asset Inventory, and KSPM-EKS: attaches the SecurityAudit managed policy and adds an ElasticSecurityPosture inline policy with the supplemental config, organizations, access-analyzer, account, cross-account sts:AssumeRole, and EKS read permissions declared in the per-package IaC patches of elastic/integrations#20240. CNVM is deliberately excluded: its scan operations (snapshot create/delete, RunInstances/TerminateInstances, iam:PassRole) require write access, and this role stays read-only. CNVM keeps its dedicated template. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cross-checked every inline action against the provider_permissions declarations in elastic/integrations#19405 (the AWS package's per-datastream permission manifest) and added the missing actions the agentless data streams require at runtime: - ec2:DescribeInstanceStatus (ec2_metrics) - ecs:DescribeClusters (ecs_metrics) - elasticloadbalancing:DescribeTargetHealth (elb_metrics) - lambda:GetFunction (lambda) - rds:DescribeDBClusters (rds) - health:DescribeAffectedEntities (awshealth) - securityhub:BatchGetSecurityControls, GetInsightResults (securityhub_findings_full_posture, securityhub_insights) securityhub:ListInsights, declared by #19405, is NOT added: cfn-lint confirms no such IAM action exists — listing insights is securityhub:GetInsights, which was already granted. Also corrects the Config grant: the aws.config data stream polls rule compliance (DescribeConfigRules, DescribeComplianceByConfigRule, GetComplianceDetailsByConfigRule), not resource inventory; the inventory-style Config reads moved to the SecurityPosturePolicy with the rest of the Asset Inventory permission set. Actions not declared by #19405 are retained when another primary source documents them (e.g. iam:ListAccountAliases in the package README); services whose policy templates are not agentless-enabled (apigateway, natgateway, vpn, emr, kafka, kinesis, redshift, s3_storage_lens) stay out of scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the all-at-once grant (five inline policies + SecurityAudit covering every agentless-enabled AWS integration upfront) with an incremental model: the template carries only the permissions of integrations that are actually federated, one block per integration, mirroring the provider_permissions declared in that integration's package manifest in elastic/integrations. Never grant ahead of a declaration. The baseline is GuardDuty only — the single integration federated in production today. Its AmazonGuardDutyReadOnlyAccess grant is carried over verbatim from the shipped cloud-connectors-guardduty template, pre-dating provider_permissions; it converts to a mirrored block when the aws package gains declarations. Per-integration additions land as separate PRs stacked on this one, each paired with the elastic/integrations PR that declares the permissions it mirrors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds 15 inline IAM policies to the federated identity template covering all remaining aws package integrations: inspector, securityhub, cloudwatch logs, shared metrics base (cloudwatch:ListMetrics, GetMetricData, tag:GetResources, ec2:DescribeRegions), awshealth, billing, dynamodb, ebs, ec2, ecs, elb, lambda, rds, sns, sqs, and transitgateway. Paired integrations PR: elastic/integrations#20526 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
This pull request does not have a backport label. Could you fix it @seanrathier? 🙏
|
9 tasks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Aug 4, 2026
seanrathier
added
backport-skip
Team:Security-Cloud Services
seanrathier
marked this pull request as ready for review
August 4, 2026 18:36
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
seanrathier
added a commit
to seanrathier/integrations
that referenced
this pull request
Aug 4, 2026
The Identity Federation quick-create link now targets cloudformation-federated-identity-aws-9.4.0.yml, published by cloudbeat's publish_cft.sh when elastic/cloudbeat#7637 merges. Until that publish runs, this URL 404s — cloudbeat#7637 must merge first. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Consolidates the grants previously split across the standalone CSPM and Cloud Asset Inventory remote-role templates into the single combined CFT. SecurityAudit covers both cloud_security_posture and cloud_asset_inventory; the intent is for this template to replace the separate per-product CFTs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Open
6 tasks
olegsu
reviewed
Aug 5, 2026
| @@ -0,0 +1,337 @@ | |||
| AWSTemplateFormatVersion: "2010-09-09" | |||
|
|
|||
| Description: 'Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for all Elastic AWS integrations that support Federated Identity: the aws package integrations (GuardDuty, Inspector, Config, CloudWatch, and metrics services), Cloud Security Posture Management (cloud_security_posture), and Cloud Asset Inventory (cloud_asset_inventory).' | |||
Collaborator
There was a problem hiding this comment.
Suggested change
| Description: 'Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for all Elastic AWS integrations that support Federated Identity: the aws package integrations (GuardDuty, Inspector, Config, CloudWatch, and metrics services), Cloud Security Posture Management (cloud_security_posture), and Cloud Asset Inventory (cloud_asset_inventory).' | |
| Description: 'Creates an IAM Role for Elastic Identity Federation. Grants read-only permissions for all Elastic AWS integrations that support Identity Federation: the AWS package integrations (GuardDuty, Inspector, Config, CloudWatch, and metrics services)' |
olegsu
requested changes
Aug 5, 2026
jeniawhite
reviewed
Aug 5, 2026
jeniawhite
left a comment
jeniawhite
left a comment
Collaborator
There was a problem hiding this comment.
Similar to PR: elastic/integrations#19405.
I assume that there is some overlap between the roles and the permissions (the roles probably include some of the permissions), but this shouldn't be a problem. Cloudbeat wise it looks fine, but would be great if we could get a review from the integration stakeholders as well.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds all AWS integration permissions to the federated identity CloudFormation template, enabling zero-creds STS AssumeRole+ExternalID auth across the entire
awspackage.Paired integrations PR: elastic/integrations#20527
Part of ingest-dev#8802
Policies added
ElasticAwsConfigconfig:DescribeConfigRules,config:GetComplianceDetailsByConfigRuleElasticAwsInspectorinspector2:ListFindingsElasticAwsSecurityHubsecurityhub:GetFindings,securityhub:GetInsightsElasticAwsCloudwatchLogslogs:DescribeLogGroups,logs:FilterLogEventsElasticAwsMetricscloudwatch:ListMetrics,cloudwatch:GetMetricData,tag:GetResources,ec2:DescribeRegionsElasticAwsHealthhealth:DescribeEvents,health:DescribeEventDetails,health:DescribeAffectedEntitiesElasticAwsBillingce:GetCostAndUsageElasticAwsDynamoDBdynamodb:ListTables,dynamodb:DescribeTableElasticAwsEBSec2:DescribeVolumesElasticAwsEC2ec2:DescribeInstances,ec2:DescribeInstanceStatusElasticAwsECSecs:ListClusters,ecs:DescribeClusters,ecs:ListServices,ecs:DescribeServicesElasticAwsELBelasticloadbalancing:DescribeLoadBalancers,...DescribeTargetGroups,...DescribeTargetHealthElasticAwsLambdalambda:ListFunctions,lambda:GetFunctionElasticAwsRDSrds:DescribeDBInstances,rds:DescribeDBClusters,rds:ListTagsForResourceElasticAwsSNSsns:ListTopics,sns:GetTopicAttributesElasticAwsSQSsqs:ListQueues,sqs:GetQueueAttributesElasticAwsTransitGatewayec2:DescribeTransitGateways,ec2:DescribeTransitGatewayAttachmentsE2E test plan
AccessDeniedExceptionappears in agent logs for any listed actionDEGRADEDstatus for Config, Inspector, SecurityHub, CloudWatch, and a sampling of metrics data streams