From 52ef28cf167dcaf9a946c0a7d879f723a4c9b495 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Tue, 21 Jul 2026 16:13:14 -0400 Subject: [PATCH 1/9] Add parameterized CloudFormation template for Federated Identity (AWS) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduces federated-identity-aws.yml — a single CFT with one Enable* boolean parameter per AWS integration. CloudFormation Conditions attach only the IAM policies needed for the selected data streams, keeping the role minimal. Transport-layer policies (S3/SQS, CloudWatch Logs, Metrics) are auto-derived so users never need to think about them. Adds the template to publish_cft.sh so it is uploaded to S3 alongside the existing cloud-connectors templates. Co-Authored-By: Claude Sonnet 4.6 --- .../cloudformation/federated-identity-aws.yml | 808 ++++++++++++++++++ scripts/publish_cft.sh | 3 + 2 files changed, 811 insertions(+) create mode 100644 deploy/cloudformation/federated-identity-aws.yml diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml new file mode 100644 index 0000000000..2c945a1c5f --- /dev/null +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -0,0 +1,808 @@ +AWSTemplateFormatVersion: "2010-09-09" + +Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Enable only the integrations you need — permissions are granted conditionally. To add integrations later, update this stack with new parameters set to 'true'. + +Parameters: + ElasticResourceId: + Description: The Elastic resource ID (deployment component ID or serverless project ID) that the role will trust. + Type: String + + ElasticRoleARN: + Description: Elastic's super-role ARN. Change only for test environments. + Type: String + Default: arn:aws:iam::254766567737:role/cloud_connectors + + # ─── Security integrations ────────────────────────────────────────────────── + EnableGuardDuty: + Description: Grant permissions for Amazon GuardDuty findings. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableSecurityHub: + Description: Grant permissions for AWS Security Hub findings and insights. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableInspector: + Description: Grant permissions for Amazon Inspector vulnerability findings. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableConfig: + Description: Grant permissions for AWS Config resource inventory. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Logging integrations ─────────────────────────────────────────────────── + EnableCloudTrail: + Description: Grant permissions for AWS CloudTrail audit logs (S3/SQS + CloudWatch). + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableVpcFlow: + Description: Grant permissions for Amazon VPC Flow Logs (S3/SQS + CloudWatch). + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableWAF: + Description: Grant permissions for AWS WAF logs (S3/SQS + CloudWatch). + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableNetworkFirewall: + Description: Grant permissions for AWS Network Firewall logs and metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableRoute53: + Description: Grant permissions for Amazon Route 53 resolver/public logs. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableCloudFront: + Description: Grant permissions for Amazon CloudFront access logs. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Compute & infrastructure ─────────────────────────────────────────────── + EnableEC2: + Description: Grant permissions for Amazon EC2 logs and metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableECS: + Description: Grant permissions for Amazon ECS metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableLambda: + Description: Grant permissions for AWS Lambda metrics and logs. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableELB: + Description: Grant permissions for Elastic Load Balancing logs and metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Storage & databases ──────────────────────────────────────────────────── + EnableS3: + Description: Grant permissions for Amazon S3 access logs and storage metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableEBS: + Description: Grant permissions for Amazon EBS metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableRDS: + Description: Grant permissions for Amazon RDS metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableDynamoDB: + Description: Grant permissions for Amazon DynamoDB metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Messaging ────────────────────────────────────────────────────────────── + EnableSNS: + Description: Grant permissions for Amazon SNS metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableSQS: + Description: Grant permissions for Amazon SQS metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Networking ───────────────────────────────────────────────────────────── + EnableTransitGateway: + Description: Grant permissions for AWS Transit Gateway metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + # ─── Cost & monitoring ────────────────────────────────────────────────────── + EnableBilling: + Description: Grant permissions for AWS Billing/Cost Explorer metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableHealth: + Description: Grant permissions for AWS Health event metrics. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + + EnableCloudWatch: + Description: Grant permissions for generic CloudWatch logs and metrics collection. + Type: String + AllowedValues: + - "true" + - "false" + Default: "false" + +Conditions: + + # Security + GuardDutyEnabled: !Equals + - !Ref EnableGuardDuty + - "true" + + SecurityHubEnabled: !Equals + - !Ref EnableSecurityHub + - "true" + + InspectorEnabled: !Equals + - !Ref EnableInspector + - "true" + + ConfigEnabled: !Equals + - !Ref EnableConfig + - "true" + + # Logging (S3/CloudWatch transport) + CloudTrailEnabled: !Equals + - !Ref EnableCloudTrail + - "true" + + VpcFlowEnabled: !Equals + - !Ref EnableVpcFlow + - "true" + + WAFEnabled: !Equals + - !Ref EnableWAF + - "true" + + FirewallEnabled: !Equals + - !Ref EnableNetworkFirewall + - "true" + + Route53Enabled: !Equals + - !Ref EnableRoute53 + - "true" + + CloudFrontEnabled: !Equals + - !Ref EnableCloudFront + - "true" + + # Compute + EC2Enabled: !Equals + - !Ref EnableEC2 + - "true" + + ECSEnabled: !Equals + - !Ref EnableECS + - "true" + + LambdaEnabled: !Equals + - !Ref EnableLambda + - "true" + + ELBEnabled: !Equals + - !Ref EnableELB + - "true" + + # Storage & databases + S3Enabled: !Equals + - !Ref EnableS3 + - "true" + + EBSEnabled: !Equals + - !Ref EnableEBS + - "true" + + RDSEnabled: !Equals + - !Ref EnableRDS + - "true" + + DynamoDBEnabled: !Equals + - !Ref EnableDynamoDB + - "true" + + # Messaging + SNSEnabled: !Equals + - !Ref EnableSNS + - "true" + + SQSEnabled: !Equals + - !Ref EnableSQS + - "true" + + # Networking + TransitGatewayEnabled: !Equals + - !Ref EnableTransitGateway + - "true" + + # Cost & monitoring + BillingEnabled: !Equals + - !Ref EnableBilling + - "true" + + HealthEnabled: !Equals + - !Ref EnableHealth + - "true" + + CloudWatchEnabled: !Equals + - !Ref EnableCloudWatch + - "true" + + # Derived: does any integration need S3/SQS transport? + NeedsS3Transport: !Or + - !Condition CloudTrailEnabled + - !Condition VpcFlowEnabled + - !Condition WAFEnabled + - !Condition FirewallEnabled + - !Condition Route53Enabled + - !Condition CloudFrontEnabled + - !Condition EC2Enabled + - !Condition ELBEnabled + - !Condition S3Enabled + - !Condition GuardDutyEnabled + + # Derived: does any integration need CloudWatch Logs transport? + NeedsCloudWatchLogs: !Or + - !Condition CloudTrailEnabled + - !Condition VpcFlowEnabled + - !Condition WAFEnabled + - !Condition FirewallEnabled + - !Condition Route53Enabled + - !Condition EC2Enabled + - !Condition ELBEnabled + - !Condition LambdaEnabled + - !Condition CloudWatchEnabled + + # Derived: does any integration need CloudWatch Metrics base? + NeedsMetricsBase: !Or + - !Condition EC2Enabled + - !Condition ECSEnabled + - !Condition LambdaEnabled + - !Condition ELBEnabled + - !Condition S3Enabled + - !Condition EBSEnabled + - !Condition RDSEnabled + - !Condition DynamoDBEnabled + - !Condition SNSEnabled + - !Condition SQSEnabled + + # !Or max 10 — second group below + NeedsMetricsBaseExtended: !Or + - !Condition TransitGatewayEnabled + - !Condition BillingEnabled + - !Condition HealthEnabled + - !Condition CloudWatchEnabled + - !Condition FirewallEnabled + - !Condition NeedsMetricsBase + + NeedsMetrics: !Or + - !Condition NeedsMetricsBase + - !Condition NeedsMetricsBaseExtended + +Resources: + ElasticFederatedIdentityRole: + Type: AWS::IAM::Role + Properties: + RoleName: !Sub ElasticFederatedIdentity-${AWS::StackName} + AssumeRolePolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Principal: + AWS: !Ref ElasticRoleARN + Action: sts:AssumeRole + Condition: + StringEquals: + sts:ExternalId: !Join + - '-' + - - !Ref ElasticResourceId + - !Select + - 2 + - !Split + - / + - !Ref AWS::StackId + Path: / + ManagedPolicyArns: + - !If + - GuardDutyEnabled + - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess + - !Ref AWS::NoValue + + # ═══════════════════════════════════════════════════════════════════════════ + # Transport layer policies (shared across many integrations) + # ═══════════════════════════════════════════════════════════════════════════ + S3TransportPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticS3Transport + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticS3Read + Effect: Allow + Action: + - s3:GetObject + - s3:ListBucket + - s3:GetBucketLocation + Resource: '*' + - Sid: ElasticSQSConsume + Effect: Allow + Action: + - sqs:ReceiveMessage + - sqs:DeleteMessage + - sqs:ChangeMessageVisibility + - sqs:GetQueueAttributes + Resource: '*' + Condition: NeedsS3Transport + + CloudWatchLogsPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticCloudWatchLogs + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticCWLogsRead + Effect: Allow + Action: + - logs:DescribeLogGroups + - logs:DescribeLogStreams + - logs:FilterLogEvents + - logs:GetLogEvents + Resource: '*' + Condition: NeedsCloudWatchLogs + + MetricsBasePolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticMetricsBase + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticMetricsRead + Effect: Allow + Action: + - cloudwatch:GetMetricData + - cloudwatch:ListMetrics + - tag:GetResources + - ec2:DescribeRegions + - iam:ListAccountAliases + - sts:GetCallerIdentity + Resource: '*' + Condition: NeedsMetrics + + # ═══════════════════════════════════════════════════════════════════════════ + # Service-specific policies + # ═══════════════════════════════════════════════════════════════════════════ + SecurityHubPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticSecurityHub + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticSecurityHub + Effect: Allow + Action: + - securityhub:GetFindings + - securityhub:DescribeHub + - securityhub:GetEnabledStandards + - securityhub:ListSecurityControlDefinitions + - securityhub:GetSecurityControlDefinition + - securityhub:GetInsights + Resource: '*' + Condition: SecurityHubEnabled + + InspectorPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticInspector + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticInspector + Effect: Allow + Action: + - inspector2:ListFindings + - inspector2:ListCoverage + Resource: '*' + Condition: InspectorEnabled + + ConfigPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticConfig + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticConfig + Effect: Allow + Action: + - config:SelectResourceConfig + - config:GetResourceConfigHistory + - config:ListDiscoveredResources + - config:DescribeConfigurationRecorders + - config:DescribeConfigurationRecorderStatus + Resource: '*' + Condition: ConfigEnabled + + CloudTrailPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticCloudTrail + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticCloudTrail + Effect: Allow + Action: + - cloudtrail:LookupEvents + - cloudtrail:DescribeTrails + - cloudtrail:GetTrailStatus + Resource: '*' + Condition: CloudTrailEnabled + + FirewallPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticNetworkFirewall + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticFirewall + Effect: Allow + Action: + - network-firewall:DescribeFirewall + - network-firewall:ListFirewalls + Resource: '*' + Condition: FirewallEnabled + + EC2Policy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticEC2 + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticEC2 + Effect: Allow + Action: + - ec2:DescribeInstances + Resource: '*' + Condition: EC2Enabled + + ECSPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticECS + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticECS + Effect: Allow + Action: + - ecs:ListClusters + - ecs:ListServices + - ecs:DescribeServices + - ecs:ListTasks + - ecs:DescribeTasks + Resource: '*' + Condition: ECSEnabled + + LambdaPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticLambda + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticLambda + Effect: Allow + Action: + - lambda:ListFunctions + - lambda:ListTags + Resource: '*' + Condition: LambdaEnabled + + ELBPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticELB + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticELB + Effect: Allow + Action: + - elasticloadbalancing:DescribeLoadBalancers + - elasticloadbalancing:DescribeTargetGroups + - elasticloadbalancing:DescribeTags + Resource: '*' + Condition: ELBEnabled + + S3ServicePolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticS3Service + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticS3Inventory + Effect: Allow + Action: + - s3:GetBucketTagging + - s3:ListAllMyBuckets + Resource: '*' + Condition: S3Enabled + + EBSPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticEBS + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticEBS + Effect: Allow + Action: + - ec2:DescribeVolumes + Resource: '*' + Condition: EBSEnabled + + RDSPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticRDS + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticRDS + Effect: Allow + Action: + - rds:DescribeDBInstances + - rds:ListTagsForResource + Resource: '*' + Condition: RDSEnabled + + DynamoDBPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticDynamoDB + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticDynamoDB + Effect: Allow + Action: + - dynamodb:DescribeTable + - dynamodb:ListTables + - dynamodb:DescribeTimeToLive + Resource: '*' + Condition: DynamoDBEnabled + + SNSPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticSNS + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticSNS + Effect: Allow + Action: + - sns:ListTopics + - sns:GetTopicAttributes + Resource: '*' + Condition: SNSEnabled + + SQSPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticSQS + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticSQS + Effect: Allow + Action: + - sqs:ListQueues + - sqs:GetQueueAttributes + Resource: '*' + Condition: SQSEnabled + + TransitGatewayPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticTransitGateway + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticTransitGateway + Effect: Allow + Action: + - ec2:DescribeTransitGateways + - ec2:DescribeTransitGatewayAttachments + Resource: '*' + Condition: TransitGatewayEnabled + + BillingPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticBilling + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticBilling + Effect: Allow + Action: + - ce:GetCostAndUsage + - ce:GetDimensionValues + - ce:GetTags + Resource: '*' + Condition: BillingEnabled + + HealthPolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticHealth + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticHealth + Effect: Allow + Action: + - health:DescribeEvents + - health:DescribeEventDetails + - health:DescribeEventsForOrganization + Resource: '*' + Condition: HealthEnabled + +Outputs: + RoleArn: + Description: The ARN of the IAM Role. Paste this into Kibana. + Value: !GetAtt ElasticFederatedIdentityRole.Arn + + ExternalId: + Description: The External ID used in the trust policy. Paste this into Kibana. + Value: !Join + - '-' + - - !Ref ElasticResourceId + - !Select + - 2 + - !Split + - / + - !Ref AWS::StackId + + StackId: + Description: Store this in Kibana to construct stack-update URLs later. + Value: !Ref AWS::StackId diff --git a/scripts/publish_cft.sh b/scripts/publish_cft.sh index d3e44198bd..271e20b829 100755 --- a/scripts/publish_cft.sh +++ b/scripts/publish_cft.sh @@ -60,3 +60,6 @@ upload_file deploy/asset-inventory-cloudformation/cloud-connectors-remote-role-o upload_file deploy/cloudformation/cloud-connectors-guardduty.yml \ "cloudformation-cloud-connectors-guardduty" \ "${version}" +upload_file deploy/cloudformation/federated-identity-aws.yml \ + "cloudformation-federated-identity-aws" \ + "${version}" From a3abc3825dc017f1983bc413441dfde682aa1988 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Wed, 22 Jul 2026 16:18:18 -0400 Subject: [PATCH 2/9] Simplify federated-identity-aws.yml: grant all permissions unconditionally Drops the 24 Enable* parameters and all CloudFormation Conditions in favor of a single static read-only role. Every IAM policy needed by the agentless-enabled AWS policy templates is always attached, so Kibana only needs to pass ElasticResourceId in the quick-create URL and users never have to update the stack when they add integrations later. Policies are grouped into four inline policy resources (transport, metrics, security findings, service inventory) plus the GuardDuty managed policy. Trust policy, ExternalId derivation, and outputs are unchanged. Co-Authored-By: Claude Fable 5 --- .../cloudformation/federated-identity-aws.yml | 607 +----------------- 1 file changed, 26 insertions(+), 581 deletions(-) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 2c945a1c5f..2e2b3561ad 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -1,6 +1,6 @@ AWSTemplateFormatVersion: "2010-09-09" -Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Enable only the integrations you need — permissions are granted conditionally. To add integrations later, update this stack with new parameters set to 'true'. +Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for all Elastic AWS integrations that support Federated Identity. Parameters: ElasticResourceId: @@ -12,361 +12,6 @@ Parameters: Type: String Default: arn:aws:iam::254766567737:role/cloud_connectors - # ─── Security integrations ────────────────────────────────────────────────── - EnableGuardDuty: - Description: Grant permissions for Amazon GuardDuty findings. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableSecurityHub: - Description: Grant permissions for AWS Security Hub findings and insights. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableInspector: - Description: Grant permissions for Amazon Inspector vulnerability findings. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableConfig: - Description: Grant permissions for AWS Config resource inventory. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Logging integrations ─────────────────────────────────────────────────── - EnableCloudTrail: - Description: Grant permissions for AWS CloudTrail audit logs (S3/SQS + CloudWatch). - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableVpcFlow: - Description: Grant permissions for Amazon VPC Flow Logs (S3/SQS + CloudWatch). - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableWAF: - Description: Grant permissions for AWS WAF logs (S3/SQS + CloudWatch). - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableNetworkFirewall: - Description: Grant permissions for AWS Network Firewall logs and metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableRoute53: - Description: Grant permissions for Amazon Route 53 resolver/public logs. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableCloudFront: - Description: Grant permissions for Amazon CloudFront access logs. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Compute & infrastructure ─────────────────────────────────────────────── - EnableEC2: - Description: Grant permissions for Amazon EC2 logs and metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableECS: - Description: Grant permissions for Amazon ECS metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableLambda: - Description: Grant permissions for AWS Lambda metrics and logs. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableELB: - Description: Grant permissions for Elastic Load Balancing logs and metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Storage & databases ──────────────────────────────────────────────────── - EnableS3: - Description: Grant permissions for Amazon S3 access logs and storage metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableEBS: - Description: Grant permissions for Amazon EBS metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableRDS: - Description: Grant permissions for Amazon RDS metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableDynamoDB: - Description: Grant permissions for Amazon DynamoDB metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Messaging ────────────────────────────────────────────────────────────── - EnableSNS: - Description: Grant permissions for Amazon SNS metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableSQS: - Description: Grant permissions for Amazon SQS metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Networking ───────────────────────────────────────────────────────────── - EnableTransitGateway: - Description: Grant permissions for AWS Transit Gateway metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - # ─── Cost & monitoring ────────────────────────────────────────────────────── - EnableBilling: - Description: Grant permissions for AWS Billing/Cost Explorer metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableHealth: - Description: Grant permissions for AWS Health event metrics. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - - EnableCloudWatch: - Description: Grant permissions for generic CloudWatch logs and metrics collection. - Type: String - AllowedValues: - - "true" - - "false" - Default: "false" - -Conditions: - - # Security - GuardDutyEnabled: !Equals - - !Ref EnableGuardDuty - - "true" - - SecurityHubEnabled: !Equals - - !Ref EnableSecurityHub - - "true" - - InspectorEnabled: !Equals - - !Ref EnableInspector - - "true" - - ConfigEnabled: !Equals - - !Ref EnableConfig - - "true" - - # Logging (S3/CloudWatch transport) - CloudTrailEnabled: !Equals - - !Ref EnableCloudTrail - - "true" - - VpcFlowEnabled: !Equals - - !Ref EnableVpcFlow - - "true" - - WAFEnabled: !Equals - - !Ref EnableWAF - - "true" - - FirewallEnabled: !Equals - - !Ref EnableNetworkFirewall - - "true" - - Route53Enabled: !Equals - - !Ref EnableRoute53 - - "true" - - CloudFrontEnabled: !Equals - - !Ref EnableCloudFront - - "true" - - # Compute - EC2Enabled: !Equals - - !Ref EnableEC2 - - "true" - - ECSEnabled: !Equals - - !Ref EnableECS - - "true" - - LambdaEnabled: !Equals - - !Ref EnableLambda - - "true" - - ELBEnabled: !Equals - - !Ref EnableELB - - "true" - - # Storage & databases - S3Enabled: !Equals - - !Ref EnableS3 - - "true" - - EBSEnabled: !Equals - - !Ref EnableEBS - - "true" - - RDSEnabled: !Equals - - !Ref EnableRDS - - "true" - - DynamoDBEnabled: !Equals - - !Ref EnableDynamoDB - - "true" - - # Messaging - SNSEnabled: !Equals - - !Ref EnableSNS - - "true" - - SQSEnabled: !Equals - - !Ref EnableSQS - - "true" - - # Networking - TransitGatewayEnabled: !Equals - - !Ref EnableTransitGateway - - "true" - - # Cost & monitoring - BillingEnabled: !Equals - - !Ref EnableBilling - - "true" - - HealthEnabled: !Equals - - !Ref EnableHealth - - "true" - - CloudWatchEnabled: !Equals - - !Ref EnableCloudWatch - - "true" - - # Derived: does any integration need S3/SQS transport? - NeedsS3Transport: !Or - - !Condition CloudTrailEnabled - - !Condition VpcFlowEnabled - - !Condition WAFEnabled - - !Condition FirewallEnabled - - !Condition Route53Enabled - - !Condition CloudFrontEnabled - - !Condition EC2Enabled - - !Condition ELBEnabled - - !Condition S3Enabled - - !Condition GuardDutyEnabled - - # Derived: does any integration need CloudWatch Logs transport? - NeedsCloudWatchLogs: !Or - - !Condition CloudTrailEnabled - - !Condition VpcFlowEnabled - - !Condition WAFEnabled - - !Condition FirewallEnabled - - !Condition Route53Enabled - - !Condition EC2Enabled - - !Condition ELBEnabled - - !Condition LambdaEnabled - - !Condition CloudWatchEnabled - - # Derived: does any integration need CloudWatch Metrics base? - NeedsMetricsBase: !Or - - !Condition EC2Enabled - - !Condition ECSEnabled - - !Condition LambdaEnabled - - !Condition ELBEnabled - - !Condition S3Enabled - - !Condition EBSEnabled - - !Condition RDSEnabled - - !Condition DynamoDBEnabled - - !Condition SNSEnabled - - !Condition SQSEnabled - - # !Or max 10 — second group below - NeedsMetricsBaseExtended: !Or - - !Condition TransitGatewayEnabled - - !Condition BillingEnabled - - !Condition HealthEnabled - - !Condition CloudWatchEnabled - - !Condition FirewallEnabled - - !Condition NeedsMetricsBase - - NeedsMetrics: !Or - - !Condition NeedsMetricsBase - - !Condition NeedsMetricsBaseExtended - Resources: ElasticFederatedIdentityRole: Type: AWS::IAM::Role @@ -391,18 +36,15 @@ Resources: - !Ref AWS::StackId Path: / ManagedPolicyArns: - - !If - - GuardDutyEnabled - - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess - - !Ref AWS::NoValue + - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess - # ═══════════════════════════════════════════════════════════════════════════ - # Transport layer policies (shared across many integrations) - # ═══════════════════════════════════════════════════════════════════════════ - S3TransportPolicy: + # Log transport: S3-delivered logs (CloudTrail, VPC Flow, WAF, Route 53, + # CloudFront, ELB, Network Firewall, ...) plus SQS queue consumption and + # CloudWatch Logs reads. + TransportPolicy: Type: AWS::IAM::Policy Properties: - PolicyName: ElasticS3Transport + PolicyName: ElasticTransport Roles: - !Ref ElasticFederatedIdentityRole PolicyDocument: @@ -423,17 +65,6 @@ Resources: - sqs:ChangeMessageVisibility - sqs:GetQueueAttributes Resource: '*' - Condition: NeedsS3Transport - - CloudWatchLogsPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticCloudWatchLogs - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticCWLogsRead Effect: Allow Action: @@ -442,12 +73,13 @@ Resources: - logs:FilterLogEvents - logs:GetLogEvents Resource: '*' - Condition: NeedsCloudWatchLogs - MetricsBasePolicy: + # CloudWatch metrics collection and account metadata shared by all metrics + # integrations. + MetricsPolicy: Type: AWS::IAM::Policy Properties: - PolicyName: ElasticMetricsBase + PolicyName: ElasticMetrics Roles: - !Ref ElasticFederatedIdentityRole PolicyDocument: @@ -463,15 +95,12 @@ Resources: - iam:ListAccountAliases - sts:GetCallerIdentity Resource: '*' - Condition: NeedsMetrics - # ═══════════════════════════════════════════════════════════════════════════ - # Service-specific policies - # ═══════════════════════════════════════════════════════════════════════════ - SecurityHubPolicy: + # Security findings and audit: Security Hub, Inspector, Config, CloudTrail. + SecurityFindingsPolicy: Type: AWS::IAM::Policy Properties: - PolicyName: ElasticSecurityHub + PolicyName: ElasticSecurityFindings Roles: - !Ref ElasticFederatedIdentityRole PolicyDocument: @@ -487,34 +116,12 @@ Resources: - securityhub:GetSecurityControlDefinition - securityhub:GetInsights Resource: '*' - Condition: SecurityHubEnabled - - InspectorPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticInspector - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticInspector Effect: Allow Action: - inspector2:ListFindings - inspector2:ListCoverage Resource: '*' - Condition: InspectorEnabled - - ConfigPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticConfig - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticConfig Effect: Allow Action: @@ -524,17 +131,6 @@ Resources: - config:DescribeConfigurationRecorders - config:DescribeConfigurationRecorderStatus Resource: '*' - Condition: ConfigEnabled - - CloudTrailPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticCloudTrail - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticCloudTrail Effect: Allow Action: @@ -542,29 +138,14 @@ Resources: - cloudtrail:DescribeTrails - cloudtrail:GetTrailStatus Resource: '*' - Condition: CloudTrailEnabled - FirewallPolicy: + # Per-service resource inventory reads for metrics enrichment: EC2, ECS, + # Lambda, ELB, S3, EBS, RDS, DynamoDB, SNS, SQS, Transit Gateway, + # Network Firewall, Billing (Cost Explorer), and Health. + ServiceInventoryPolicy: Type: AWS::IAM::Policy Properties: - PolicyName: ElasticNetworkFirewall - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticFirewall - Effect: Allow - Action: - - network-firewall:DescribeFirewall - - network-firewall:ListFirewalls - Resource: '*' - Condition: FirewallEnabled - - EC2Policy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticEC2 + PolicyName: ElasticServiceInventory Roles: - !Ref ElasticFederatedIdentityRole PolicyDocument: @@ -574,18 +155,10 @@ Resources: Effect: Allow Action: - ec2:DescribeInstances + - ec2:DescribeVolumes + - ec2:DescribeTransitGateways + - ec2:DescribeTransitGatewayAttachments Resource: '*' - Condition: EC2Enabled - - ECSPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticECS - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticECS Effect: Allow Action: @@ -595,34 +168,12 @@ Resources: - ecs:ListTasks - ecs:DescribeTasks Resource: '*' - Condition: ECSEnabled - - LambdaPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticLambda - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticLambda Effect: Allow Action: - lambda:ListFunctions - lambda:ListTags Resource: '*' - Condition: LambdaEnabled - - ELBPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticELB - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticELB Effect: Allow Action: @@ -630,67 +181,18 @@ Resources: - elasticloadbalancing:DescribeTargetGroups - elasticloadbalancing:DescribeTags Resource: '*' - Condition: ELBEnabled - - S3ServicePolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticS3Service - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticS3Inventory Effect: Allow Action: - s3:GetBucketTagging - s3:ListAllMyBuckets Resource: '*' - Condition: S3Enabled - - EBSPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticEBS - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticEBS - Effect: Allow - Action: - - ec2:DescribeVolumes - Resource: '*' - Condition: EBSEnabled - - RDSPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticRDS - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticRDS Effect: Allow Action: - rds:DescribeDBInstances - rds:ListTagsForResource Resource: '*' - Condition: RDSEnabled - - DynamoDBPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticDynamoDB - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticDynamoDB Effect: Allow Action: @@ -698,68 +200,23 @@ Resources: - dynamodb:ListTables - dynamodb:DescribeTimeToLive Resource: '*' - Condition: DynamoDBEnabled - - SNSPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticSNS - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticSNS Effect: Allow Action: - sns:ListTopics - sns:GetTopicAttributes Resource: '*' - Condition: SNSEnabled - - SQSPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticSQS - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticSQS + - Sid: ElasticSQSInventory Effect: Allow Action: - sqs:ListQueues - - sqs:GetQueueAttributes Resource: '*' - Condition: SQSEnabled - - TransitGatewayPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticTransitGateway - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticTransitGateway + - Sid: ElasticFirewall Effect: Allow Action: - - ec2:DescribeTransitGateways - - ec2:DescribeTransitGatewayAttachments + - network-firewall:DescribeFirewall + - network-firewall:ListFirewalls Resource: '*' - Condition: TransitGatewayEnabled - - BillingPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticBilling - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticBilling Effect: Allow Action: @@ -767,17 +224,6 @@ Resources: - ce:GetDimensionValues - ce:GetTags Resource: '*' - Condition: BillingEnabled - - HealthPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticHealth - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - Sid: ElasticHealth Effect: Allow Action: @@ -785,7 +231,6 @@ Resources: - health:DescribeEventDetails - health:DescribeEventsForOrganization Resource: '*' - Condition: HealthEnabled Outputs: RoleArn: From 5cfb4c0c3f6107b0246da5c076cded98457c7bdc Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Thu, 23 Jul 2026 09:45:24 -0400 Subject: [PATCH 3/9] Add security posture permissions from integrations#20240 patch sets Extends the federated identity role to cover CSPM, Cloud Asset Inventory, and KSPM-EKS: attaches the SecurityAudit managed policy and adds an ElasticSecurityPosture inline policy with the supplemental config, organizations, access-analyzer, account, cross-account sts:AssumeRole, and EKS read permissions declared in the per-package IaC patches of elastic/integrations#20240. CNVM is deliberately excluded: its scan operations (snapshot create/delete, RunInstances/TerminateInstances, iam:PassRole) require write access, and this role stays read-only. CNVM keeps its dedicated template. Co-Authored-By: Claude Fable 5 --- .../cloudformation/federated-identity-aws.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 2e2b3561ad..83bb275854 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -37,6 +37,7 @@ Resources: Path: / ManagedPolicyArns: - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess + - arn:aws:iam::aws:policy/SecurityAudit # Log transport: S3-delivered logs (CloudTrail, VPC Flow, WAF, Route 53, # CloudFront, ELB, Network Firewall, ...) plus SQS queue consumption and @@ -232,6 +233,62 @@ Resources: - health:DescribeEventsForOrganization Resource: '*' + # Security posture packages (CSPM, Cloud Asset Inventory, KSPM-EKS): + # supplemental read permissions beyond the SecurityAudit managed policy. + # Sourced from the per-package IaC patches in elastic/integrations#20240. + # CNVM is intentionally excluded — its snapshot/instance scan operations + # require write permissions and keep their own dedicated template. + SecurityPosturePolicy: + Type: AWS::IAM::Policy + Properties: + PolicyName: ElasticSecurityPosture + Roles: + - !Ref ElasticFederatedIdentityRole + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: ElasticPostureConfig + Effect: Allow + Action: + - config:ListDiscoveredResources + - config:SelectResourceConfig + - config:SelectAggregateResourceConfig + - config:DescribeConfigurationRecorders + - config:DescribeAggregationAuthorizations + - config:DescribeConfigurationAggregators + Resource: '*' + - Sid: ElasticPostureOrganizations + Effect: Allow + Action: + - organizations:DescribeOrganization + - organizations:ListAccounts + - organizations:ListAccountsForParent + - organizations:ListOrganizationalUnitsForParent + - organizations:ListRoots + - organizations:ListDelegatedAdministrators + Resource: '*' + - Sid: ElasticPostureSupplemental + Effect: Allow + Action: + - access-analyzer:ListAnalyzers + - account:GetAlternateContact + Resource: '*' + - Sid: ElasticPostureCrossAccountAssumeRole + Effect: Allow + Action: + - sts:AssumeRole + Resource: '*' + - Sid: ElasticPostureEKS + Effect: Allow + Action: + - eks:DescribeCluster + - eks:ListClusters + - ec2:DescribeSecurityGroups + - ec2:DescribeSubnets + - iam:GetRole + - iam:ListAttachedRolePolicies + Resource: '*' + Outputs: RoleArn: Description: The ARN of the IAM Role. Paste this into Kibana. From 7c6c286ad904b8681d357dc87563ee361609e2a4 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Thu, 23 Jul 2026 09:55:29 -0400 Subject: [PATCH 4/9] Align per-service permissions with integrations#19405 declarations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cross-checked every inline action against the provider_permissions declarations in elastic/integrations#19405 (the AWS package's per-datastream permission manifest) and added the missing actions the agentless data streams require at runtime: - ec2:DescribeInstanceStatus (ec2_metrics) - ecs:DescribeClusters (ecs_metrics) - elasticloadbalancing:DescribeTargetHealth (elb_metrics) - lambda:GetFunction (lambda) - rds:DescribeDBClusters (rds) - health:DescribeAffectedEntities (awshealth) - securityhub:BatchGetSecurityControls, GetInsightResults (securityhub_findings_full_posture, securityhub_insights) securityhub:ListInsights, declared by #19405, is NOT added: cfn-lint confirms no such IAM action exists — listing insights is securityhub:GetInsights, which was already granted. Also corrects the Config grant: the aws.config data stream polls rule compliance (DescribeConfigRules, DescribeComplianceByConfigRule, GetComplianceDetailsByConfigRule), not resource inventory; the inventory-style Config reads moved to the SecurityPosturePolicy with the rest of the Asset Inventory permission set. Actions not declared by #19405 are retained when another primary source documents them (e.g. iam:ListAccountAliases in the package README); services whose policy templates are not agentless-enabled (apigateway, natgateway, vpn, emr, kafka, kinesis, redshift, s3_storage_lens) stay out of scope. Co-Authored-By: Claude Fable 5 --- .../cloudformation/federated-identity-aws.yml | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 83bb275854..0e92a34626 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -111,11 +111,13 @@ Resources: Effect: Allow Action: - securityhub:GetFindings + - securityhub:BatchGetSecurityControls - securityhub:DescribeHub - securityhub:GetEnabledStandards - securityhub:ListSecurityControlDefinitions - securityhub:GetSecurityControlDefinition - securityhub:GetInsights + - securityhub:GetInsightResults Resource: '*' - Sid: ElasticInspector Effect: Allow @@ -123,14 +125,16 @@ Resources: - inspector2:ListFindings - inspector2:ListCoverage Resource: '*' + + # The aws.config data stream polls Config rule compliance via the + # Config API; resource-inventory Config reads live in the + # SecurityPosturePolicy below. - Sid: ElasticConfig Effect: Allow Action: - - config:SelectResourceConfig - - config:GetResourceConfigHistory - - config:ListDiscoveredResources - - config:DescribeConfigurationRecorders - - config:DescribeConfigurationRecorderStatus + - config:DescribeConfigRules + - config:DescribeComplianceByConfigRule + - config:GetComplianceDetailsByConfigRule Resource: '*' - Sid: ElasticCloudTrail Effect: Allow @@ -156,6 +160,7 @@ Resources: Effect: Allow Action: - ec2:DescribeInstances + - ec2:DescribeInstanceStatus - ec2:DescribeVolumes - ec2:DescribeTransitGateways - ec2:DescribeTransitGatewayAttachments @@ -164,6 +169,7 @@ Resources: Effect: Allow Action: - ecs:ListClusters + - ecs:DescribeClusters - ecs:ListServices - ecs:DescribeServices - ecs:ListTasks @@ -173,6 +179,7 @@ Resources: Effect: Allow Action: - lambda:ListFunctions + - lambda:GetFunction - lambda:ListTags Resource: '*' - Sid: ElasticELB @@ -180,6 +187,7 @@ Resources: Action: - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:DescribeTargetGroups + - elasticloadbalancing:DescribeTargetHealth - elasticloadbalancing:DescribeTags Resource: '*' - Sid: ElasticS3Inventory @@ -192,6 +200,7 @@ Resources: Effect: Allow Action: - rds:DescribeDBInstances + - rds:DescribeDBClusters - rds:ListTagsForResource Resource: '*' - Sid: ElasticDynamoDB @@ -230,6 +239,7 @@ Resources: Action: - health:DescribeEvents - health:DescribeEventDetails + - health:DescribeAffectedEntities - health:DescribeEventsForOrganization Resource: '*' From 63434a3c5da4775827feb650a5b740fddb0d88ed Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Fri, 31 Jul 2026 15:24:34 -0400 Subject: [PATCH 5/9] Rework template to grow incrementally from declared permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the all-at-once grant (five inline policies + SecurityAudit covering every agentless-enabled AWS integration upfront) with an incremental model: the template carries only the permissions of integrations that are actually federated, one block per integration, mirroring the provider_permissions declared in that integration's package manifest in elastic/integrations. Never grant ahead of a declaration. The baseline is GuardDuty only — the single integration federated in production today. Its AmazonGuardDutyReadOnlyAccess grant is carried over verbatim from the shipped cloud-connectors-guardduty template, pre-dating provider_permissions; it converts to a mirrored block when the aws package gains declarations. Per-integration additions land as separate PRs stacked on this one, each paired with the elastic/integrations PR that declares the permissions it mirrors. Co-Authored-By: Claude Fable 5 --- .../cloudformation/federated-identity-aws.yml | 273 +----------------- 1 file changed, 11 insertions(+), 262 deletions(-) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 0e92a34626..e30c36812a 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -1,6 +1,6 @@ AWSTemplateFormatVersion: "2010-09-09" -Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for all Elastic AWS integrations that support Federated Identity. +Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for the Elastic AWS integrations that support Federated Identity, accumulated per integration from each package's declared provider_permissions. Parameters: ElasticResourceId: @@ -13,6 +13,13 @@ Parameters: Default: arn:aws:iam::254766567737:role/cloud_connectors Resources: + + # Grants live in two places, both mirroring the provider_permissions + # declared in each integration's package manifest (elastic/integrations): + # managed policies (`roles`) go on the role's ManagedPolicyArns; inline + # permissions get one AWS::IAM::Policy resource per federated integration. + # Add grants only when an integration gains Federated Identity support — + # never ahead of a declaration. ElasticFederatedIdentityRole: Type: AWS::IAM::Role Properties: @@ -36,268 +43,10 @@ Resources: - !Ref AWS::StackId Path: / ManagedPolicyArns: - - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess - - arn:aws:iam::aws:policy/SecurityAudit - - # Log transport: S3-delivered logs (CloudTrail, VPC Flow, WAF, Route 53, - # CloudFront, ELB, Network Firewall, ...) plus SQS queue consumption and - # CloudWatch Logs reads. - TransportPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticTransport - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticS3Read - Effect: Allow - Action: - - s3:GetObject - - s3:ListBucket - - s3:GetBucketLocation - Resource: '*' - - Sid: ElasticSQSConsume - Effect: Allow - Action: - - sqs:ReceiveMessage - - sqs:DeleteMessage - - sqs:ChangeMessageVisibility - - sqs:GetQueueAttributes - Resource: '*' - - Sid: ElasticCWLogsRead - Effect: Allow - Action: - - logs:DescribeLogGroups - - logs:DescribeLogStreams - - logs:FilterLogEvents - - logs:GetLogEvents - Resource: '*' - # CloudWatch metrics collection and account metadata shared by all metrics - # integrations. - MetricsPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticMetrics - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticMetricsRead - Effect: Allow - Action: - - cloudwatch:GetMetricData - - cloudwatch:ListMetrics - - tag:GetResources - - ec2:DescribeRegions - - iam:ListAccountAliases - - sts:GetCallerIdentity - Resource: '*' - - # Security findings and audit: Security Hub, Inspector, Config, CloudTrail. - SecurityFindingsPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticSecurityFindings - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticSecurityHub - Effect: Allow - Action: - - securityhub:GetFindings - - securityhub:BatchGetSecurityControls - - securityhub:DescribeHub - - securityhub:GetEnabledStandards - - securityhub:ListSecurityControlDefinitions - - securityhub:GetSecurityControlDefinition - - securityhub:GetInsights - - securityhub:GetInsightResults - Resource: '*' - - Sid: ElasticInspector - Effect: Allow - Action: - - inspector2:ListFindings - - inspector2:ListCoverage - Resource: '*' - - # The aws.config data stream polls Config rule compliance via the - # Config API; resource-inventory Config reads live in the - # SecurityPosturePolicy below. - - Sid: ElasticConfig - Effect: Allow - Action: - - config:DescribeConfigRules - - config:DescribeComplianceByConfigRule - - config:GetComplianceDetailsByConfigRule - Resource: '*' - - Sid: ElasticCloudTrail - Effect: Allow - Action: - - cloudtrail:LookupEvents - - cloudtrail:DescribeTrails - - cloudtrail:GetTrailStatus - Resource: '*' - - # Per-service resource inventory reads for metrics enrichment: EC2, ECS, - # Lambda, ELB, S3, EBS, RDS, DynamoDB, SNS, SQS, Transit Gateway, - # Network Firewall, Billing (Cost Explorer), and Health. - ServiceInventoryPolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticServiceInventory - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticEC2 - Effect: Allow - Action: - - ec2:DescribeInstances - - ec2:DescribeInstanceStatus - - ec2:DescribeVolumes - - ec2:DescribeTransitGateways - - ec2:DescribeTransitGatewayAttachments - Resource: '*' - - Sid: ElasticECS - Effect: Allow - Action: - - ecs:ListClusters - - ecs:DescribeClusters - - ecs:ListServices - - ecs:DescribeServices - - ecs:ListTasks - - ecs:DescribeTasks - Resource: '*' - - Sid: ElasticLambda - Effect: Allow - Action: - - lambda:ListFunctions - - lambda:GetFunction - - lambda:ListTags - Resource: '*' - - Sid: ElasticELB - Effect: Allow - Action: - - elasticloadbalancing:DescribeLoadBalancers - - elasticloadbalancing:DescribeTargetGroups - - elasticloadbalancing:DescribeTargetHealth - - elasticloadbalancing:DescribeTags - Resource: '*' - - Sid: ElasticS3Inventory - Effect: Allow - Action: - - s3:GetBucketTagging - - s3:ListAllMyBuckets - Resource: '*' - - Sid: ElasticRDS - Effect: Allow - Action: - - rds:DescribeDBInstances - - rds:DescribeDBClusters - - rds:ListTagsForResource - Resource: '*' - - Sid: ElasticDynamoDB - Effect: Allow - Action: - - dynamodb:DescribeTable - - dynamodb:ListTables - - dynamodb:DescribeTimeToLive - Resource: '*' - - Sid: ElasticSNS - Effect: Allow - Action: - - sns:ListTopics - - sns:GetTopicAttributes - Resource: '*' - - Sid: ElasticSQSInventory - Effect: Allow - Action: - - sqs:ListQueues - Resource: '*' - - Sid: ElasticFirewall - Effect: Allow - Action: - - network-firewall:DescribeFirewall - - network-firewall:ListFirewalls - Resource: '*' - - Sid: ElasticBilling - Effect: Allow - Action: - - ce:GetCostAndUsage - - ce:GetDimensionValues - - ce:GetTags - Resource: '*' - - Sid: ElasticHealth - Effect: Allow - Action: - - health:DescribeEvents - - health:DescribeEventDetails - - health:DescribeAffectedEntities - - health:DescribeEventsForOrganization - Resource: '*' - - # Security posture packages (CSPM, Cloud Asset Inventory, KSPM-EKS): - # supplemental read permissions beyond the SecurityAudit managed policy. - # Sourced from the per-package IaC patches in elastic/integrations#20240. - # CNVM is intentionally excluded — its snapshot/instance scan operations - # require write permissions and keep their own dedicated template. - SecurityPosturePolicy: - Type: AWS::IAM::Policy - Properties: - PolicyName: ElasticSecurityPosture - Roles: - - !Ref ElasticFederatedIdentityRole - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: ElasticPostureConfig - Effect: Allow - Action: - - config:ListDiscoveredResources - - config:SelectResourceConfig - - config:SelectAggregateResourceConfig - - config:DescribeConfigurationRecorders - - config:DescribeAggregationAuthorizations - - config:DescribeConfigurationAggregators - Resource: '*' - - Sid: ElasticPostureOrganizations - Effect: Allow - Action: - - organizations:DescribeOrganization - - organizations:ListAccounts - - organizations:ListAccountsForParent - - organizations:ListOrganizationalUnitsForParent - - organizations:ListRoots - - organizations:ListDelegatedAdministrators - Resource: '*' - - Sid: ElasticPostureSupplemental - Effect: Allow - Action: - - access-analyzer:ListAnalyzers - - account:GetAlternateContact - Resource: '*' - - Sid: ElasticPostureCrossAccountAssumeRole - Effect: Allow - Action: - - sts:AssumeRole - Resource: '*' - - Sid: ElasticPostureEKS - Effect: Allow - Action: - - eks:DescribeCluster - - eks:ListClusters - - ec2:DescribeSecurityGroups - - ec2:DescribeSubnets - - iam:GetRole - - iam:ListAttachedRolePolicies - Resource: '*' + # aws/guardduty: pre-dates provider_permissions; grant carried over + # from the shipped cloud-connectors-guardduty template. + - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess Outputs: RoleArn: From 2bc6e791c92fdec2cbf4f71baf233d33187609c1 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Tue, 4 Aug 2026 14:17:02 -0400 Subject: [PATCH 6/9] Add all remaining integration permissions to the Federated Identity CFT Adds 15 inline IAM policies to the federated identity template covering all remaining aws package integrations: inspector, securityhub, cloudwatch logs, shared metrics base (cloudwatch:ListMetrics, GetMetricData, tag:GetResources, ec2:DescribeRegions), awshealth, billing, dynamodb, ebs, ec2, ecs, elb, lambda, rds, sns, sqs, and transitgateway. Paired integrations PR: elastic/integrations#20526 Co-Authored-By: Claude Sonnet 4.6 --- .../cloudformation/federated-identity-aws.yml | 265 ++++++++++++++++++ 1 file changed, 265 insertions(+) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index e30c36812a..6f01f53f01 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -48,6 +48,271 @@ Resources: # from the shipped cloud-connectors-guardduty template. - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess + # aws/inspector: inspector2 data stream + ElasticAwsInspector: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsInspector-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - inspector2:ListFindings + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/securityhub: securityhub_findings, securityhub_findings_full_posture, securityhub_insights + ElasticAwsSecurityHub: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsSecurityHub-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + + # securityhub_findings + securityhub_findings_full_posture call /findings + # securityhub_insights calls /insights/get + # Both /findings and GetFindingsV2 authorize as securityhub:GetFindings + - securityhub:GetFindings + - securityhub:GetInsights + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/cloudwatch: cloudwatch_logs (aws-cloudwatch) and cloudwatch_metrics (aws/metrics) + # Also covers ec2_logs, elb_logs, lambda_logs via the shared aws-cloudwatch input + ElasticAwsCloudwatchLogs: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsCloudwatchLogs-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - logs:DescribeLogGroups + - logs:FilterLogEvents + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # Shared base for all aws/metrics metricsets (cloudwatch, ec2, elb, lambda, rds, etc.) + ElasticAwsMetrics: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsMetrics-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ec2:DescribeRegions + - cloudwatch:ListMetrics + - cloudwatch:GetMetricData + - tag:GetResources + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/awshealth: health events data stream + ElasticAwsHealth: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsHealth-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - health:DescribeEvents + - health:DescribeEventDetails + - health:DescribeAffectedEntities + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/billing: billing metrics data stream + ElasticAwsBilling: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsBilling-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ce:GetCostAndUsage + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/dynamodb: dynamodb metrics data stream + ElasticAwsDynamoDB: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsDynamoDB-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - dynamodb:ListTables + - dynamodb:DescribeTable + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/ebs: ebs metrics data stream + ElasticAwsEBS: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsEBS-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ec2:DescribeVolumes + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/ec2: ec2_metrics data stream + ElasticAwsEC2: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsEC2-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ec2:DescribeInstances + - ec2:DescribeInstanceStatus + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/ecs: ecs_metrics data stream + ElasticAwsECS: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsECS-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ecs:ListClusters + - ecs:DescribeClusters + - ecs:ListServices + - ecs:DescribeServices + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/elb: elb_metrics data stream + ElasticAwsELB: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsELB-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - elasticloadbalancing:DescribeLoadBalancers + - elasticloadbalancing:DescribeTargetGroups + - elasticloadbalancing:DescribeTargetHealth + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/lambda: lambda metrics data stream + ElasticAwsLambda: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsLambda-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - lambda:ListFunctions + - lambda:GetFunction + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/rds: rds metrics data stream + ElasticAwsRDS: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsRDS-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - rds:DescribeDBInstances + - rds:DescribeDBClusters + - rds:ListTagsForResource + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/sns: sns metrics data stream + ElasticAwsSNS: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsSNS-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - sns:ListTopics + - sns:GetTopicAttributes + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/sqs: sqs metrics data stream + ElasticAwsSQS: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsSQS-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - sqs:ListQueues + - sqs:GetQueueAttributes + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + + # aws/transitgateway: transitgateway metrics data stream + ElasticAwsTransitGateway: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsTransitGateway-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ec2:DescribeTransitGateways + - ec2:DescribeTransitGatewayAttachments + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + Outputs: RoleArn: Description: The ARN of the IAM Role. Paste this into Kibana. From 08dbf06497189fc7d2b435ffa7b2aa140d368609 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Tue, 4 Aug 2026 14:28:16 -0400 Subject: [PATCH 7/9] Add aws Config permissions to the Federated Identity CFT Co-Authored-By: Claude Sonnet 4.6 --- deploy/cloudformation/federated-identity-aws.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 6f01f53f01..9dc1219665 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -135,6 +135,22 @@ Resources: Roles: - !Ref ElasticFederatedIdentityRole + # aws/config: rule listing and per-rule compliance reads for the AWS Config data stream + ElasticAwsConfig: + Type: AWS::IAM::Policy + Properties: + PolicyName: !Sub ElasticAwsConfig-${AWS::StackName} + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - config:DescribeConfigRules + - config:GetComplianceDetailsByConfigRule + Resource: '*' + Roles: + - !Ref ElasticFederatedIdentityRole + # aws/billing: billing metrics data stream ElasticAwsBilling: Type: AWS::IAM::Policy From 33cd03f837bed3cc0a0aad6742338bad510db612 Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Tue, 4 Aug 2026 14:54:12 -0400 Subject: [PATCH 8/9] =?UTF-8?q?Remove=20ElasticAwsSecurityHub=20=E2=80=94?= =?UTF-8?q?=20moving=20to=20separate=20PR=20(ingest-dev#8812)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- .../cloudformation/federated-identity-aws.yml | 20 ------------------- 1 file changed, 20 deletions(-) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 9dc1219665..432ca41579 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -63,26 +63,6 @@ Resources: Roles: - !Ref ElasticFederatedIdentityRole - # aws/securityhub: securityhub_findings, securityhub_findings_full_posture, securityhub_insights - ElasticAwsSecurityHub: - Type: AWS::IAM::Policy - Properties: - PolicyName: !Sub ElasticAwsSecurityHub-${AWS::StackName} - PolicyDocument: - Version: "2012-10-17" - Statement: - - Effect: Allow - Action: - - # securityhub_findings + securityhub_findings_full_posture call /findings - # securityhub_insights calls /insights/get - # Both /findings and GetFindingsV2 authorize as securityhub:GetFindings - - securityhub:GetFindings - - securityhub:GetInsights - Resource: '*' - Roles: - - !Ref ElasticFederatedIdentityRole - # aws/cloudwatch: cloudwatch_logs (aws-cloudwatch) and cloudwatch_metrics (aws/metrics) # Also covers ec2_logs, elb_logs, lambda_logs via the shared aws-cloudwatch input ElasticAwsCloudwatchLogs: From 83fb8a6131952b25121fca9086499c8e5e4381da Mon Sep 17 00:00:00 2001 From: Sean Rathier Date: Wed, 5 Aug 2026 12:00:49 -0400 Subject: [PATCH 9/9] Add SecurityAudit to combined Federated Identity CFT for CSPM and CAI Consolidates the grants previously split across the standalone CSPM and Cloud Asset Inventory remote-role templates into the single combined CFT. SecurityAudit covers both cloud_security_posture and cloud_asset_inventory; the intent is for this template to replace the separate per-product CFTs. Co-Authored-By: Claude Sonnet 4.6 --- deploy/cloudformation/federated-identity-aws.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deploy/cloudformation/federated-identity-aws.yml b/deploy/cloudformation/federated-identity-aws.yml index 432ca41579..ba52f228d7 100644 --- a/deploy/cloudformation/federated-identity-aws.yml +++ b/deploy/cloudformation/federated-identity-aws.yml @@ -1,6 +1,6 @@ AWSTemplateFormatVersion: "2010-09-09" -Description: Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for the Elastic AWS integrations that support Federated Identity, accumulated per integration from each package's declared provider_permissions. +Description: 'Creates an IAM Role for Elastic Federated Identity (Cloud Connectors). Grants read-only permissions for all Elastic AWS integrations that support Federated Identity: the aws package integrations (GuardDuty, Inspector, Config, CloudWatch, and metrics services), Cloud Security Posture Management (cloud_security_posture), and Cloud Asset Inventory (cloud_asset_inventory).' Parameters: ElasticResourceId: @@ -48,6 +48,13 @@ Resources: # from the shipped cloud-connectors-guardduty template. - arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess + # cloud_security_posture (CSPM) and cloud_asset_inventory (CAI): + # both require SecurityAudit for broad read-only access to AWS config + # and resource metadata. Consolidates the grants previously split across + # deploy/cloudformation/cloud-connectors-remote-role.yml (CSPM) and + # deploy/asset-inventory-cloudformation/cloud-connectors-remote-role.yml (CAI). + - arn:aws:iam::aws:policy/SecurityAudit + # aws/inspector: inspector2 data stream ElasticAwsInspector: Type: AWS::IAM::Policy