diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index 79206a5ee87..af8b8e8c7ef 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "7.3.0" + changes: + - description: Enable Identity Federation (Cloud Connectors) for the Amazon Inspector data stream by migrating its HTTPJSON template from hand-rolled SigV4 signing to the input's `auth.aws` configuration. This also fixes temporary credentials (session tokens) and adds Role ARN and shared-credential support, none of which the hand-rolled signing handled. + type: enhancement + link: https://github.com/elastic/integrations/pull/20439 - version: "7.1.1" changes: - description: Add `data_stream.namespace` to the Amazon Inspector vulnerability latest transform's unique key so findings are tracked per namespace, preventing findings ingested into non-default namespaces from being dropped or conflated in the latest index. Bump transform's destination suffix to `-v2`. diff --git a/packages/aws/data_stream/inspector/agent/stream/httpjson.yml.hbs b/packages/aws/data_stream/inspector/agent/stream/httpjson.yml.hbs index e1b8ba80c08..e42931e2a5e 100644 --- a/packages/aws/data_stream/inspector/agent/stream/httpjson.yml.hbs +++ b/packages/aws/data_stream/inspector/agent/stream/httpjson.yml.hbs @@ -16,9 +16,6 @@ request.ssl: {{ssl}} request.url: https://inspector2.{{aws_region}}.{{tld}}/findings/list request.transforms: - - set: - target: header.X-Amz-Date - value: '[[formatDate (now) "20060102T150405Z"]]' - set: target: body.maxResults value: 100 @@ -41,21 +38,12 @@ request.transforms: value: '[{ "startInclusive": [[mul (div (toInt .cursor.last_update_datetime) 1000) 1000]], "endInclusive": 1956528000 }]' default: '[{ "startInclusive": [[mul (div (toInt (now (parseDuration "-{{initial_interval}}")).Unix) 1000) 1000]], "endInclusive": 1956528000 }]' value_type: json - - set: - target: header.Authorization - value: '[[$now := (now)]][[(sprintf "AWS4-HMAC-SHA256 Credential={{access_key_id}}/%s/{{aws_region}}/inspector2/aws4_request, SignedHeaders=host;x-amz-date, Signature=%s" (formatDate ($now) "20060102") (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" "AWS4{{secret_access_key}}" (formatDate ($now) "20060102"))) "{{aws_region}}")) "inspector2")) "aws4_request")) "AWS4-HMAC-SHA256\n" (formatDate ($now) "20060102T150405Z") "\n" (sprintf "%s/%s\n" (formatDate ($now) "20060102") "{{aws_region}}/inspector2/aws4_request") (hash "sha256" "POST\n" "/findings/list\n" "\n" "host:inspector2.{{aws_region}}.{{tld}}\n" (sprintf "x-amz-date:%s\n\n" (formatDate ($now) "20060102T150405Z")) "host;x-amz-date\n" (hash "sha256" (sprintf `%s` .body)))))]]' -{{!-- https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html --}} response.pagination: - set: target: body.nextToken value: '[[if (eq (len .last_response.body.findings) 100)]][[.last_response.body.nextToken]][[end]]' fail_on_template_error: true do_not_log_failure: true - - delete: - target: header.Authorization - - set: - target: header.Authorization - value: '[[$now := (now)]][[(sprintf "AWS4-HMAC-SHA256 Credential={{access_key_id}}/%s/{{aws_region}}/inspector2/aws4_request, SignedHeaders=host;x-amz-date, Signature=%s" (formatDate ($now) "20060102") (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" (hexDecode (hmac "sha256" "AWS4{{secret_access_key}}" (formatDate ($now) "20060102"))) "{{aws_region}}")) "inspector2")) "aws4_request")) "AWS4-HMAC-SHA256\n" (formatDate ($now) "20060102T150405Z") "\n" (sprintf "%s/%s\n" (formatDate ($now) "20060102") "{{aws_region}}/inspector2/aws4_request") (hash "sha256" "POST\n" "/findings/list\n" "\n" "host:inspector2.{{aws_region}}.{{tld}}\n" (sprintf "x-amz-date:%s\n\n" (formatDate ($now) "20060102T150405Z")) "host;x-amz-date\n" (hash "sha256" (sprintf `%s` .body)))))]]' {{!-- Store the poll time minus lag_time as the watermark. Because the window advances by wall-clock time (not by a value seen in the data), a finding whose updatedAt predates the poll but only becomes visible later would be missed; the lag_time @@ -66,6 +54,37 @@ cursor: value: '[[if (ne (len .last_response.body.findings) 100)]][[(now (parseDuration "-{{lag_time}}")).Unix]][[end]]' response.split: target: body.findings +auth.aws: +{{#if access_key_id}} + access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} + secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} + session_token: {{session_token}} +{{/if}} +{{#if shared_credential_file}} + shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if credential_profile_name}} + credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if role_arn}} + role_arn: {{role_arn}} +{{/if}} +{{#if external_id}} + external_id: {{external_id}} +{{/if}} +{{#if assume_role_duration}} + assume_role.duration: {{assume_role_duration}} +{{/if}} +{{#if assume_role_expiry_window}} + assume_role.expiry_window: {{assume_role_expiry_window}} +{{/if}} +{{#if supports_identity_federation}} + use_cloud_connectors: {{supports_identity_federation}} +{{/if}} tags: {{#if preserve_original_event}} - preserve_original_event diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index 6aea6328c5e..2c86dbd3d56 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.6.1 name: aws title: AWS -version: 7.1.1 +version: 7.3.0 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration categories: @@ -1055,8 +1055,6 @@ policy_templates: - type: httpjson title: Collect Amazon Inspector logs via API description: Collecting Amazon Inspector logs via API. - hide_in_var_group_options: - credential_type: [identity_federation] screenshots: - src: /img/inspector-findings-overview-dashboard.png title: Inspector Findings Overview dashboard