[aws] Enable Identity Federation for SecurityHub data streams

[seanrathier]

Important

Parked. The aws package's securityhub template has an open deprecate-or-coexist question versus the standalone aws_securityhub package, which is the intended vehicle for Security Hub federation (#20436, paired with elastic/cloudbeat#7588). This PR stays draft until that decision lands; if the legacy template is deprecated, close this unmerged.

Proposed commit message

Enable Identity Federation for the aws package SecurityHub data streams.

WHAT: migrates securityhub_findings, securityhub_findings_full_posture, and securityhub_insights HTTPJSON templates from hand-rolled SigV4 signing (X-Amz-Date header + Authorization set transforms, including the pagination re-sign) to the input's auth.aws configuration with use_cloud_connectors driven by the supports_identity_federation var. Removes the identity_federation gate from the securityhub policy template.

WHY: the hand-rolled signing never set X-Amz-Security-Token, so session tokens were silently broken, and it blocked the Cloud Connectors zero-credential flow. Part of ingest-dev#8812 (SecurityHub federation is scoped there, not under ingest-dev#8802).

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs. (E2E validation pending — see test plan below)
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices (no dashboards added or changed)

Author's Checklist

• All three securityhub streams validated E2E via Identity Federation (no AccessDeniedException, streams HEALTHY)
• CFT permissions: securityhub:GetInsights still needs adding on the cloudbeat side — Add aws_securityhub permissions to the Federated Identity template cloudbeat#7588 currently carries securityhub:GetFindings only
• Rebase over main after [aws] Enable Identity Federation for all remaining policy templates #20527 merges so the 7.2.0 changelog entry slots in beneath this PR's 7.3.0

How to test this PR locally

cd packages/aws
elastic-package check
elastic-package test policy

For the federated path E2E:

1. Deploy the federated identity CFT with securityhub:GetFindings and securityhub:GetInsights on the role
2. In Fleet, create an agentless AWS integration using the Identity Federation credential type and enable the SecurityHub CSPM policy template
3. Validate securityhub_findings, securityhub_findings_full_posture, and securityhub_insights all show HEALTHY with no AccessDeniedException in agent logs

Related issues

• Relates elastic/ingest-dev#8812
• Relates Add aws_securityhub permissions to the Federated Identity template cloudbeat#7588 (SecurityHub CFT permissions — needs GetInsights added)
• Relates [aws] Enable Identity Federation for all remaining policy templates #20527 (rest of the aws package federation, under elastic/ingest-dev#8802)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 0d97cd3

History

• 💔 Build #47180 failed da5e049