[aws_securityhub] Enable Identity Federation for agentless deployments - #20436
Draft
seanrathier wants to merge 5 commits into
Draft
[aws_securityhub] Enable Identity Federation for agentless deployments#20436seanrathier wants to merge 5 commits into
seanrathier wants to merge 5 commits into
Conversation
Add tag fields to every processor in all aws_securityhub ingest pipelines using elastic-package modify --modifiers pipeline-tag, and update pipeline-level on_failure error messages to include _ingest.pipeline per the SVR00009 linter rule. Both are requirements that will be enforced when the package format_version is bumped to 3.6.x for Identity Federation support. Also fix a pre-existing copy-paste bug surfaced by the tagging: the pipeline_object_evidence pipeline processor in default.yml was tagged pipeline_object_device, duplicating the device processor's tag. Landing these changes separately keeps the upcoming format_version bump PR small, following the precedent of elastic#19824 for the aws package. No functional effect at format_version 3.5.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add a var_groups credential selector to the aws_securityhub package, offering Identity Federation (Cloud Connectors) on the agentless path while preserving every existing credential method for agent-based deployments. The CloudFormation template is rendered by the IaC Provider at onboard time from the declared provider_permissions; no static template URL is used. - Bump format_version to 3.6.4 (var_groups needs 3.6.0, provider_permissions needs 3.6.4) - Raise Kibana and Agent floors to ^9.4.0 (auth.aws cloud connector support in the CEL input requires Agent 9.4.0+) - Add supports_identity_federation var and the use_cloud_connectors hook in the CEL stream template - Declare provider_permissions on the cel input: the GetFindingsV2 API authorizes via securityhub:GetFindings per the AWS API reference Depends on the pipeline hygiene pre-landing in elastic#20435. Part of elastic/ingest-dev#8812. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Contributor
🚀 Benchmarks reportTo see the full report comment with |
Kibana renders the template via the IaC Provider first and falls back to opening this quick-create URL when the render fails (422/502). Same S3 bucket and URL shape as the aws package's existing URL, but pointing at the incremental federated-identity-aws template, version pinned to the package's Kibana floor minor. The fallback only functions once elastic/cloudbeat#7422 merges and publishes the template to S3. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
Changelog link mismatch — expected
Tip If expected, add the |
💔 Build Failed
Failed CI StepsHistory
|
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Background
Part of https://github.com/elastic/ingest-dev/issues/8812 —
aws_securityhubis the named exit criterion for expanding Identity Federation beyond theawspackage.Depends on #20435 (pipeline hygiene pre-landing): the
format_versionbump to 3.6.4 in this PR activates pipeline validators that #20435 satisfies. This PR is stacked on that branch and includes its commits until it merges.What changed
format_version3.5.0 → 3.6.4 (var_groupsrequires 3.6.0;provider_permissionsrequires 3.6.4)^9.4.0—auth.awscloud connector support in the CEL input requires Agent 9.4.0+. The previous floor was^9.3.0, so no stack line is dropped.var_groupscredential selector (Setup Access) with six options: Identity Federation (agentless-only), Direct Access Keys (both modes), and Temporary Access Keys / Assume Role / Assume Role with External ID / Shared Credentials (agent-only, hidden in agentless)supports_identity_federationvar wired touse_cloud_connectorsin the CEL stream template'sauth.awsblockprovider_permissionsdeclared on thecelinput:securityhub:GetFindings— note the CEL program calls theGetFindingsV2API (POST /findingsv2), but per the AWS API reference, "GetFindings and GetFindingsV2 both use securityhub:GetFindings in the Action element of an IAM policy statement"iac_template_urlwired as the fallback: Kibana renders via the IaC Provider first and opens this quick-create URL only when the render fails (422/502). It points at the incrementalfederated-identity-awstemplate (same S3 bucket/URL shape as theawspackage's URL, version pinned to the Kibana floor minor). The fallback only functions once the template publishes to S3 with the Security Hub permissions included — that requires both Add CloudFormation template for Federated Identity (AWS) cloudbeat#7422 (the incremental GuardDuty-only baseline) and Add aws_securityhub permissions to the Federated Identity template cloudbeat#7588 (stacked on it, mirrors this PR'sprovider_permissionsas theElasticAwsSecurityHubpolicy).Verification
elastic-package lintandelastic-package buildpass at format_version 3.6.4Checklist
changelog.ymlfile.🤖 Generated with Claude Code