Skip to content

[Cloud Security] Add aws prefix to CSPM vars #14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

[Cloud Security] Add aws prefix to CSPM vars #14923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5504ea9
added aws prefix to CSPM aws vars
seanrathier Aug 13, 2025
600b835
add PR
seanrathier Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/cloud_security_posture/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@
# 1.4.x - 8.9.x
# 1.3.x - 8.8.x
# 1.2.x - 8.7.x
- version: "4.0.0-preview01"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the reasoning behind major version upgrade?
So far, we kept it in sync with major stack versions

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are at version 3. I perceived this to be a breaking change, warranting a major version change.

changes:
- description: Changed AWS input vars with aws. prefix
type: enhancement
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed the GH PR is labeled with breaking change but that's not in agreement with the changelog type. Assuming it's a breaking change that affects end users then I would expect to have a changes item with type: breaking-change explaining the impact and how users can handle the breaking change when they upgrade.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh, I was pretty sure that this would be a breaking eventually, however I managed to find a different path in Kibana to fix this issue so I will be closing this.

I will add the correct type next time.

link: https://github.com/elastic/integrations/pull/14923
- version: "3.0.1"
changes:
- description: Save GCP Project ID as string
Expand Down
18 changes: 18 additions & 0 deletions packages/cloud_security_posture/data_stream/findings/agent/stream/aws.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,21 +23,39 @@ config:
{{#if access_key_id}}
Copy link
Preview

Copilot AI Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The template now contains duplicate conditional blocks for both old and new variable names (e.g., access_key_id and aws.access_key_id). This duplication makes the template harder to maintain. Consider consolidating these into a single conditional or adding a comment explaining the backward compatibility strategy and deprecation timeline.

Copilot uses AI. Check for mistakes.

access_key_id: {{access_key_id}}
{{/if}}
{{#if aws.access_key_id}}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what happens if both access_key_id and aws.access_key_id are available?

I believe only one should be used to resolve source of truth

access_key_id is deprecated and its content is migrated to aws.access_key_id. then I'd use aws.access_key_id when available, and when not I'll check for access_key_id for compatibility

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was doing that in the aws.hbs file, the change checks for both values with and without the aws prefix. Or so I thought that was the solution you were referring to in DMs.

However, this change does not address showing the Fleet extension in Kibana for older versions of the integration; therefore, I am going to close this PR and have a CloudSetup mapping

access_key_id: {{aws.access_key_id}}
{{/if}}
{{#if secret_access_key}}
secret_access_key: {{secret_access_key}}
{{/if}}
{{#if aws.secret_access_key}}
secret_access_key: {{aws.secret_access_key}}
{{/if}}
{{#if session_token}}
session_token: {{session_token}}
{{/if}}
{{#if aws.session_token}}
session_token: {{aws.session_token}}
{{/if}}
{{#if shared_credential_file}}
shared_credential_file: {{shared_credential_file}}
{{/if}}
{{#if aws.shared_credential_file}}
shared_credential_file: {{aws.shared_credential_file}}
{{/if}}
{{#if credential_profile_name}}
credential_profile_name: {{credential_profile_name}}
{{/if}}
{{#if aws.credential_profile_name}}
credential_profile_name: {{aws.credential_profile_name}}
{{/if}}
{{#if role_arn}}
role_arn: {{role_arn}}
{{/if}}
{{#if aws.role_arn}}
role_arn: {{aws.role_arn}}
{{/if}}
{{#if aws.credentials.external_id}}
external_id: {{aws.credentials.external_id}}
{{/if}}
Expand Down
30 changes: 15 additions & 15 deletions packages/cloud_security_posture/data_stream/findings/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,26 +91,26 @@ streams:
assume_role:
- name: aws.credentials.type
value: assume_role
- name: role_arn
- name: aws.role_arn
- name: aws.account_type
direct_access_keys:
- name: aws.credentials.type
value: direct_access_keys
- name: access_key_id
- name: secret_access_key
- name: aws.access_key_id
- name: aws.secret_access_key
- name: aws.account_type
temporary_session:
- name: aws.credentials.type
value: temporary_keys
- name: access_key_id
- name: secret_access_key
- name: session_token
- name: aws.access_key_id
- name: aws.secret_access_key
- name: aws.session_token
- name: aws.account_type
shared_credentials:
- name: aws.credentials.type
value: shared_credentials
- name: shared_credential_file
- name: credential_profile_name
- name: aws.shared_credential_file
- name: aws.credential_profile_name
- name: aws.account_type
cloud_formation:
- name: aws.credentials.type
Expand All @@ -126,7 +126,7 @@ streams:
- name: aws.credentials.type
value: cloud_connectors
- name: aws.account_type
- name: role_arn
- name: aws.role_arn
- name: aws.credentials.external_id
vars:
- name: condition
Expand All @@ -137,41 +137,41 @@ streams:
multi: false
required: false
show_user: false
- name: access_key_id
- name: aws.access_key_id
type: text
title: Access Key ID
multi: false
required: false
show_user: true
secret: false
- name: secret_access_key
- name: aws.secret_access_key
type: password
title: Secret Access Key
multi: false
required: false
show_user: true
secret: true
- name: session_token
- name: aws.session_token
type: text
title: Session Token
multi: false
required: false
show_user: true
secret: false
- name: shared_credential_file
- name: aws.shared_credential_file
type: text
title: Shared Credential File
multi: false
required: false
show_user: false
description: Directory of the shared credentials file
- name: credential_profile_name
- name: aws.credential_profile_name
type: text
title: Credential Profile Name
multi: false
required: false
show_user: false
- name: role_arn
- name: aws.role_arn
type: text
title: ARN Role
multi: false
Expand Down
2 changes: 1 addition & 1 deletion packages/cloud_security_posture/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.3.2
name: cloud_security_posture
title: "Security Posture Management"
version: "3.0.1"
version: "4.0.0-preview01"
source:
license: "Elastic-2.0"
description: "Identify & remediate configuration risks in your Cloud infrastructure"
Expand Down