[CFT] Add ElasticAwsSecurityHub policy to federated-identity-aws template

[seanrathier]

Summary

Adds the ElasticAwsSecurityHub IAM policy resource to deploy/cloudformation/federated-identity-aws.yml, granting the permissions required by the aws_securityhub and aws package SecurityHub data streams for Federated Identity (Cloud Connectors) deployments.

The remaining packages in elastic/ingest-dev#8812 (aws_bedrock, aws_bedrock_agentcore, aws_mq, aws_logs) require no new policy blocks — their streams read exclusively from CloudWatch metrics and CloudWatch Logs, which are already covered by the existing ElasticAwsMetrics and ElasticAwsCloudwatchLogs policies.

Permissions added

Action	Authorizes
securityhub:GetFindings	POST /findings (aws/securityhub_findings, aws/securityhub_findings_full_posture) and POST /findingsv2 (aws_securityhub/finding) — both operations use this IAM action
securityhub:GetInsights	POST /insights/get (aws/securityhub_insights)

Related

• [aws] Enable Identity Federation for aws.securityhub data stream and standalone SecurityHub integration integrations#20529 — Enable Identity Federation for aws package SecurityHub streams and standalone aws_securityhub package
• elastic/ingest-dev#8812 — per-package federation rollout tracking
• elastic/ingest-dev#9116 — external_id / ExternalId removed from federation trust policy

🤖 Generated with Claude Code

[mergify]

This pull request does not have a backport label. Could you fix it @seanrathier? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b seanrathier/federated-identity-aws-remaining upstream/seanrathier/federated-identity-aws-remaining
git merge upstream/main
git push upstream seanrathier/federated-identity-aws-remaining

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request