[aws_mq] Enable Identity Federation for agentless deployments - #20817
Open
seanrathier wants to merge 4 commits into
Open
[aws_mq] Enable Identity Federation for agentless deployments#20817seanrathier wants to merge 4 commits into
seanrathier wants to merge 4 commits into
Conversation
…-dev#8812) - Bump format_version 3.3.1 → 3.6.4 (required for var_groups + provider_permissions) - Bump version 1.0.0 → 2.0.0 (major bump frees 1.x namespace for backport-aws_mq-1.x) - Bump kibana and agent floors to ^9.6.0 (use_cloud_connectors requires Agent 9.6.0+) - Add supports_identity_federation var - Add var_groups with identity_federation, direct_access_key, temporary_access_key, assume_role, and shared_credentials options - Enable agentless deployment mode (beta) on the amazon_mq policy template - Add use_cloud_connectors to all 5 stream templates (activemq_metrics, rabbitmq_metrics, activemq_audit_logs, activemq_general_logs, rabbitmq_general_logs) - Fix pipeline processor tags and on_failure messages (SVR00006/SVR00009) surfaced by the format_version bump Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Elastic Docs Style Checker (Vale)Summary: 1 suggestion found 💡 Suggestions (1): Optional style improvements. Apply when helpful.
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Contributor
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
activemq_audit_logs |
12500 | 9523.81 | -2976.19 (-23.81%) | 💔 |
To see the full report comment with /test benchmark fullreport
Declares IAM permissions needed for Identity Federation role provisioning via the IaCP render path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
seanrathier
force-pushed
the
aws_mq/identity-federation
branch
from
August 19, 2026 21:06
c0c0947 to
26c6004
Compare
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Enables Identity Federation and agentless deployment for the Amazon MQ integration.
Changes:
- Adds credential selection, agentless support, permissions, and updated version floors.
- Enables Cloud Connectors across all five stream templates.
- Updates ingest pipelines and records the 2.0.0 release.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Summary |
|---|---|
packages/aws_mq/manifest.yml |
Adds federation, agentless configuration, permissions, and version updates. |
packages/aws_mq/data_stream/rabbitmq_metrics/elasticsearch/ingest_pipeline/default.yml |
Updates processor tags and failure context. |
packages/aws_mq/data_stream/rabbitmq_metrics/agent/stream/stream.yml.hbs |
Enables Cloud Connectors. |
packages/aws_mq/data_stream/rabbitmq_general_logs/elasticsearch/ingest_pipeline/default.yml |
Updates processor tags and failure context. |
packages/aws_mq/data_stream/rabbitmq_general_logs/agent/stream/aws-cloudwatch.yml.hbs |
Enables Cloud Connectors. |
packages/aws_mq/data_stream/activemq_metrics/elasticsearch/ingest_pipeline/default.yml |
Updates processor tags and failure context. |
packages/aws_mq/data_stream/activemq_metrics/agent/stream/stream.yml.hbs |
Enables Cloud Connectors. |
packages/aws_mq/data_stream/activemq_general_logs/elasticsearch/ingest_pipeline/default.yml |
Updates processor tags and failure context. |
packages/aws_mq/data_stream/activemq_general_logs/agent/stream/aws-cloudwatch.yml.hbs |
Enables Cloud Connectors. |
packages/aws_mq/data_stream/activemq_audit_logs/elasticsearch/ingest_pipeline/default.yml |
Updates processor tags and failure context. |
packages/aws_mq/data_stream/activemq_audit_logs/agent/stream/aws-cloudwatch.yml.hbs |
Enables Cloud Connectors. |
packages/aws_mq/changelog.yml |
Documents the 2.0.0 release. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…reaking-change Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
✅ All changelog entries have the correct PR link. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
packages/aws_mq/manifest.yml:154
- The shared
aws/metricsinput performsec2:DescribeRegionsduring startup (the AWS package documents it as a required call), and the federatedElasticAwsMetricspolicy grants it. This newprovider_permissionsdeclaration omits that action, so the Amazon MQ metrics input under-declares the permissions needed for Identity Federation. Please addec2:DescribeRegionshere.
- name: cloudwatch:GetMetricData
- name: cloudwatch:ListMetrics
- name: tag:GetResources
packages/aws_mq/manifest.yml:140
- Enabling the agentless deployment mode without regenerating the package documentation leaves both
docs/README.mdand_dev/build/docs/README.mdsaying that Elastic Agent must be installed, with no Agentless deployment section. That directly contradicts this new mode and will mislead users; rerun the package build (or update the generated docs) and include the resulting documentation changes.
agentless:
enabled: true
release: beta
Comment on lines
+138
to
+140
| agentless: | ||
| enabled: true | ||
| release: beta |
Contributor
There was a problem hiding this comment.
@seanrathier , do you want to take up this suggestion ?
💚 Build Succeeded
History
|
agithomas
approved these changes
Aug 26, 2026
agithomas
left a comment
agithomas
left a comment
Contributor
There was a problem hiding this comment.
The change looks good to me. Kindly address the suggestion for improvement.
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Enable Identity Federation (Cloud Connectors) for the Amazon MQ integration.
Adds
var_groupswith a credential selector (Identity Federation, Direct Access Keys, Temporary Access Keys, Assume Role, Shared Credentials), enables agentless deployment mode, and wiresuse_cloud_connectorsinto all five stream templates. Bumpsformat_versionto 3.6.4 andkibana/agentfloors to^9.6.0(required foruse_cloud_connectors). Fixes pipeline processor tag andon_failurehygiene surfaced by the format_version bump.Major version bump (
1.0.0→2.0.0) frees the1.xnamespace forbackport-aws_mq-1.x, which will carry patch/minor fixes for users on stacks below^9.6.0. See elastic/ingest-dev#8788 for the branching strategy.Part of elastic/ingest-dev#8812.
Checklist
changelog.ymlfile.Author's Checklist
backport-aws_mq-1.xbranch created on elastic/integrations from the last1.0.0release commit@elastic/obs-infraobs-integrationson the major version bump + Kibana floor changeElasticAwsMetricsandElasticAwsCloudwatchLogsin [CFT] Add ElasticAwsSecurityHub policy to federated-identity-aws template cloudbeat#8030Related
🤖 Generated with Claude Code