[aws_logs] Enable Identity Federation for agentless CloudWatch deployments - #20823
Open
seanrathier wants to merge 4 commits into
Open
[aws_logs] Enable Identity Federation for agentless CloudWatch deployments#20823seanrathier wants to merge 4 commits into
seanrathier wants to merge 4 commits into
Conversation
…ments (ingest-dev#8812) - Bump format_version 3.3.1 → 3.6.4 (required for var_groups + provider_permissions) - Bump version 1.8.3 → 2.0.0 (major bump frees 1.x namespace for backport-aws_logs-1.x) - Bump kibana and agent floors to ^9.6.0 (use_cloud_connectors requires Agent 9.6.0+) - Add supports_identity_federation var - Add var_groups with identity_federation, direct_access_key, temporary_access_key, assume_role, and shared_credentials options - Enable agentless deployment mode (beta) on the aws_logs policy template - Pin aws-s3 input to deployment_modes: [default] (aws-s3 is not agentless-eligible) - Add use_cloud_connectors to the aws-cloudwatch stream template Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Elastic Docs Style Checker (Vale)Summary: 1 suggestion found 💡 Suggestions (1): Optional style improvements. Apply when helpful.
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Declares IAM permissions needed for Identity Federation role provisioning via the IaCP render path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
seanrathier
force-pushed
the
aws_logs/identity-federation
branch
from
August 19, 2026 21:06
c82c29c to
0692a75
Compare
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
seanrathier
added
Integration:aws_logs
seanrathier
marked this pull request as ready for review
August 21, 2026 19:52
Contributor
There was a problem hiding this comment.
Pull request overview
Enables Identity Federation (Cloud Connectors) and agentless deployment support for the aws_logs integration’s CloudWatch-based collection, aligning the package with Elastic Stack/Agent capabilities introduced in ^9.6.0.
Changes:
- Bump package to
2.0.0, updateformat_versionto3.6.4, and raise Kibana/Agent minimum versions to^9.6.0. - Add
var_groupscredential selector (including Identity Federation) and enableagentlessdeployment mode at the policy template level, while restrictingaws-s3to default (agent-based) deployments. - Wire
supports_identity_federationinto the CloudWatch stream template viause_cloud_connectors, and document the change inchangelog.yml.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/aws_logs/manifest.yml | Raises stack/agent floors, adds deployment modes, introduces credential selection var_group, and restricts S3 input to default deployments. |
| packages/aws_logs/data_stream/generic/agent/stream/aws-cloudwatch.yml.hbs | Adds conditional use_cloud_connectors emission for Identity Federation support. |
| packages/aws_logs/changelog.yml | Adds a 2.0.0 changelog entry describing the Identity Federation + agentless updates and version floor bump. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
constanca-m
approved these changes
Aug 24, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
… breaking-change Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
✅ All changelog entries have the correct PR link. |
Comment on lines
+94
to
+96
| {{#if supports_identity_federation}} | ||
| use_cloud_connectors: {{supports_identity_federation}} | ||
| {{/if}} |
Comment on lines
+41
to
+49
| provider_permissions: | ||
| - provider: aws | ||
| description: CloudWatch Logs read access for custom log collection. | ||
| permissions: | ||
| - name: logs:DescribeLogGroups | ||
| - name: logs:DescribeLogStreams | ||
| - name: logs:FilterLogEvents | ||
| - name: logs:GetLogEvents | ||
| - name: logs:GetLogGroupFields |
💚 Build Succeeded
History
cc @seanrathier |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Enable Identity Federation (Cloud Connectors) for the Custom AWS Logs integration.
Adds
var_groupswith a credential selector (Identity Federation, Direct Access Keys, Temporary Access Keys, Assume Role, Shared Credentials), enables agentless deployment mode for theaws-cloudwatchinput, and wiresuse_cloud_connectorsinto the cloudwatch stream template. Theaws-s3input is pinned todeployment_modes: ["default"]as it is not agentless-eligible. Bumpsformat_versionto 3.6.4 andkibana/agentfloors to^9.6.0. No pipeline hygiene changes needed (no ingest pipelines in this package).Major version bump (
1.8.3→2.0.0) frees the1.xnamespace forbackport-aws_logs-1.x, which will carry patch/minor fixes for users on stacks below^9.6.0. See elastic/ingest-dev#8788 for the branching strategy.Part of elastic/ingest-dev#8812.
Checklist
changelog.ymlfile.Author's Checklist
backport-aws_logs-1.xbranch created on elastic/integrations from the last1.8.3release commit@elastic/obs-ds-hosted-serviceson the major version bump + Kibana floor changeElasticAwsCloudwatchLogsin [CFT] Add ElasticAwsSecurityHub policy to federated-identity-aws template cloudbeat#8030Related
ElasticAwsCloudwatchLogs)🤖 Generated with Claude Code