Repository navigation
AWS Cloudtrail: add docs for IAM Roles Anywhere - #19140
chemamartinez merged 6 commits into
Conversation
7587b71 to
7e5cc7a
Compare
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
✅ Vale Linting ResultsNo issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
/test |
cafa986 to
62f1749
Compare
|
Failures in Buildkite seem to be unrelated. |
|
/test |
🚀 Benchmarks reportTo see the full report comment with |
|
|
||
| 1. [Download and install `aws_signing_helper`](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html) on the host running Elastic Agent. | ||
|
|
||
| 2. Add a profile to `~/.aws/config` that uses the helper as a [`credential_process`](https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html): |
There was a problem hiding this comment.
The path here is Linux-specific.
Also note that if shared_credential_file is set in the UI it will interfere with this (credentials.go), and the configuration is something that affects all aws data streams; should this be root-level documentation?
There was a problem hiding this comment.
Also note that if shared_credential_file is set in the UI it will interfere with this (credentials.go), and the configuration is something that affects all aws data streams; should this be root-level documentation?
That's a good point. I've added a note that I think it reflects the issue you are pointing to. Please let me know if this would solve your concerns.
TL;DRThe Buildkite failure is from the PR merge step, not from tests: CI could not auto-merge this branch with Remediation
Investigation detailsRoot CauseBuildkite failed during repository
This indicates branch drift against Evidence
Verification
Follow-up
Note 🔒 Integrity filter blocked 2 itemsThe following items were blocked because they don't meet the GitHub integrity level.
To allow these resources, lower tools:
github:
min-integrity: approved # merged | approved | unapproved | noneWhat is this? | From workflow: PR Buildkite Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
|
|
||
| 3. In the CloudTrail integration configuration, set the **Credential Profile Name** field to the profile name you defined (for example, `elastic-agent`). If you configure the profile as `[default]`, you can leave the field blank. | ||
|
|
||
| > **Note:** If the **Shared Credential File** field is set, the integration loads credentials only from that file and stops reading the default AWS shared config file. Ensure the profile with the `credential_process` entry is present in whichever file you specify, or leave the field blank to use the default config file location. |
There was a problem hiding this comment.
I think it needs to be noted that this is integration-wide and that this means that it will interact with other data streams. That should already be reasonably clear from the UI, but it never hurts to be clear.
💚 Build Succeeded
History
|
|
Package aws - 6.18.1 containing this change is available at https://epr.elastic.co/package/aws/6.18.1/ |
packages/aws/cloudtrail: document IAM Roles Anywhere authentication Add an "IAM Roles Anywhere" subsection under Advanced options in the CloudTrail integration docs. The new section explains how to configure aws_signing_helper as a credential_process entry in ~/.aws/config, allowing Elastic Agent instances running outside AWS to authenticate using X.509 certificates.
Proposed commit message
Checklist
changelog.ymlfile.