Add versioned root IaC blueprints and per-package iac patches/links

[bhapas]

Summary

Host the canonical federated-identity CloudFormation template at the repo root instead of shipping a elastic_iac_blueprints registry package.

• Canonical template: blueprints/aws/federated-identity/account/v1/account.cloudformation.json
• packages/{aws,cloud_asset_inventory,cloud_security_posture}/iac/ ships RFC 6902 JSON patches plus account.cloudformation.json.link (relative path + sha256 of the versioned root template)
• Manifest iac_blueprints ids use aws/federated-identity/account/v1
• Package versions: aws 7.2.0, cloud_asset_inventory 1.8.0, cloud_security_posture 3.6.0
• format_version bumped to 3.7.0 on these three packages (depends on the companion package-spec PR that adds iac/ + iac_blueprints in 3.7.0)

Does not add packages/elastic_iac_blueprints/.

Related

• Relates to Support dynamic IaC for integrations #20240 and POC [DRAFT] POC: share canonical blueprint via .link files from repo root #20721 (does not modify them)
• Companion package-spec: Add iac/ folder validation for JSON patches and linked base templates package-spec#1227
• Companion package-registry: Expose package iac/ folder and iac_blueprints in EPR package-registry#1940

Test plan

• Confirm blueprints/aws/federated-identity/account/v1/account.cloudformation.json is valid CloudFormation JSON
• Confirm all three .link files share the same relative path and sha256
• Confirm shasum -a 256 of the root template matches the checksum in the .link files
• Confirm no packages/elastic_iac_blueprints/ package is present
• Review iac_blueprints ids are aws/federated-identity/account/v1 (not the unversioned id)
• After package-spec 3.7.0 lands, run elastic-package check for aws, cloud_asset_inventory, and cloud_security_posture
• After package-registry expose-iac/ lands, confirm iac/ (patches + materialized template) is present in the built/pulled package zip

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

⏳ Build in-progress, with failures

• Buildkite Build
• Commit: 5422840

Failed CI Steps

• Check integrations aws
• Check integrations aws_bedrock
• Check integrations aws_logs
• Check integrations beyondtrust_epm
• Check integrations canva
• Check integrations carbon_black_cloud
• Check integrations cisco_umbrella
• Check integrations cloud_asset_inventory
• Check integrations cloud_security_posture
• Check integrations cloudflare_logpush
• Check integrations crowdstrike
• Check integrations f5_bigip
• Check integrations github
• Check integrations imperva_cloud_waf
• Check integrations jamf_protect
• Check integrations kolide
• Check integrations netskope
• Check integrations sentinel_one_cloud_funnel
• Check integrations servicenow
• Check integrations sublime_security
• Check integrations symantec_endpoint_security
• Check integrations tanium
• Check integrations trellix_edr_cloud

History

• 💔 Build #47863 failed 406309a