Add versioned root IaC blueprints and per-package iac patches/links

blueprints/aws/federated-identity/account/v1/account.cloudformation.json

@@ -0,0 +1,82 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "Elastic Federated Identity role for AWS — canonical base blueprint for single-account deployments. The cloud-iac-provisioner loads this template and appends RFC 6902 patches from each enabled integration as separate AWS::IAM::Policy resources.",
+  "Parameters": {
+    "ElasticResourceId": {
+      "Type": "String",
+      "Description": "Elastic resource ID (deployment component ID or serverless project ID). Used to construct the ExternalId trust condition, uniquely scoping this role to the Elastic deployment."
+    },
+    "ElasticRoleARN": {
+      "Type": "String",
+      "Default": "arn:aws:iam::254766567737:role/cloud_connectors",
+      "Description": "Elastic's super-role ARN that this role will trust. Change only for non-production Elastic environments."
+    }
+  },
+  "Resources": {
+    "ElasticFederatedIdentityRole": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "RoleName": { "Fn::Sub": "ElasticFederatedIdentity-${AWS::StackName}" },
+        "Path": "/",
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": { "Ref": "ElasticRoleARN" }
+              },
+              "Action": "sts:AssumeRole",
+              "Condition": {
+                "StringEquals": {
+                  "sts:ExternalId": {
+                    "Fn::Join": [
+                      "-",
+                      [
+                        { "Ref": "ElasticResourceId" },
+                        {
+                          "Fn::Select": [
+                            2,
+                            { "Fn::Split": ["/", { "Ref": "AWS::StackId" }] }
+                          ]
+                        }
+                      ]
+                    ]
+                  }
+                }
+              }
+            }
+          ]
+        },
+        "ManagedPolicyArns": []
+      }
+    }
+  },
+  "Outputs": {
+    "RoleArn": {
+      "Description": "ARN of the Elastic Federated Identity role. Paste this into Kibana when configuring the integration.",
+      "Value": { "Fn::GetAtt": ["ElasticFederatedIdentityRole", "Arn"] }
+    },
+    "ExternalId": {
+      "Description": "Full ExternalId used in the trust condition. Paste this into Kibana when configuring the integration.",
+      "Value": {
+        "Fn::Join": [
+          "-",
+          [
+            { "Ref": "ElasticResourceId" },
+            {
+              "Fn::Select": [
+                2,
+                { "Fn::Split": ["/", { "Ref": "AWS::StackId" }] }
+              ]
+            }
+          ]
+        ]
+      }
+    },
+    "StackId": {
+      "Description": "CloudFormation stack ID. Store in Kibana to construct stack-update URLs when additional integrations are enabled.",
+      "Value": { "Ref": "AWS::StackId" }
+    }
+  }
+}

packages/aws/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "7.2.0"
+  changes:
+    - description: Add iac/ JSON patches and a linked versioned federated-identity account base template (aws/federated-identity/account/v1).
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20728
 - version: "7.1.1"
   changes:
     - description: Add `data_stream.namespace` to the Amazon Inspector vulnerability latest transform's unique key so findings are tracked per namespace, preventing findings ingested into non-default namespaces from being dropped or conflated in the latest index. Bump transform's destination suffix to `-v2`.

packages/aws/iac/account.cloudformation.json.link

@@ -0,0 +1 @@
+../../../blueprints/aws/federated-identity/account/v1/account.cloudformation.json 469bf9341e21fc2fc2e9690d7c0ed76d2f0e5073db7ff8298656e469e60add73

packages/aws/iac/aws-federated-identity-account-apigateway.cloudformation.patches.json

@@ -0,0 +1,30 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSAPIGatewayPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSAPIGateway",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "APIGatewayReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "apigateway:GET"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-awshealth.cloudformation.patches.json

@@ -0,0 +1,32 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSHealthPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSHealth",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "HealthReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "health:DescribeEvents",
+                "health:DescribeEventDetails",
+                "health:DescribeAffectedEntities"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-billing.cloudformation.patches.json

@@ -0,0 +1,30 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSBillingPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSBilling",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "BillingReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "ce:GetCostAndUsage"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-cloudwatch-input.cloudformation.patches.json

@@ -0,0 +1,27 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSCloudWatchInputPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSCloudWatchInput",
+        "Roles": [{ "Ref": "ElasticFederatedIdentityRole" }],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "CloudWatchInputBase",
+              "Effect": "Allow",
+              "Action": [
+                "logs:DescribeLogGroups",
+                "logs:FilterLogEvents"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-config.cloudformation.patches.json

@@ -0,0 +1,32 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSConfigPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSConfig",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "ConfigReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "config:DescribeConfigRules",
+                "config:DescribeComplianceByConfigRule",
+                "config:GetComplianceDetailsByConfigRule"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-dynamodb.cloudformation.patches.json

@@ -0,0 +1,31 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSDynamoDBPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSDynamoDB",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "DynamoDBReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "dynamodb:ListTables",
+                "dynamodb:DescribeTable"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-ebs.cloudformation.patches.json

@@ -0,0 +1,30 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSEBSPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSEBS",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "EBSReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "ec2:DescribeVolumes"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-ec2.cloudformation.patches.json

@@ -0,0 +1,31 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSEC2Policy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSEC2",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "EC2ReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "ec2:DescribeInstances",
+                "ec2:DescribeInstanceStatus"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]

packages/aws/iac/aws-federated-identity-account-ecs.cloudformation.patches.json

@@ -0,0 +1,33 @@
+[
+  {
+    "op": "add",
+    "path": "/Resources/ElasticAWSECSPolicy",
+    "value": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyName": "ElasticAWSECS",
+        "Roles": [
+          {
+            "Ref": "ElasticFederatedIdentityRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "ECSReadAccess",
+              "Effect": "Allow",
+              "Action": [
+                "ecs:ListClusters",
+                "ecs:DescribeClusters",
+                "ecs:ListServices",
+                "ecs:DescribeServices"
+              ],
+              "Resource": "*"
+            }
+          ]
+        }
+      }
+    }
+  }
+]