Add iac/ folder validation for JSON patches and linked base templates

code/go/pkg/validator/validator_test.go

@@ -72,6 +72,8 @@ func Test_ValidateFromPath(t *testing.T) {
 		"with_links":                             {},
 		"good_provider_permissions":              {},
 		"good_provider_permissions_input":        {},
+		"good_iac_folder":                       {},
+		"good_iac_folder_input":                  {},
 		"good_integration_group":                 {},
 		"good_input_group":                       {},
 		"bad_integration_group": {
@@ -86,6 +88,31 @@ func Test_ValidateFromPath(t *testing.T) {
 				"field group: Does not match pattern '^[a-z0-9_]+$'",
 			},
 		},
+		"bad_iac_patches_invalid": {
+			"iac/foo.patches.json",
+			[]string{
+				`field 0.op: 0.op must be one of the following: "add", "remove", "replace", "move", "copy", "test"`,
+			},
+		},
+		"bad_iac_patches_missing_required": {
+			"iac/foo.patches.json",
+			[]string{
+				`field 0: op is required`,
+				`field 0: path is required`,
+			},
+		},
+		"bad_iac_blueprints_invalid_id": {
+			"manifest.yml",
+			[]string{
+				"field iac_blueprints.0.id: Does not match pattern '^[a-z0-9]+(/[a-z0-9-]+)+/v[0-9]+$'",
+			},
+		},
+		"bad_iac_blueprints_invalid_format": {
+			"manifest.yml",
+			[]string{
+				`field iac_blueprints.0.format: iac_blueprints.0.format must be one of the following: "cloudformation", "arm", "terraform", "deployment-manager", "helm", "kustomize", "ansible", "bicep"`,
+			},
+		},
 		"bad_duration_vars": {
 			"manifest.yml",
 			[]string{
@@ -726,6 +753,11 @@ func TestValidateItemNotAllowed(t *testing.T) {
 				"deploy",
 			},
 		},
+		"bad_iac_unknown_file": {
+			"iac": []string{
+				"readme.txt",
+			},
+		},
 	}
 
 	for pkgName, invalidItemsPerFolder := range tests {

spec/changelog.yml

@@ -8,6 +8,9 @@
     - description: Add support for semantic_text field definition.
       type: enhancement
       link: https://github.com/elastic/package-spec/pull/807
+    - description: Add optional iac/ folder that validates RFC 6902 JSON patches and allowLink base-template files, plus iac_blueprints manifest fields with versioned blueprint ids (provider/trust-model/scope/vN).
+      type: enhancement
+      link: https://github.com/elastic/package-spec/pull/1227
 - version: 3.6.6
   changes:
     - description: Add support for mode-aware constructors and validation APIs.

spec/input/manifest.spec.yml

@@ -88,6 +88,8 @@ spec:
             $ref: "../integration/manifest.spec.yml#/definitions/sections"
           provider_permissions:
             $ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
+          iac_blueprints:
+            $ref: "../integration/manifest.spec.yml#/definitions/iac_blueprints"
           input:
             type: string
             examples:
@@ -152,6 +154,8 @@ spec:
       $ref: "../integration/manifest.spec.yml#/definitions/sections"
     provider_permissions:
       $ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "../integration/manifest.spec.yml#/definitions/iac_blueprints"
     owner:
       $ref: "../integration/manifest.spec.yml#/definitions/owner"
     agent:
@@ -178,6 +182,12 @@ spec:
 
 # JSON patches for newer versions should be placed on top
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/properties/policy_templates/items/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/iac_blueprints"
   - before: 3.6.0
     patch:
       - op: remove

spec/input/spec.yml

@@ -74,8 +74,17 @@ spec:
     name: img
     required: false
     $ref: "../integration/img/spec.yml"
+  - description: Folder containing IaC JSON patches and linked base templates
+    type: folder
+    name: iac
+    required: false
+    $ref: "../integration/iac/spec.yml"
 
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/contents/11" # iac folder
   - before: 3.5.0
     patch:
       - op: replace

spec/integration/data_stream/manifest.spec.yml

@@ -766,12 +766,16 @@ spec:
       $ref: "../../integration/manifest.spec.yml#/definitions/deprecated"
     provider_permissions:
       $ref: "../../integration/manifest.spec.yml#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "../../integration/manifest.spec.yml#/definitions/iac_blueprints"
   required:
   - title
 # JSON patches for newer versions should be placed on top
 versions:
   - before: 3.7.0
     patch:
+      - op: remove
+        path: "/properties/iac_blueprints"
       # Variable-level scope migration.
       - op: remove
         path: /definitions/vars/items/properties/migrate_from

spec/integration/iac/patches.spec.yml

@@ -0,0 +1,22 @@
+##
+## RFC 6902 JSON Patch document.
+##
+spec:
+  type: array
+  minItems: 1
+  items:
+    type: object
+    additionalProperties: false
+    required:
+      - op
+      - path
+    properties:
+      op:
+        type: string
+        enum: [add, remove, replace, move, copy, test]
+      path:
+        type: string
+        pattern: '^/'
+      from:
+        type: string
+      value: true

spec/integration/iac/spec.yml

@@ -0,0 +1,18 @@
+##
+## Folder containing IaC JSON patches and linked or inlined base templates.
+##
+spec:
+  additionalContents: false
+  contents:
+  - description: RFC 6902 JSON Patch contributions applied on top of a linked base template
+    type: file
+    pattern: '^.+\.patches\.json$'
+    contentMediaType: "application/json"
+    required: false
+    $ref: "./patches.spec.yml"
+  - description: Linked or inlined base IaC template (CloudFormation, ARM, etc.)
+    type: file
+    pattern: '^.+\.(cloudformation|arm)\.json$'
+    contentMediaType: "application/json"
+    required: false
+    allowLink: true

spec/integration/manifest.spec.yml

@@ -825,6 +825,50 @@ spec:
                 description:
                   description: Human-readable description of why this permission is needed.
                   type: string
+    iac_blueprints:
+      description: >
+        IaC composition contributions this integration unit makes to a shared canonical blueprint.
+        Pointers to RFC 6902 patch files the cloud-iac-provisioner renderer applies on top of a
+        canonical blueprint to produce one deployable artifact covering all enabled integrations.
+        May be declared at package, policy_template, input, and data_stream levels;
+        contributions across all applicable levels are merged into a single artifact.
+      type: array
+      items:
+        type: object
+        additionalProperties: false
+        required:
+          - id
+          - format
+          - patches
+        properties:
+          id:
+            description: >
+              Versioned blueprint identifier in the form <provider>/<trust-model>/<scope>/v<n>,
+              e.g. aws/federated-identity/account/v1.
+            type: string
+            pattern: '^[a-z0-9]+(/[a-z0-9-]+)+/v[0-9]+$'
+            examples:
+              - aws/federated-identity/account/v1
+              - azure/service-principal/subscription/v1
+              - gcp/workload-identity/project/v1
+          format:
+            description: IaC format this patch targets.
+            type: string
+            enum:
+              - cloudformation
+              - arm
+              - terraform
+              - deployment-manager
+              - helm
+              - kustomize
+              - ansible
+              - bicep
+          patches:
+            description: Relative path inside the package to the RFC 6902 JSON Patch file.
+            type: string
+          title:
+            description: Optional human-readable label for this IaC contribution.
+            type: string
   properties:
     format_version:
       description: The version of the package specification format used by this package.
@@ -859,6 +903,8 @@ spec:
       $ref: "#/definitions/conditions"
     provider_permissions:
       $ref: "#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "#/definitions/iac_blueprints"
     # requires a conditional JSON schema to update the value depending
     # on the policy_templates length
     policy_templates_behavior:
@@ -1005,6 +1051,8 @@ spec:
                     - credential_type: [cloud_connectors]
                 provider_permissions:
                   $ref: "#/definitions/provider_permissions"
+                iac_blueprints:
+                  $ref: "#/definitions/iac_blueprints"
               required:
                 - title
                 - description
@@ -1033,6 +1081,8 @@ spec:
             $ref: "#/definitions/deprecated"
           provider_permissions:
             $ref: "#/definitions/provider_permissions"
+          iac_blueprints:
+            $ref: "#/definitions/iac_blueprints"
         required:
           - name
           - title
@@ -1101,6 +1151,16 @@ spec:
 
 # JSON patches for newer versions should be placed on top
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/definitions/iac_blueprints"
+      - op: remove
+        path: "/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/policy_templates/items/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/policy_templates/items/properties/inputs/items/properties/iac_blueprints"
   - before: 3.6.0
     patch:
       # Input qualifier (named inputs).

spec/integration/spec.yml

@@ -78,8 +78,17 @@ spec:
     name: img
     required: false
     $ref: "./img/spec.yml"
+  - description: Folder containing IaC JSON patches and linked base templates
+    type: folder
+    name: iac
+    required: false
+    $ref: "./iac/spec.yml"
 
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/contents/12" # iac folder
   - before: 3.2.2
     patch:
       - op: remove