[aws] Add Instance/Pod IAM Role option to Setup Access selector (7.1.x) by kcreddy · Pull Request #21046 · elastic/integrations

kcreddy · 2026-09-03T07:43:45Z

Proposed commit message

[aws] Add Instance/Pod IAM Role option to Setup Access selector (7.1.x)

Add a default_credentials var_group option (displayed as "Instance or Pod IAM Role") with no
required fields, so Elastic Agent can authenticate using the AWS SDK default credential chain
(EC2 instance profile, EKS Pod Identity, IRSA) without entering access keys or a Role ARN.
This restores the documented capability that was blocked when the credential_type var_group
became required with all-var options in 7.0.0 (#19828).

Update the credentials documentation to clarify the Setup Access selector, explain each option's
purpose, and distinguish "Assume Role" (assumes a specified role) from "Instance/Pod IAM Role"
(uses the role attached to the host). Unlike main, this line still has the "Assume Role with
External ID" option, so it is documented as well.

Backport of #21025 to backport-aws-7.1, the last line installable on Kibana 9.4.x and 9.5.x
(7.2.0+ require Kibana ^9.6.0).

Includes mandatory SCP tags on system test terraform configs (backport of #20698).

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Add a default_credentials var_group option (displayed as "Instance or Pod IAM Role") with no required fields, so Elastic Agent can authenticate using the AWS SDK default credential chain (EC2 instance profile, EKS Pod Identity, IRSA) without entering access keys or a Role ARN. This restores the documented capability that was blocked when the credential_type var_group became required with all-var options in 7.0.0 (elastic#19828). Update the credentials documentation to clarify the Setup Access selector, explain each option's purpose, and distinguish "Assume Role" (assumes a specified role) from "Instance/Pod IAM Role" (uses the role attached to the host). Unlike main, this line still has the "Assume Role with External ID" option, so it is documented as well. Backport of elastic#21025 to backport-aws-7.1, the last line installable on Kibana 9.4.x and 9.5.x (7.2.0+ require Kibana ^9.6.0).

infra-vault-gh-plugin-prod · 2026-09-03T07:44:26Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-09-03T07:45:17Z

Elastic Docs Style Checker (Vale)

Summary: 4 suggestions found

💡 Suggestions (4): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/aws/_dev/build/docs/README.md	90	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.
packages/aws/_dev/build/docs/README.md	100	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.
packages/aws/_dev/build/docs/README.md	174	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.
packages/aws/_dev/build/docs/README.md	184	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Copilot

🟢 Approval recommended

The manifest, docs, and changelog updates are consistent with the stated goal and appear internally coherent for the 7.1.x backport.

Pull request overview

This PR backports the “Instance or Pod IAM Role” / AWS SDK default credential chain authentication option to the AWS integration’s Setup Access selector on the 7.1.x line, restoring the ability to save policies without entering access keys or a role ARN.

Changes:

Bump aws package version to 7.1.2 and add a default_credentials Setup Access option with no fields.
Update AWS credentials documentation to explain the Setup Access selector and clarify the differences between Assume Role and Instance or Pod IAM Role (and document Assume Role with External ID on this branch).
Add a 7.1.2 changelog entry referencing this PR.

File summaries

File	Description
packages/aws/manifest.yml	Bumps version and adds `default_credentials` var_group option with `vars: []` (no required fields).
packages/aws/docs/README.md	Updates credential configuration docs and adds a Setup Access options table and updated role-auth sections.
packages/aws/changelog.yml	Adds a 7.1.2 bugfix entry linking to the PR.
packages/aws/_dev/build/docs/README.md	Mirrors the docs changes in the build/docs copy.

Review details

Files reviewed: 4/4 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟢 Approval recommended

The manifest, docs, and changelog updates are consistent with the stated goal and appear internally coherent for the 7.1.x backport.

Review details

Files reviewed: 5/6 changed files
Comments generated: 0 new
Review effort level: Lite

The observability-ci account SCP now denies resource creation without the division/org/team/project tags, breaking the 11 SQS-based data stream system tests and redshift. (cherry picked from commit ecadef5)

…/kcreddy/integrations into aws-default_credentials-backport

Copilot

🟢 Approval recommended

The changes are consistent and scoped to enabling/clarifying AWS default-credential-chain auth via the Setup Access selector, with matching versioning and documentation updates.

Review details

Files reviewed: 17/18 changed files
Comments generated: 0 new
Review effort level: Lite

elastic-vault-github-plugin-prod · 2026-09-03T09:35:22Z

✅ All changelog entries have the correct PR link.

elastic-vault-github-plugin-prod · 2026-09-03T09:35:38Z

✅ Package owners are in sync with main.

vera-review-bot · 2026-09-03T09:38:59Z

🟢 No issues across the latest commits 55e079f, ea5bfe6.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.3.0 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-09-03T11:30:27Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: ea5bfe6

Failed CI Steps

Check integrations aws

History

cc @kcreddy

mrodm

LGTM, for the go.mod and go.sum changes

mergify · 2026-09-04T05:45:03Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

github-actions · 2026-09-04T05:46:10Z

Changelog sync PR created: #21061

elastic-vault-github-plugin-prod · 2026-09-04T06:46:41Z

Package aws - 7.1.2 containing this change is available at https://epr.elastic.co/package/aws/7.1.2/

kcreddy self-assigned this Sep 3, 2026

kcreddy marked this pull request as ready for review September 3, 2026 07:43

kcreddy requested review from a team as code owners September 3, 2026 07:43

Copilot AI lite review requested due to automatic review settings September 3, 2026 07:43

kcreddy requested a review from a team as a code owner September 3, 2026 07:43

update pr number

faf6ebb

kcreddy added Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Sep 3, 2026

Copilot started reviewing on behalf of kcreddy September 3, 2026 07:44 View session

kcreddy added the bugfix Pull request that fixes a bug issue label Sep 3, 2026

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Update elastic-package to v0.126.1

fe8162f

Copilot AI review requested due to automatic review settings September 3, 2026 08:19

teresaromero requested a review from a team as a code owner September 3, 2026 08:19

Copilot started reviewing on behalf of teresaromero September 3, 2026 08:19 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

mallendem and others added 2 commits September 3, 2026 14:59

add mandatory aws tags to system test terraform (elastic#20698)

55e079f

The observability-ci account SCP now denies resource creation without the division/org/team/project tags, breaking the 11 SQS-based data stream system tests and redshift. (cherry picked from commit ecadef5)

Merge branch 'aws-default_credentials-backport' of https://github.com…

ea5bfe6

…/kcreddy/integrations into aws-default_credentials-backport

Copilot AI review requested due to automatic review settings September 3, 2026 09:31

Copilot started reviewing on behalf of kcreddy September 3, 2026 09:31 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

ShourieG approved these changes Sep 3, 2026

View reviewed changes

mrodm approved these changes Sep 3, 2026

View reviewed changes

MichaelKatsoulis approved these changes Sep 3, 2026

View reviewed changes

ishleenk17 approved these changes Sep 4, 2026

View reviewed changes

kcreddy merged commit c1438e4 into elastic:backport-aws-7.1 Sep 4, 2026
11 checks passed

github-actions Bot mentioned this pull request Sep 4, 2026

changelog: aws 7.1.2 (backport sync from PR #21046) #21061

Open

Uh oh!

Conversation

kcreddy commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Related issues

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 3, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 3, 2026

Uh oh!

vera-review-bot Bot commented Sep 3, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

History

Uh oh!

mrodm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mergify Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kcreddy commented Sep 3, 2026 •

edited

Loading

infra-vault-gh-plugin-prod Bot commented Sep 3, 2026 •

edited

Loading