Add iac_blueprints and scoped provider_permissions for integrations/inputs

code/go/pkg/validator/validator_test.go

@@ -86,6 +86,21 @@ func Test_ValidateFromPath(t *testing.T) {
 				"field group: Does not match pattern '^[a-z0-9_]+$'",
 			},
 		},
+		"good_iac_blueprints":       {},
+		"good_iac_blueprints_input": {},
+		"bad_iac_blueprints_missing_required": {
+			"manifest.yml",
+			[]string{
+				`field iac_blueprints.0: format is required`,
+				`field iac_blueprints.0: patches is required`,
+			},
+		},
+		"bad_iac_blueprints_invalid_format": {
+			"manifest.yml",
+			[]string{
+				`field iac_blueprints.0.format: iac_blueprints.0.format must be one of the following: "cloudformation", "arm", "terraform", "deployment-manager", "helm", "kustomize", "ansible", "bicep"`,
+			},
+		},
 		"bad_duration_vars": {
 			"manifest.yml",
 			[]string{

spec/changelog.yml

@@ -8,6 +8,12 @@
     - description: Add support for semantic_text field definition.
       type: enhancement
       link: https://github.com/elastic/package-spec/pull/807
+    - description: Extend provider_permissions.permissions items with resource scoping (resources array) and conditional narrowing (conditions object) fields.
+      type: enhancement
+      link: https://github.com/elastic/package-spec/pull/1225
+    - description: Add iac_blueprints field at package, policy_template, input, and data_stream levels for IaC composition contributions via RFC 6902 patch files.
+      type: enhancement
+      link: https://github.com/elastic/package-spec/pull/1225
 - version: 3.6.6
   changes:
     - description: Add support for mode-aware constructors and validation APIs.

spec/input/manifest.spec.yml

@@ -88,6 +88,8 @@ spec:
             $ref: "../integration/manifest.spec.yml#/definitions/sections"
           provider_permissions:
             $ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
+          iac_blueprints:
+            $ref: "../integration/manifest.spec.yml#/definitions/iac_blueprints"
           input:
             type: string
             examples:
@@ -152,6 +154,8 @@ spec:
       $ref: "../integration/manifest.spec.yml#/definitions/sections"
     provider_permissions:
       $ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "../integration/manifest.spec.yml#/definitions/iac_blueprints"
     owner:
       $ref: "../integration/manifest.spec.yml#/definitions/owner"
     agent:
@@ -178,6 +182,12 @@ spec:
 
 # JSON patches for newer versions should be placed on top
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/properties/policy_templates/items/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/iac_blueprints"
   - before: 3.6.0
     patch:
       - op: remove

spec/integration/data_stream/manifest.spec.yml

@@ -766,12 +766,16 @@ spec:
       $ref: "../../integration/manifest.spec.yml#/definitions/deprecated"
     provider_permissions:
       $ref: "../../integration/manifest.spec.yml#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "../../integration/manifest.spec.yml#/definitions/iac_blueprints"
   required:
   - title
 # JSON patches for newer versions should be placed on top
 versions:
   - before: 3.7.0
     patch:
+      - op: remove
+        path: "/properties/iac_blueprints"
       # Variable-level scope migration.
       - op: remove
         path: /definitions/vars/items/properties/migrate_from

spec/integration/manifest.spec.yml

@@ -825,6 +825,66 @@ spec:
                 description:
                   description: Human-readable description of why this permission is needed.
                   type: string
+                resources:
+                  description: >
+                    Provider-native resource targets this permission applies to (ARNs, Azure resource paths,
+                    GCP resource selectors, K8s apiGroup/resource, SQL object names, …).
+                    When omitted the permission applies account-wide.
+                  type: array
+                  items:
+                    type: string
+                  examples:
+                    - - "arn:aws:s3:::my-log-bucket/*"
+                    - - "arn:aws:s3:::*"
+                    - - "/subscriptions/*/resourceGroups/*/providers/Microsoft.Storage/storageAccounts/*"
+                conditions:
+                  description: >
+                    Provider-native conditions that narrow when this permission applies
+                    (AWS Condition block, Azure conditions, GCP IAM Conditions in CEL, …).
+                  type: object
+    iac_blueprints:
+      description: >
+        IaC composition contributions this integration unit makes to a shared canonical blueprint.
+        Pointers to RFC 6902 patch files the cloud-iac-provisioner renderer applies on top of a
+        canonical blueprint to produce one deployable artifact covering all enabled integrations.
+        May be declared at package, policy_template, input, and data_stream levels;
+        contributions across all applicable levels are merged into a single artifact.
+      type: array
+      items:
+        type: object
+        additionalProperties: false
+        required:
+          - id
+          - format
+          - patches
+        properties:
+          id:
+            description: >
+              Blueprint identifier in the form <provider>/<trust-model>/<scope>,
+              e.g. aws/federated-identity/account.
+            type: string
+            examples:
+              - aws/federated-identity/account
+              - azure/service-principal/subscription
+              - gcp/workload-identity/project
+          format:
+            description: IaC format this patch targets.
+            type: string
+            enum:
+              - cloudformation
+              - arm
+              - terraform
+              - deployment-manager
+              - helm
+              - kustomize
+              - ansible
+              - bicep
+          patches:
+            description: Relative path inside the package to the RFC 6902 JSON Patch file.
+            type: string
+          title:
+            description: Optional human-readable label for this IaC contribution.
+            type: string
   properties:
     format_version:
       description: The version of the package specification format used by this package.
@@ -859,6 +919,8 @@ spec:
       $ref: "#/definitions/conditions"
     provider_permissions:
       $ref: "#/definitions/provider_permissions"
+    iac_blueprints:
+      $ref: "#/definitions/iac_blueprints"
     # requires a conditional JSON schema to update the value depending
     # on the policy_templates length
     policy_templates_behavior:
@@ -1005,6 +1067,8 @@ spec:
                     - credential_type: [cloud_connectors]
                 provider_permissions:
                   $ref: "#/definitions/provider_permissions"
+                iac_blueprints:
+                  $ref: "#/definitions/iac_blueprints"
               required:
                 - title
                 - description
@@ -1033,6 +1097,8 @@ spec:
             $ref: "#/definitions/deprecated"
           provider_permissions:
             $ref: "#/definitions/provider_permissions"
+          iac_blueprints:
+            $ref: "#/definitions/iac_blueprints"
         required:
           - name
           - title
@@ -1101,6 +1167,20 @@ spec:
 
 # JSON patches for newer versions should be placed on top
 versions:
+  - before: 3.7.0
+    patch:
+      - op: remove
+        path: "/definitions/iac_blueprints"
+      - op: remove
+        path: "/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/policy_templates/items/properties/iac_blueprints"
+      - op: remove
+        path: "/properties/policy_templates/items/properties/inputs/items/properties/iac_blueprints"
+      - op: remove
+        path: "/definitions/provider_permissions/items/properties/permissions/items/properties/resources"
+      - op: remove
+        path: "/definitions/provider_permissions/items/properties/permissions/items/properties/conditions"
   - before: 3.6.0
     patch:
       # Input qualifier (named inputs).