Skip to content

[9.4](backport #7183) [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53)#7236

Open
mergify[bot] wants to merge 1 commit into
9.4from
mergify/bp/9.4/pr-7183
Open

[9.4](backport #7183) [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53)#7236
mergify[bot] wants to merge 1 commit into
9.4from
mergify/bp/9.4/pr-7183

Conversation

@mergify

@mergify mergify Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Follow-up to InfoSec's review of #6991: adds two AWS asset types the FedRAMP inventory needs but cloudbeat didn't emit — Route53 DNS records and EKS clusters. Both are greenfield providers + fetchers. All resource-specific fields land in entity.attributes.* (non-ECS, flattened), so no integration mapping change is required.

Tracking: https://github.com/elastic/security-team/issues/17750
Merge after: #6991

Route53 (awslib/route53)

  • New global provider (ListHostedZonesListResourceRecordSets, paginated); one asset per record set, carrying its parent zone.
  • entity.attributes: Type, ResourceRecords, Weight, Region, ZoneID, ZoneName, AliasTargetDNS, AliasTargetZoneId, HealthCheckId.
  • Classification: {Infrastructure, "AWS Route53 DNS Record"}. Region reported as global. Records have no creation time in the SDK, so no CreatedAt.

EKS (awslib/eks)

  • New regional provider (ListClustersDescribeCluster per cluster); one asset per cluster.
  • entity.attributes: Status, Version, Endpoint, RoleArn, PlatformVersion, EndpointPublicAccess, EndpointPrivateAccess, OwnerTag; plus entity.lifecycle.CreatedAt.
  • Classification: {Orchestrator, "AWS EKS Cluster"} (consistent with GCP GKE).

Notes

  • Dependency bump: adding the EKS SDK pulled a core bump — aws-sdk-go-v2 1.41.1→1.42.1, smithy-go 1.24.0→1.27.3, and two indirect internal modules. Whole repo builds and tests pass.
  • ASSETS.md / spreadsheet: regenerated (AWS coverage 21→23/85). The cloud_assets.xlsx "EKS Cluster" row was moved from Infrastructure to Orchestrator to match the classification (and GKE); the Route53 and EKS "Updated Type" cells were filled so the generator marks them implemented.
  • No elastic/integrations change: entity.attributes is flattened (arbitrary keys) and entity.lifecycle.CreatedAt + entity.type/sub_type are already mapped by the 1.7.0 PR (#19795).

This is an automatic backport of pull request #7183 done by [Mergify](https://mergify.com).

…#7183)

## Summary

Follow-up to InfoSec's review of #6991: adds two AWS asset types the
FedRAMP inventory needs but cloudbeat didn't emit — **Route53 DNS
records** and **EKS clusters**. Both are greenfield providers +
fetchers. All resource-specific fields land in `entity.attributes.*`
(non-ECS, flattened), so no integration mapping change is required.

Tracking: https://github.com/elastic/security-team/issues/17750
Merge after: #6991

## Route53 (`awslib/route53`)

- New global provider (`ListHostedZones` → `ListResourceRecordSets`,
paginated); one asset per record set, carrying its parent zone.
- `entity.attributes`: `Type`, `ResourceRecords`, `Weight`, `Region`,
`ZoneID`, `ZoneName`, `AliasTargetDNS`, `AliasTargetZoneId`,
`HealthCheckId`.
- Classification: `{Infrastructure, "AWS Route53 DNS Record"}`. Region
reported as `global`. Records have no creation time in the SDK, so no
`CreatedAt`.

## EKS (`awslib/eks`)

- New regional provider (`ListClusters` → `DescribeCluster` per
cluster); one asset per cluster.
- `entity.attributes`: `Status`, `Version`, `Endpoint`, `RoleArn`,
`PlatformVersion`, `EndpointPublicAccess`, `EndpointPrivateAccess`,
`OwnerTag`; plus `entity.lifecycle.CreatedAt`.
- Classification: `{Orchestrator, "AWS EKS Cluster"}` (consistent with
GCP GKE).

## Notes

- **Dependency bump:** adding the EKS SDK pulled a core bump —
`aws-sdk-go-v2` 1.41.1→1.42.1, `smithy-go` 1.24.0→1.27.3, and two
indirect internal modules. Whole repo builds and tests pass.
- **ASSETS.md / spreadsheet:** regenerated (AWS coverage 21→23/85). The
`cloud_assets.xlsx` "EKS Cluster" row was moved from Infrastructure to
Orchestrator to match the classification (and GKE); the Route53 and EKS
"Updated Type" cells were filled so the generator marks them
implemented.
- **No `elastic/integrations` change:** `entity.attributes` is flattened
(arbitrary keys) and `entity.lifecycle.CreatedAt` +
`entity.type`/`sub_type` are already mapped by the 1.7.0 PR (#19795).

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit 74745e6)

# Conflicts:
#	go.mod
#	go.sum
#	internal/inventory/awsfetcher/awsfetchers.go
@mergify mergify Bot requested a review from a team as a code owner July 7, 2026 15:38
@mergify

mergify Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Cherry-pick of 74745e6 has failed:

On branch mergify/bp/9.4/pr-7183
Your branch is up to date with 'origin/9.4'.

You are currently cherry-picking commit 74745e63.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   internal/inventory/ASSETS.md
	modified:   internal/inventory/asset.go
	new file:   internal/inventory/awsfetcher/fetcher_eks.go
	new file:   internal/inventory/awsfetcher/fetcher_eks_mock.go
	new file:   internal/inventory/awsfetcher/fetcher_eks_test.go
	new file:   internal/inventory/awsfetcher/fetcher_route53.go
	new file:   internal/inventory/awsfetcher/fetcher_route53_mock.go
	new file:   internal/inventory/awsfetcher/fetcher_route53_test.go
	modified:   internal/inventory/cloud_assets.xlsx
	modified:   internal/resources/fetching/fetcher.go
	new file:   internal/resources/providers/awslib/eks/cluster.go
	new file:   internal/resources/providers/awslib/eks/eks.go
	new file:   internal/resources/providers/awslib/eks/eks_mock.go
	new file:   internal/resources/providers/awslib/eks/provider.go
	new file:   internal/resources/providers/awslib/eks/provider_test.go
	new file:   internal/resources/providers/awslib/route53/provider.go
	new file:   internal/resources/providers/awslib/route53/provider_test.go
	new file:   internal/resources/providers/awslib/route53/record.go
	new file:   internal/resources/providers/awslib/route53/route53.go
	new file:   internal/resources/providers/awslib/route53/route53_mock.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   go.mod
	both modified:   go.sum
	both modified:   internal/inventory/awsfetcher/awsfetchers.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify

mergify Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/9.4/pr-7183 upstream/mergify/bp/9.4/pr-7183
git merge upstream/9.4
git push upstream mergify/bp/9.4/pr-7183

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant