[9.4](backport #7183) [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53)#7236
Open
mergify[bot] wants to merge 1 commit into
Open
[9.4](backport #7183) [Cloud Asset Inventory] Add extra resource fields #2 (EKS & Route 53)#7236mergify[bot] wants to merge 1 commit into
mergify[bot] wants to merge 1 commit into
Conversation
…#7183) ## Summary Follow-up to InfoSec's review of #6991: adds two AWS asset types the FedRAMP inventory needs but cloudbeat didn't emit — **Route53 DNS records** and **EKS clusters**. Both are greenfield providers + fetchers. All resource-specific fields land in `entity.attributes.*` (non-ECS, flattened), so no integration mapping change is required. Tracking: https://github.com/elastic/security-team/issues/17750 Merge after: #6991 ## Route53 (`awslib/route53`) - New global provider (`ListHostedZones` → `ListResourceRecordSets`, paginated); one asset per record set, carrying its parent zone. - `entity.attributes`: `Type`, `ResourceRecords`, `Weight`, `Region`, `ZoneID`, `ZoneName`, `AliasTargetDNS`, `AliasTargetZoneId`, `HealthCheckId`. - Classification: `{Infrastructure, "AWS Route53 DNS Record"}`. Region reported as `global`. Records have no creation time in the SDK, so no `CreatedAt`. ## EKS (`awslib/eks`) - New regional provider (`ListClusters` → `DescribeCluster` per cluster); one asset per cluster. - `entity.attributes`: `Status`, `Version`, `Endpoint`, `RoleArn`, `PlatformVersion`, `EndpointPublicAccess`, `EndpointPrivateAccess`, `OwnerTag`; plus `entity.lifecycle.CreatedAt`. - Classification: `{Orchestrator, "AWS EKS Cluster"}` (consistent with GCP GKE). ## Notes - **Dependency bump:** adding the EKS SDK pulled a core bump — `aws-sdk-go-v2` 1.41.1→1.42.1, `smithy-go` 1.24.0→1.27.3, and two indirect internal modules. Whole repo builds and tests pass. - **ASSETS.md / spreadsheet:** regenerated (AWS coverage 21→23/85). The `cloud_assets.xlsx` "EKS Cluster" row was moved from Infrastructure to Orchestrator to match the classification (and GKE); the Route53 and EKS "Updated Type" cells were filled so the generator marks them implemented. - **No `elastic/integrations` change:** `entity.attributes` is flattened (arbitrary keys) and `entity.lifecycle.CreatedAt` + `entity.type`/`sub_type` are already mapped by the 1.7.0 PR (#19795). --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 74745e6) # Conflicts: # go.mod # go.sum # internal/inventory/awsfetcher/awsfetchers.go
Contributor
Author
|
Cherry-pick of 74745e6 has failed: To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally |
Contributor
Author
|
This pull request is now in conflicts. Could you fix it? 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to InfoSec's review of #6991: adds two AWS asset types the FedRAMP inventory needs but cloudbeat didn't emit — Route53 DNS records and EKS clusters. Both are greenfield providers + fetchers. All resource-specific fields land in
entity.attributes.*(non-ECS, flattened), so no integration mapping change is required.Tracking: https://github.com/elastic/security-team/issues/17750
Merge after: #6991
Route53 (
awslib/route53)ListHostedZones→ListResourceRecordSets, paginated); one asset per record set, carrying its parent zone.entity.attributes:Type,ResourceRecords,Weight,Region,ZoneID,ZoneName,AliasTargetDNS,AliasTargetZoneId,HealthCheckId.{Infrastructure, "AWS Route53 DNS Record"}. Region reported asglobal. Records have no creation time in the SDK, so noCreatedAt.EKS (
awslib/eks)ListClusters→DescribeClusterper cluster); one asset per cluster.entity.attributes:Status,Version,Endpoint,RoleArn,PlatformVersion,EndpointPublicAccess,EndpointPrivateAccess,OwnerTag; plusentity.lifecycle.CreatedAt.{Orchestrator, "AWS EKS Cluster"}(consistent with GCP GKE).Notes
aws-sdk-go-v21.41.1→1.42.1,smithy-go1.24.0→1.27.3, and two indirect internal modules. Whole repo builds and tests pass.cloud_assets.xlsx"EKS Cluster" row was moved from Infrastructure to Orchestrator to match the classification (and GKE); the Route53 and EKS "Updated Type" cells were filled so the generator marks them implemented.elastic/integrationschange:entity.attributesis flattened (arbitrary keys) andentity.lifecycle.CreatedAt+entity.type/sub_typeare already mapped by the 1.7.0 PR (#19795).This is an automatic backport of pull request #7183 done by [Mergify](https://mergify.com).