[Cloud Security] Fleet validation using the RequiredVars and CSPM showing validation errors

[seanrathier]

Summary

This change introduces the ability for integrations to validate dependent fields using the required_vars object in the package-spec, for example, a username and password are both required fields. Additionally, we can check for a predetermined value in the required_vars.

The validatePackageRequiredVars validatePackagePolicy function integrates with validatePackagePolicy functions and adds the invalid required_vars to the validationResults object. Validating the required_vars is all dependent on the inputs.stream being enable

{
    "name": null,
    "description": null,
    "namespace": null,
    "inputs": {
        "cspm-cloudbeat/cis_aws": {
            "streams": {
                "cloud_security_posture.findings": {
                    "vars": {
                        ...
                    },
                    "required_vars": {
                        "assume_role": [
                            {
                                "name": "role_arn",
                                "invalid": true
                            }
                        ],
                        "direct_access_keys": [
                            {
                                "name": "aws.credentials.type",
                                "invalid": true
                            },
                            {
                                "name": "access_key_id",
                                "invalid": true
                            },
                            {
                                "name": "secret_access_key",
                                "invalid": true
                            }
                        ],
               
                    }
                }
            }
        },
    },
    "vars": {
        "posture": null,
        "deployment": null
    }
}

We have enhanced the CSPM integration to support required_vars, as such, since the CSPM integration is a custom Fleet extension and the behaviour is only one package policy stream can be enabled, the CSPM UI only needs to know if there are required_vars that are invalid to show the error state.

Screen.Recording.2025-01-20.at.5.47.16.PM.mov

Follow Up

This solution primarily addresses the concerns for the CSPM integration and reads the streams/input/vars, a follow-up issue has been created to include any vars to validate required_vars and introduce Fleet native integration UI to show invalid fields

Depends On

• [Cloud Security] add required_vars validation rules and default CSPM and Asset Inventory to agentless deployment integrations#12363

Related Issues

• [Change Proposal] Add support for required conditional groups of variables package-spec#744
• https://github.com/elastic/security-team/issues/10623
• Follow up [ Fleet] Fleet's Integration platform native UI engine needs to render the form invalid if the package's required_vars and not valid. #208315

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[Omolola-Akinleye]

🚀

[jen-huang]

Fleet changes LGTM

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 9c0eef5

Failed CI Steps

• Linting

History

• 💔 Build #270767 failed a11c770
• 💛 Build #270227 was flaky 7f5b96b
• 💔 Build #270130 failed 1b4b330
• 💔 Build #269863 failed 20d2f56
• 💔 Build #269779 failed 369c53d

cc @seanrathier

[kibanamachine]

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/13004762294

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 207130

Questions ?

Please refer to the Backport tool documentation

[seanrathier]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation