[aws] Enable Identity Federation for the Amazon Inspector data stream

[seanrathier]

Proposed commit message

[aws] Enable Identity Federation for the Amazon Inspector data stream

Migrate the Inspector HTTPJSON template from hand-rolled SigV4 signing
to the input's auth.aws configuration, and remove the inspector policy
template's hide_in_var_group_options gate so Identity Federation is
selectable on the agentless path.

Background

Part of https://github.com/elastic/ingest-dev/issues/8802 — second per-stream PR extending the GuardDuty federation pattern (after #20437 for Config). Split per stream to keep review and e2e validation scoped.

What changed

• HTTPJSON template migrated off hand-rolled SigV4: the Authorization header was built in Go template expressions — twice, because the request body changes between pagination pages and each page needed re-signing. With auth.aws the input signs every request at the transport layer, pagination included.
• Bug fixed en passant: the manual signing never set X-Amz-Security-Token, so temporary credentials (session tokens) were silently broken for Inspector. auth.aws handles them, plus Role ARN and shared credentials — none of which worked before.
• Full auth.aws block added with the use_cloud_connectors hook driven by supports_identity_federation — same pattern as the GuardDuty HTTPJSON stream from [aws] Add var_groups for credential type selection with Identity Federation #19828.
• Gate removed: hide_in_var_group_options dropped from the inspector policy template.
• No format_version change (stays 3.6.1). Version is 7.3.0 assuming [aws] Enable Identity Federation for the Config data stream #20437 (7.2.0) merges first; whichever merges second re-numbers trivially.

IAM permissions (for the paired cloudbeat PR)

The template calls exactly one operation:

API call	IAM action
POST /findings/list (Inspector2 ListFindings)	inspector2:ListFindings

Note: the permission patch sets in #20240 also list inspector2:ListCoverage — the template never calls it, so the CFT mirror omits it (least privilege).

Testing

• elastic-package lint / build pass
• The existing system test (TLS mock with static dummy keys) exercises the new auth.aws path
• Hold-merge: per the [Cisco FTD] Fix the handling of spaces in 113005 messages #8798 discipline, merge only after the e2e validation below confirms the federated flow

E2E test plan

The critical thing this run proves: the input's auth.aws signer correctly signs the pagination flow against real AWS — each page's body differs, so every page needs a fresh signature (this is exactly what the hand-rolled version got wrong-adjacent and re-implemented manually).

1. AWS-side prerequisites (test account):

• Amazon Inspector (v2) activated in the target region, with at least one scan type enabled (EC2, ECR, or Lambda)
• A scannable resource: a running SSM-managed EC2 instance, an ECR image, or a Lambda function. An instance from an older AMI (known CVEs) guarantees findings.

2. Generate findings:

• Inspector auto-discovers and scans resources on activation — no manual trigger exists. A deliberately outdated ECR image or old-AMI instance produces vulnerability findings fastest.

3. Latency: initial scans typically complete within 15 minutes to 1 hour of activation; budget 1h before concluding failure.

4. Onboard in Kibana (agentless + Identity Federation):

• Add the Amazon Inspector integration on the agentless path, select Identity Federation, deploy the role, paste Role ARN + External ID
• Verify documents in logs-aws.inspector-<namespace> with populated aws.inspector fields (severity, status)
• Let it run past one full page (>100 findings) if possible — that exercises the signed pagination path

5. Failure probes:

• Authorization failure: httpjson request error with HTTP 403 / AccessDeniedException on POST /findings/list — check the paired cloudbeat PR's policy
• Authorized-but-empty: HTTP 200 with "findings": [] — means no scans have produced findings yet (see step 2)

Also validate the legacy paths (this PR touches shared request code): a default-mode policy with static access keys, and one with temporary credentials (session token) — the latter never worked before this PR, so it doubles as the bug-fix check.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have added an entry to my package's changelog.yml file.

🤖 Generated with Claude Code

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: aa2d13b

History

• 💔 Build #46981 failed 15228e1

[seanrathier]

Superseded by #20527 which combines config, inspector, and all remaining policy templates into a single PR.