Skip to content

Cloud connector 9.3 updates #4284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benironside wants to merge 7 commits into
base: main
Choose a base branch
from
+35 −22
Open

Cloud connector 9.3 updates #4284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2cd6e10
Cloud connector 9.3 updates
benironside Dec 10, 2025
7a90fe8
adds lifecycle version info for limitation
benironside Dec 17, 2025
f49d13f
Merge branch 'main' into 4205-cloud-connector-9.3
benironside Dec 17, 2025
fac87c0
Adds links to cloud connector doc, and info about CC names
benironside Dec 17, 2025
b34b87e
Merge branch '4205-cloud-connector-9.3' of https://github.com/elastic…
benironside Dec 17, 2025
9887b6b
adds serverless lifecycle labels
benironside Dec 17, 2025
e9f6682
Merge branch 'main' into 4205-cloud-connector-9.3
benironside Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions solutions/security/cloud/asset-disc-aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,11 @@ Two deployment technologies are available: agentless and agent-based.
6. In **Deployment options**, select **Agentless**.
7. Next, you’ll need to authenticate to AWS. The following methods are available:

* Option 1: Cloud connector (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
* To use a pre-existing cloud connector for this deployment, select it under **Existing connection**.
* To use a new cloud connector: under **New connection**, expand the **Steps to assume role** section. Complete the instructions to generate a `Role ARN` and `External ID`; enter them in {{kib}}.

* Option 1: [Cloud connector](/solutions/security/get-started/cloud-connector-deployment.md) (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
* To use a pre-existing cloud connector for this deployment, select **Existing connection** then the cloud connector's name.
Copy link
Contributor

@smriti0321 smriti0321 Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we need to elaborate here what to expect under name for existing cloud connector. Since Cloud Connector name will be introduced in 9.3, for any cloud connector which was created before 9.3 in case of AWS the name will be Cloud Connector RoleARN and in case of Azure it will be Cloud Connector ID. If user wishes to rename the cloud connector to a more user friendly name they can do so by clicking edit button next to the selected cloud connector in the drop down, it leads to opening a flyout with cloud connector details and one can rename the cloud connector there.

Copy link
Contributor Author

@benironside benironside Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm going to add some of this info to the Cloud connector general page, and link to it from here, but not include the info here so the instructions don't get too long.

* To use a new cloud connector: under **New connection**, enter a **Cloud Connector Name**, then expand the **Steps to assume role** section. Complete the instructions to generate a `Role ARN` and `External ID`; enter them in {{kib}}.
::::{important}
In order to use cloud connector for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
{applies_to}`stack: removed 9.3`{applies_to}`serverless: removed` To use cloud connector authentication for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
::::

* Option 2: Direct access keys/CloudFormation. For **Preferred method**, select **Direct access keys**. Expand the **Steps to Generate AWS Account Credentials** section, then follow the displayed instructions to automatically create the necessary credentials using CloudFormation.
Expand Down
4 changes: 2 additions & 2 deletions solutions/security/cloud/asset-disc-azure.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,8 @@ Two deployment technologies are available: agentless and agent-based.
6. In **Deployment options**, select **Agentless**.
7. Next, you’ll need to authenticate to Azure. The following methods are available:

* Option 1: Cloud connector (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
Under **New connection**, expand the **Steps to create Managed User Identity in Azure** section. Complete the instructions to generate a `Client ID`, `Tenant ID`, and `Cloud Connector ID`, then enter them in {{kib}}.
* Option 1: [Cloud connector](/solutions/security/get-started/cloud-connector-deployment.md) (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
Under **New connection**, enter a **Cloud Connector Name**, then expand the **Steps to create Managed User Identity in Azure** section. Complete the instructions to generate a `Client ID`, `Tenant ID`, and `Cloud Connector ID`, then enter them in {{kib}}.

* Option 2: Azure Client ID with Client Secret. Provide a **Client ID**, **Tenant ID**, and **Client Secret**. To learn how to generate them, refer to [Service principal with client secret](/solutions/security/cloud/asset-disc-azure.md#cad-azure-client-secret).
8. Once you’ve provided the necessary credentials, click **Save and continue** to finish deployment. Your data should start to appear within a few minutes.
Expand Down
14 changes: 7 additions & 7 deletions solutions/security/cloud/get-started-with-cspm-for-aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@ This page explains how to start monitoring the security posture of your cloud as
## Requirements
* Minimum privileges vary depending on whether you need to read, write, or manage CSPM data and integrations. Refer to [CSPM privilege requirements](/solutions/security/cloud/cspm-privilege-requirements.md).
* The CSPM integration is available to all {{ecloud}} users. On-premise deployments require an [appropriate subscription](https://www.elastic.co/pricing) level.
* CSPM supports only the AWS, GCP, and Azure commercial cloud platforms, and AWS GovCloud. AWS GovCloud is only supported for agent-based deployments — agentless deployments do not work on this platform. Other government cloud platforms are not supported. To request support for other platforms, [open a GitHub issue](https://github.com/elastic/kibana/issues/new/choose).
* CSPM supports only the AWS, GCP, and Azure commercial cloud platforms, and AWS GovCloud. AWS GovCloud is only supported for agent-based deployments—agentless deployments do not work on this platform. Other government cloud platforms are not supported. To request support for other platforms, [open a GitHub issue](https://github.com/elastic/kibana/issues/new/choose).
* The user who gives the CSPM integration AWS permissions must be an AWS account `admin`.



## Set up CSPM for AWS [cspm-setup]

You can set up CSPM for AWS either by enrolling a single cloud account, or by enrolling an organization containing multiple accounts. Either way, first you will add the CSPM integration, then enable cloud account access.
You can set up CSPM for AWS either by enrolling a single cloud account, or by enrolling an organization containing multiple accounts. Either way, you must first add the CSPM integration, then enable cloud account access.

Two deployment technologies are available: agentless and agent-based.

Expand All @@ -49,14 +49,14 @@ Two deployment technologies are available: agentless and agent-based.
7. In **Deployment options** select **Agentless**.
8. Next, you’ll need to authenticate to AWS. The following methods are available:

* Option 1: Cloud connector (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
* To use a pre-existing cloud connector for this deployment, select it under **Existing connection**.
* To use a new cloud connector: under **New connection**, expand the **Steps to assume role** section. Complete the instructions to generate a `Role ARN` and `External ID`; enter them in {{kib}}.

* Option 1: [Cloud connector](/solutions/security/get-started/cloud-connector-deployment.md) (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
* To use a pre-existing cloud connector for this deployment, select **Existing connection** then the cloud connector's name.
* To use a new cloud connector: under **New connection**, enter a **Cloud Connector Name**, then expand the **Steps to assume role** section. Complete the instructions to generate a `Role ARN` and `External ID`; enter them in {{kib}}.
::::{important}
In order to use cloud connector for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
{applies_to}`stack: removed 9.3`{applies_to}`serverless: removed` To use cloud connector authentication for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
::::


* Option 2: Direct access keys/CloudFormation. For **Preferred method**, select **Direct access keys**. Expand the **Steps to Generate AWS Account Credentials** section, then follow the instructions to automatically create the necessary credentials using CloudFormation.

::::{note}
Expand Down
4 changes: 2 additions & 2 deletions solutions/security/cloud/get-started-with-cspm-for-azure.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,8 @@ The following deployment technologies are available: agentless and agent-based.
7. For **Deployment options**, select **Agentless**.
8. Next, you’ll need to authenticate to Azure. The following methods are available:

* Option 1: Cloud connector (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
Under **New connection**, expand the **Steps to create Managed User Identity in Azure** section. Complete the instructions to generate a `Client ID`, `Tenant ID`, and `Cloud Connector ID`, then enter them in {{kib}}.
* Option 1: [Cloud connector](/solutions/security/get-started/cloud-connector-deployment.md) (recommended). {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
Under **New connection**, enter a **Cloud Connector Name**, then expand the **Steps to create Managed User Identity in Azure** section. Complete the instructions to generate a `Client ID`, `Tenant ID`, and `Cloud Connector ID`, then enter them in {{kib}}.

* Option 2: Azure Client ID with Client Secret. Provide a **Client ID**, **Tenant ID**, and **Client Secret**. To learn how to generate them, refer to [Service principal with client secret](/solutions/security/cloud/get-started-with-cspm-for-azure.md#cspm-azure-client-secret).

Expand Down
26 changes: 20 additions & 6 deletions solutions/security/get-started/cloud-connector-deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,29 @@ applies_to:

Cloud connector authentication for agentless integrations reduces the administrative burden of authentating to third-party cloud service providers by eliminating the need to keep track of credentials such as API keys or passwords. Cloud connectors provide a reusable, secure-by-default means of authentication, helping you to manage deployments with many integrations collecting data from multiple cloud security providers.

## Where is cloud connector authentication supported?
## Integrations that support cloud connector deployment

At the current stage of this technical preview, a limited selection of cloud providers and integrations are supported.

You can use cloud connector deployment to authenticate with AWS and Azure while deploying either Elastic's Cloud Security Posture Management (CSPM) or Asset Discovery integration. For deployment instructions, refer to:
Cloud connector authentication currently supports deployments of Elastic's Cloud Security Posture Management (CSPM) and Asset Discovery integrations to AWS and Azure. For deployment instructions, refer to:

- Asset Discovery: [Asset Discovery on Azure](/solutions/security/cloud/asset-disc-azure.md); [Asset Discovery on AWS](/solutions/security/cloud/asset-disc-aws.md)
- CSPM: [CSPM on Azure](/solutions/security/cloud/get-started-with-cspm-for-azure.md); [CSPM on AWS](/solutions/security/cloud/get-started-with-cspm-for-aws.md)

::::{important}
In order to use cloud connector for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
::::
{applies_to}`stack: removed 9.3`{applies_to}`serverless: removed` To use cloud connector authentication for an AWS integration, your {{kib}} instance must be hosted on AWS. In other words, you must have chosen AWS hosting during {{kib}} setup.
::::

## Cloud connector names
```{applies_to}
stack: preview 9.3
serverless: preview
```
Cloud connector names help you keep track of each connector's purpose and reuse it appropriately. For example, you could name two AWS connectors `aws-prod` and `aws-testing`.

When you create a new cloud connector you must name it. When you're deploying an integration with a cloud connector, if you select **Existing connection** a dropdown menu with the names of existing cloud connectors appears.

To rename a connector, go to the **Existing connection** dropdown menu and click the **Edit** button next to its name, then enter a new name.

Because cloud connector names were introduced with {{stack}} version 9.3, cloud connectors created in earlier versions have default names:

- For AWS cloud connectors: `Cloud Connector RoleARN`.
- For Azure cloud connectors: `Cloud Connector ID`.
Loading