[AWS] Automated credentials creation flow

[moukoublen]

The manual credentials flow for CSPM in AWS requires the user to create Direct Access Keys or Temporary Keys manually.

Based on elastic/kibana#175977, this task is for creating CloudFormation script that generates those credentials.

[moukoublen]

@tinnytintin10 and @maxcold
(cc @oren-zohar)

Regarding AWS part of the epic: elastic/kibana#175977,

The ticket is ready (pending some last tests and will be merged). Currently, it supports creating only Direct Access Keys (not temporary ones).

There are 2 (two) CloudFormation files, one for a single AWS account and one for an organization account.

The URLs for CloudFormation files are similar to those of the AWS agent ones:

• https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-direct-access-key-single-account-<stack version>.yml (with <stack version> is like that 8.13.0)
• https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-direct-access-key-organization-account<stack version>.yml (with <stack version> is like that 8.13.0)

Example for 8.14.0:
https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-direct-access-key-single-account-8.14.0.yml

https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-direct-access-key-organization-account-8.14.0.yml

---

AWS Temporary Security Credentials

Temporary security credentials seem to be a bit more complex to implement. There is no direct way to implement them with CloudFormation.
Based on my investigation thus far, there seem to be two ways to implement them using CloudFormation (partially).

One way is to implement an AWS Lambda custom resource beforehand (that creates the credentials using the AWS SDK) and then trigger this lambda from CloudFormation. This scenario seems a bit difficult to implement since it requires creating the lambda on the target cloud before CloudFormation deployment.

A second way (not verified) is to create the user and the role we need, then spin up an EC2, run AWS CLI commands inside of it, and perhaps destroy it (or not).

Implementing temporary security credentials seems to require more effort because of each solution's complications, and the result does not seem to be assured.

[kfirpeled]

Hey @moukoublen / @oren-zohar does this issue relate to agentless epic? if so can you please assign to it the correct epic?