[Agentless] Enable firewall-metrics for Agentless

[nimarezainia]

We have a goal of streamlining the AWS integration and all its services. Part of that is defaulting to a recommended ingest method so it's easier for our users. Currently firewall-metrics are not covered by Agentless which means that the user would have to install an agent to ingest these metrics.

cc: @qcorporation

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

tl;dr: aws/firewall_metrics appears implementation-ready for Agentless, and the likely missing piece is enabling agentless deployment mode on the AWS firewall policy template in packages/aws/manifest.yml.

Recommendation

Enable Agentless for the AWS Network Firewall policy template by adding deployment_modes.agentless.enabled: true (with org/division/team metadata, consistent with nearby templates) under policy_templates[].name: firewall in packages/aws/manifest.yml, then ship with a changelog entry in packages/aws/changelog.yml.

Findings

1. The firewall policy template includes firewall_metrics but does not define deployment_modes:
   • packages/aws/manifest.yml:459-503
2. Neighboring AWS templates explicitly enable Agentless:
   • packages/aws/manifest.yml:364-371 (ELB)
   • packages/aws/manifest.yml:419-426 (Lambda)
   • packages/aws/manifest.yml:516-523 (RDS)
3. Spec behavior confirms why omission matters:
   • docs/extend/manifest-spec.md:207-212 (agentless.enabled is disabled by default)
4. Recent AWS changelog shows an incremental rollout of Agentless across multiple AWS metrics templates, but no firewall entry:
   • packages/aws/changelog.yml:42-86 (RDS, DynamoDB, SNS, Transitgateway, Billing, Health, SQS, ELB, Lambda)
5. firewall_metrics stream itself looks compatible with Agentless-style CloudWatch collection:
   • packages/aws/data_stream/firewall_metrics/manifest.yml:6 (input: aws/metrics)
   • packages/aws/data_stream/firewall_metrics/agent/stream/stream.yml.hbs:1 (metricsets: ["cloudwatch"])

Note: I could not read issue/PR discussion bodies in this run due integrity restrictions, so this triage is based on repository evidence plus the issue title.

Verification

I validated the manifest/changelog state directly in the workspace:

$ sed -n '459,503p' packages/aws/manifest.yml
## Firewall template block
  - name: firewall
    ...
    data_streams:
      - firewall_logs
      - firewall_metrics
    inputs:
      - type: aws-s3
      - type: aws-cloudwatch
      - type: aws/metrics
    ...
  - name: rds

$ sed -n '364,371p;419,426p;516,523p' packages/aws/manifest.yml
## Nearby agentless-enabled templates
deployment_modes:
  default:
    enabled: true
  agentless:
    enabled: true
    organization: observability
    division: engineering
    team: obs-infraobs-integrations

$ sed -n '42,86p' packages/aws/changelog.yml
Enable agentless deployment for AWS RDS metrics.
Enable agentless deployment for AWS DynamoDB metrics.
Enable agentless deployment for AWS SNS metrics.
Enable agentless deployment for AWS Transitgateway metrics.
Enable agentless deployment for AWS Billing metrics.
Enable agentless deployment for AWS Health metrics.
Enable agentless deployment for AWS SQS metrics.
Enable agentless deployment for AWS ELB metrics.
Enable agentless deployment for AWS Lambda metrics.

Detailed Action Plan

1. Update packages/aws/manifest.yml in the policy_templates entry at name: firewall (~459+) to include:
   • deployment_modes.default.enabled: true
   • deployment_modes.agentless.enabled: true
   • metadata fields (organization, division, team) matching the established AWS pattern in nearby templates.
2. Confirm no variable visibility/deployment-mode constraints are needed for firewall metrics inputs (none currently appear required).
3. Add changelog entry in packages/aws/changelog.yml describing Agentless enablement for AWS Network Firewall metrics.
4. Regenerate/build package docs as required by normal AWS package workflow so docs reflect Agentless availability.
5. Run package checks/tests used for AWS integration changes before merging.

Related Items

Type	Link / Path	Relevance
Issue	#19301	Current request
File	packages/aws/manifest.yml:459-503	Firewall template currently missing deployment_modes
File	packages/aws/data_stream/firewall_metrics/manifest.yml:6	Firewall metrics uses aws/metrics
File	docs/extend/manifest-spec.md:207-212	Agentless mode is disabled unless explicitly enabled
PRs	#18584, #18583, #18365, #18389, #18363, #18362, #18366, #18364, #18361	Prior AWS metrics Agentless rollout entries referenced in changelog

Note

🔒 Integrity filter blocked 31 items

The following items were blocked because they don't meet the GitHub integrity level.

• #19301 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18365 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18881 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19301 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19283 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19266 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19191 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19062 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19219 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18363 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18362 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18366 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18364 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18361 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19185 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 15 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[qcorporation]

@narph do you think you can prioritize this? this is for ingest-hub V1. I think this is one of the few integrations we are missing that isn't mapped to a delivery date to get AWS onboarding.

[narph]

@qcorporation, @nimarezainia, this data stream appears to be owned by our team, but it's ingesting metrics through the cloudwatch metricset owned by the @elastic/obs-ds-hosted-services team.

@lalit-satapathy, could you take a look at this data stream? Can your take ownership of it? If so, could you also help investigate and drive any follow-up work needed here?