crowdstrike: Mask AWS access_key_id policy variables as secret

[kcreddy]

Summary

Several integrations declare the AWS Access Key ID policy variable with secret: false (and type: text), so Fleet shows the value in plaintext. The Secret Access Key in the same form is masked. This is inconsistent with the AWS integration and other aws-s3/aws-sqs-based packages, and was reported by user when onboarding CrowdStrike FDR alongside AWS CloudTrail.

While an AWS Access Key ID is not as sensitive as the secret key, exposing it in the policy UI increases accidental disclosure (screenshots, screen sharing, support tickets) and makes credential handling feel inconsistent across integrations that use the same collection mechanism.

Expected behaviour

Integrations that accept AWS direct-access credentials should declare access_key_id the same way as secret_access_key:

• type: password
• secret: true

This matches the package-level vars in the aws integration (used by CloudTrail and other AWS data streams) and the convention adopted by most aws-s3 input packages after the secret variables migration.

Affected packages

Audit of packages/**/manifest.yml found these access_key_id (or equivalent) definitions still set to secret: false:

Package	File	Variable
crowdstrike	packages/crowdstrike/data_stream/fdr/manifest.yml	access_key_id

Proposed fix

For each affected variable, change:

- name: access_key_id
  type: text
  secret: false

Note

The issue only covers packages owned by SSI. Other packages not owned by SSI where the issue is also relevant:

Package	File	Variable
cisco_umbrella	packages/cisco_umbrella/data_stream/log/manifest.yml	access_key_id
cloud_asset_inventory	packages/cloud_asset_inventory/data_stream/asset_inventory/manifest.yml	aws.access_key_id
cloud_security_posture	packages/cloud_security_posture/data_stream/findings/manifest.yml	access_key_id (AWS and EKS input sections)

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)