Skip to content

[Cloud Security Posture] Support GCP Cloud Connectors#17185

Merged
amirbenun merged 6 commits into
elastic:mainfrom
amirbenun:gcp-cloud-connectors
Feb 4, 2026
Merged

[Cloud Security Posture] Support GCP Cloud Connectors#17185
amirbenun merged 6 commits into
elastic:mainfrom
amirbenun:gcp-cloud-connectors

Conversation

@amirbenun
Copy link
Copy Markdown
Contributor

@amirbenun amirbenun commented Feb 1, 2026 •
edited
Loading

Proposed commit message

Present new Cloud Connectors fields for GCP

  • gcp.credentials.service_account_email
  • gcp.credentials.audience
  • gcp_credentials_cloud_connector_id
    These fields are are needed for cloudbeat to impersonate into the target account.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Screenshots

@amirbenun amirbenun requested a review from a team as a code owner February 1, 2026 13:56
Copilot AI review requested due to automatic review settings February 1, 2026 13:56
Copilot AI reviewed Feb 1, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds support for GCP Cloud Connectors in the Cloud Security Posture integration. Cloud Connectors enable Cloudbeat to use workload identity federation to impersonate into the target GCP account without requiring long-lived credentials.

Changes:

  • Added three new credential fields for GCP Cloud Connectors: gcp.credentials.service_account_email, gcp.credentials.audience, and gcp_credentials_cloud_connector_id
  • Added configuration templates for both organization and single account GCP Cloud Connector deployments
  • Updated the template to include the new credential fields and supports_cloud_connectors flag
  • Bumped version from 3.3.0-preview02 to 3.3.0-preview03

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
packages/cloud_security_posture/manifest.yml Version bump from 3.3.0-preview02 to 3.3.0-preview03
packages/cloud_security_posture/data_stream/findings/manifest.yml Added Cloud Connector configuration options for both organization and single account GCP deployments, including three new credential fields
packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs Updated template to include new Cloud Connector credential fields and supports_cloud_connectors flag
packages/cloud_security_posture/changelog.yml Added changelog entry for GCP Cloud Connectors support

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
secret: true
- name: gcp.credentials.audience
type: text
title: Service Account Email
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The title for this field is incorrect. It says "Service Account Email" but this field is for the audience parameter. The title should be "Audience" instead.

Suggested change
title: Service Account Email
title: Audience

Copilot uses AI. Check for mistakes.
Comment thread packages/cloud_security_posture/changelog.yml Outdated
changes:
- description: Support GCP Cloud Connectors
type: enhancement
link: https://github.com/elastic/integrations/pull/1515151515151515
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR link appears to be invalid. The link "https://github.com/elastic/integrations/pull/1515151515151515" contains a PR number that is unrealistically high and likely a placeholder. This should be updated with the actual PR number once known, or removed if not yet available.

Suggested change
link: https://github.com/elastic/integrations/pull/1515151515151515

Copilot uses AI. Check for mistakes.
Comment thread packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs
Comment on lines +19 to +21
{{#if gcp.supports_cloud_connectors}}
supports_cloud_connectors: {{gcp.supports_cloud_connectors}}
{{/if}}
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The field "gcp.supports_cloud_connectors" is referenced in the template but is not defined in the manifest.yml vars section. This field should be added to the vars section similar to how "aws.supports_cloud_connectors" is defined (around line 192 of the manifest), with appropriate type and configuration.

Suggested change
{{#if gcp.supports_cloud_connectors}}
supports_cloud_connectors: {{gcp.supports_cloud_connectors}}
{{/if}}

Copilot uses AI. Check for mistakes.
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented Feb 1, 2026

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@andrewkroh andrewkroh added the Integration:cloud_security_posture Security Posture Management label Feb 2, 2026
Omolola-Akinleye
Omolola-Akinleye reviewed Feb 2, 2026
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs
service_account_email: {{gcp.credentials.service_account_email}}
{{/if}}
{{#if gcp.credentials.audience}}
audience: {{gcp.credentials.audience}}
Copy link
Copy Markdown
Contributor

@Omolola-Akinleye Omolola-Akinleye Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What the credentials for audience? Do you have an example of an output?

Copy link
Copy Markdown
Contributor Author

@amirbenun amirbenun Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

target_service_account_email: "elastic-agent-sa-<SUFFIX>@elastic-security-test.iam.gserviceaccount.com"
gcp_audience: "//iam.googleapis.com/projects/439975565995/locations/global/workloadIdentityPools/elastic-pool-<SUFFIX>/providers/elastic-aws-provider-<SUFFIX>"

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Feb 3, 2026

💚 Build Succeeded

History

@Omolola-Akinleye Omolola-Akinleye self-requested a review February 3, 2026 16:09
Omolola-Akinleye
Omolola-Akinleye approved these changes Feb 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@Omolola-Akinleye Omolola-Akinleye left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@amirbenun amirbenun merged commit c865647 into elastic:main Feb 4, 2026
9 checks passed
@amirbenun amirbenun deleted the gcp-cloud-connectors branch February 4, 2026 14:12
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented Feb 4, 2026

Package cloud_security_posture - 3.3.0-preview03 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.3.0-preview03/

@amirbenun amirbenun mentioned this pull request Feb 9, 2026
Merged
jakubgalecki0 pushed a commit to jakubgalecki0/integrations that referenced this pull request Feb 19, 2026
@amirbenun @jakubgalecki0
[Cloud Security Posture] Support GCP Cloud Connectors (elastic#17185)
bfa728c
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented Apr 9, 2026

Package cloud_security_posture - 3.3.0 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.3.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Omolola-Akinleye Omolola-Akinleye Omolola-Akinleye approved these changes

Assignees

No one assigned

Labels

Integration:cloud_security_posture Security Posture Management

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@amirbenun @elasticmachine @Omolola-Akinleye @andrewkroh