[Cloud Secutity Posture] Add cloud connector support for asset discovery

x-pack/platform/plugins/private/translations/translations/fr-FR.json

@@ -35206,17 +35206,6 @@
     "xpack.securitySolution.assetInventory.emptyState.readDocsLink": "Lisez les documents",
     "xpack.securitySolution.assetInventory.emptyState.resetFiltersButton": "Réinitialiser les filtres",
     "xpack.securitySolution.assetInventory.emptyState.title": "Aucun résultat ne correspond à vos critères de recherche.",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.agentlessAWSCredentialsForm.cloudFormation.launchButton": "Lancer CloudFormation",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.description": "Les clés d'accès sont des informations d'identification à long terme pour un utilisateur IAM ou l'utilisateur racine du compte AWS. Utilisez AWS CloudFormation (un outil AWS intégré) ou une série d'étapes manuelles pour configurer l'accès. {learnMore}.",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.learnMoreLinkText": "En savoir plus sur CloudFormation",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.steps.launch": "Cliquez sur le bouton {launchCloudFormation} ci-dessous.",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept": "Cochez la case située sous les {capabilities} dans le formulaire d'évaluation CloudFormation : {acknowledge}",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.acknowledge": "Je reconnais qu'AWS CloudFormation peut créer des ressources IAM.",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.capabilties": "fonctionnalités",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.create": "Cliquez sur {createStack}.",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.credentials": "Copiez les {accessKeyId} et les {secretAccessKey}, puis collez les informations d'identification ci-dessous",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.region": "(Facultatif) Modifiez la {amazonRegion} dans le coin supérieur droit pour qu'elle corresponde à la région où vous voulez déployer la suite",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.stackStatus": "Une fois que l'état de la suite est {createComplete}, cliquez sur l'onglet Sorties",
     "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.googleCloudShell.cloudCredentials.button": "Lancer Google Cloud Shell",
     "xpack.securitySolution.assetInventory.fleetIntegration.assetIntegration.integration.fieldRequired": "{field} est obligatoire",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.awsOrganizationDescription": "Connectez Elastic à chaque compte AWS (actuel et futur) de votre environnement en fournissant à Elastic un accès en lecture seule (configuration) à votre organisation AWS.",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

@@ -35181,15 +35181,6 @@
     "xpack.securitySolution.assetInventory.emptyState.illustrationAlt": "0件ヒット",
     "xpack.securitySolution.assetInventory.emptyState.resetFiltersButton": "フィルターをリセット",
     "xpack.securitySolution.assetInventory.emptyState.title": "検索条件と一致する結果がありません。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.agentlessAWSCredentialsForm.cloudFormation.launchButton": "CloudFormationを起動",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.description": "アクセスキーはIAMユーザーまたはAWSアカウントルートユーザー用の長期的な資格情報です。AWS CloudFormation（AWSに組み込まれたツール）または一連の手動ステップを利用してアクセスを設定します。{learnMore}。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.learnMoreLinkText": "CloudFormationの詳細",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.steps.launch": "下の［{launchCloudFormation}］ボタンをクリックします。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.acknowledge": "AWS CloudFormationがIAMリソースを作成する可能性があることを承諾します。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.capabilties": "機能",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.create": "{createStack}をクリックします。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.credentials": "{accessKeyId}と{secretAccessKey}をコピーして、以下に資格情報を貼り付けます",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.stackStatus": "スタックステータスが{createComplete}になったら、［出力］タブをクリックします",
     "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.googleCloudShell.cloudCredentials.button": "Google Cloud Shellを起動",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.awsOrganizationDescription": "お客様のAWS組織への読み取り専用（設定）アクセスをElasticに提供することで、お客様の環境にあるすべてのAWSアカウント（現在および将来）にElasticを接続します。",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.awsOrganizationLabel": "AWS組織",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

@@ -35241,29 +35241,14 @@
     "xpack.securitySolution.assetInventory.emptyState.resetFiltersButton": "重置筛选",
     "xpack.securitySolution.assetInventory.emptyState.title": "没有任何结果匹配您的搜索条件",
     "xpack.securitySolution.assetInventory.fleetIntegration.accessKeyIdLabel": "访问密钥 ID",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.agentlessAWSCredentialsForm.cloudFormation.launchButton": "启动 CloudFormation",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.description": "访问密钥是 IAM 用户或 AWS 帐户根用户的长期凭据。利用 AWS CloudFormation（内置 AWS 工具）或一系列手动步骤设置访问权限。{learnMore}。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.learnMoreLinkText": "详细了解 CloudFormation",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.steps.launch": "单击下面的 {launchCloudFormation} 按钮。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.steps.organizationLogin": "作为 {admin} 登录到您要载入的 AWS 组织管理帐户",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.guide.steps.singleLogin": "作为 {admin} 登录到您要载入的 AWS 帐户",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept": "在打开的 CloudFormation 堆栈复查表单中，勾选 {capabilities} 下方的复选框：{acknowledge}",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.acknowledge": "我确认，AWS CloudFormation 可以创建 IAM 资源。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.accept.capabilties": "功能",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.create": "单击 {createStack}。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.credentials": "复制 {accessKeyId} 和 {secretAccessKey}，然后粘贴以下凭据",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.region": "（可选）将右上角的 {amazonRegion} 更改为要将您的堆栈部署到的区域",
-    "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.cloudFormation.steps.stackStatus": "一旦堆栈状态为 {createComplete}，则单击“输出”选项卡",
     "xpack.securitySolution.assetInventory.fleetIntegration.agentlessForm.googleCloudShell.cloudCredentials.button": "启动 Google Cloud Shell",
     "xpack.securitySolution.assetInventory.fleetIntegration.assetIntegration.integration.fieldRequired": "{field} 必填",
     "xpack.securitySolution.assetInventory.fleetIntegration.assumeRoleDescription": "IAM 角色 Amazon 资源名称 (ARN) 是您可在 AWS 帐户中创建的 IAM 身份。创建 IAM 角色时，用户可以定义该角色的权限。角色没有标准的长期凭据，如密码或访问密钥。",
-    "xpack.securitySolution.assetInventory.fleetIntegration.assumeRoleLabel": "接管角色",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.awsOrganizationDescription": "通过为 Elastic 提供您的 AWS 组织的只读（配置）访问权限，将 Elastic 连接到您环境中的每个 AWS 帐户（当前和未来）。",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.awsOrganizationLabel": "AWS 组织",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountType.singleAccountLabel": "单个帐户",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsAccountTypeDescriptionLabel": "选择单个帐户或组织，然后填写名称和描述以帮助标识此集成。",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsCredentialTypeSelectorLabel": "首选手动方法",
-    "xpack.securitySolution.assetInventory.fleetIntegration.awsCredentialTypeSelectorLabelAgentless": "首选方法",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsIntegration.cloudFormationSetupNote": "如需了解更多详细信息，请参阅{documentation}。",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsIntegration.cloudFormationSetupStep.hostRequirement": "确保在下面的“要将此集成添加到什么位置？”部分中选择了“新主机”",
     "xpack.securitySolution.assetInventory.fleetIntegration.awsIntegration.cloudFormationSetupStep.launch": "在随后的弹出式模式窗口中，单击“启动 CloudFormation”按钮。",
@@ -35329,7 +35314,6 @@
     "xpack.securitySolution.assetInventory.fleetIntegration.integrationDescriptionLabel": "描述",
     "xpack.securitySolution.assetInventory.fleetIntegration.integrationNameLabel": "名称",
     "xpack.securitySolution.assetInventory.fleetIntegration.integrationSettingsTitle": "集成设置",
-    "xpack.securitySolution.assetInventory.fleetIntegration.roleArnLabel": "角色 ARN",
     "xpack.securitySolution.assetInventory.fleetIntegration.secretAccessKeyLabel": "机密访问密钥",
     "xpack.securitySolution.assetInventory.fleetIntegration.sessionTokenLabel": "会话令牌",
     "xpack.securitySolution.assetInventory.fleetIntegration.setupTechnology.agentBasedRadioDescription": "将 Elastic 代理部署到您的云环境",

x-pack/solutions/security/plugins/cloud_security_posture/public/components/fleet_extensions/aws_credentials_form/aws_credentials_form_agentless.tsx

@@ -99,7 +99,7 @@ Utilize AWS CloudFormation (a built-in AWS tool) or a series of manual steps to
       intro: (
         <FormattedMessage
           id="xpack.csp.agentlessForm.cloudFormation.guide.description.cloudConnectors"
-          defaultMessage="An IAM role Amazon Resource Name (ARN) is an IAM identity that you can create in your AWS account. When creating an IAM role, users can define the role’s permissions. Roles do not have standard long-term credentials such as passwords or access keys. {learnMore}."
+          defaultMessage="To enable CSPM, you launch an AWS CloudFormation stack that automatically creates an IAM role in your account. This role includes the necessary permissions and embeds a unique External ID—generated during onboarding—into its trust policy. The resulting Role ARN and External ID are then used by CSPM to securely assume the role and access your AWS resources. Roles do not have standard long-term credentials such as passwords or access keys. {learnMore}."
           values={{
             learnMore: (
               <EuiLink

x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts

@@ -263,6 +263,11 @@ export const allowedExperimentalValues = Object.freeze({
    * Automatically installs the security AI prompts package
    */
   securityAIPromptsEnabled: false,
+
+  /**
+   * Enables the new cloud connector UI and e2e flow for Asset Inventory Integration
+   */
+  cloudConnectorsEnabled: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;

x-pack/solutions/security/plugins/security_solution/public/asset_inventory/components/fleet_extensions/aws_credentials_form/aws_credentials_form.tsx

@@ -21,14 +21,14 @@ import type { NewPackagePolicyInput, PackageInfo } from '@kbn/fleet-plugin/commo
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 import { css } from '@emotion/react';
-import { getAssetPolicy } from '../utils';
+import { getAssetPolicy, getAwsCredentialsType } from '../utils';
 import type { AssetRadioOption } from '../asset_boxed_radio_group';
 import { RadioGroup } from '../asset_boxed_radio_group';
 import {
   AWS_CREDENTIALS_TYPE_OPTIONS_TEST_SUBJ,
   AWS_CREDENTIALS_TYPE_SELECTOR_TEST_SUBJ,
 } from '../test_subjects';
-import { AWS_ORGANIZATION_ACCOUNT, AWS_SETUP_FORMAT } from './constants';
+import { AWS_CREDENTIALS_TYPE, AWS_ORGANIZATION_ACCOUNT, AWS_SETUP_FORMAT } from './constants';
 import type { AwsCredentialsTypeOptions } from './aws_credentials_form_options';
 import { getAwsCredentialsFormManualOptions } from './aws_credentials_form_options';
 import { AwsInputVarFields } from './aws_input_var_fields';
@@ -78,6 +78,24 @@ const getSetupFormatOptions = (): AssetRadioOption[] => [
   },
 ];
 
+export const getAgentlessCredentialsType = (
+  postureInput: Extract<NewPackagePolicyAssetInput, { type: 'cloudbeat/asset_inventory_aws' }>,
+  showCloudConnectors: boolean
+): AwsCredentialsType => {
+  const credentialsType = getAwsCredentialsType(postureInput);
+  if (
+    (!credentialsType && showCloudConnectors) ||
+    (credentialsType === AWS_CREDENTIALS_TYPE.CLOUD_FORMATION && showCloudConnectors)
+  ) {
+    return AWS_CREDENTIALS_TYPE.CLOUD_CONNECTORS;
+  }
+
+  if (credentialsType === AWS_CREDENTIALS_TYPE.CLOUD_FORMATION || !credentialsType) {
+    return AWS_CREDENTIALS_TYPE.DIRECT_ACCESS_KEYS;
+  }
+
+  return credentialsType;
+};
 export interface AwsFormProps {
   newPolicy: NewPackagePolicy;
   input: Extract<NewPackagePolicyAssetInput, { type: 'cloudbeat/asset_inventory_aws' }>;
@@ -294,17 +312,20 @@ export const AwsCredentialTypeSelector = ({
   onChange,
   label,
   options,
+  disabled = false,
 }: {
   onChange(type: AwsCredentialsType): void;
   type: AwsCredentialsType;
   label: string;
   options: AwsCredentialsTypeOptions;
+  disabled?: boolean;
 }) => (
   <EuiFormRow fullWidth label={label}>
     <EuiSelect
       fullWidth
       options={options}
       value={type}
+      disabled={disabled}
       onChange={(optionElem) => {
         onChange(optionElem.target.value as AwsCredentialsType);
       }}