[AWS Onboarding] Add Connect Account step UI by juliaElastic · Pull Request #271195 · elastic/kibana

juliaElastic · 2026-05-26T08:38:09Z

Summary

Implements the Connect Account step of the AWS onboarding flow (issue #7620), letting users choose how Elastic authenticates to their AWS account before proceeding to subsequent steps.

Plan to move the Account step later in the flow, to start with Services and show the Account step based on selected services: FI only if supported by selected services, ECF/Firehose doesn't need Account setup.

What's added

Fleet plugin — AwsConnectSetup component (exported as LazyAwsConnectSetup):

AwsAuthTypeSelector: select between Identity Federation (cloud connector), Static keys and ** Temporary keys**
AwsIdentityFederationSetup: tabbed UI with an Existing Identity selector (reuses CloudConnectorSelector) and a New Identity form (Role ARN + External ID + connector name + CloudFormation launcher). The "Create Identity" button calls the cloud connector API and auto-selects the new connector on success.
AwsStaticKeysForm: fields for Access Key ID, Secret Access Key
AwsTemporaryKeysForm: fields for Access Key ID, Secret Access Key, and Session Token
useCreateCloudConnector: react-query mutation hook wrapping POST /api/fleet/cloud_connectors

Ingest Hub plugin — onboarding flow wiring:

onNext callback threaded from OnboardingShell → step components → AwsConnectSetup; clicking Next marks the step complete and advances to the next step
OnboardingFlowProvider / useOnboardingFlow: React context backed by sessionStorage (onboarding.aws.connectStep) holding the selected connectorId, entered staticKeys or temporaryKeys as a single object
Connector selection and static/temporary key fields are preserved when navigating back to the Connect step: initial values are passed into the sub-forms on remount, and auth type is restored from stored state
Added Scout UI tests

Test plan

Enable feature flag:

feature_flags.overrides:
  ingestHub.onboardingEnabled: true

Select Identity Federation, create a new identity via CloudFormation → connector appears in Existing tab and is auto-selected → Next button becomes active
Select an existing identity from the dropdown → Next button becomes active
Switch to Static keys, enter Access Key ID + Secret → Next button becomes active
Switch to Temporary keys, enter form fields → Next button becomes active
Click Next on Connect step → moves to Services step; click back → previously selected connector / entered keys are still shown
Refresh page while on Connect step → session storage restores prior selections

🤖 Generated with Claude Code

Screenshots

…nagement Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

kibanamachine · 2026-05-26T10:38:36Z

🤖 Prompt Changes Detected

Changes have been detected to one or more prompt files in the Elastic Assistant plugin.

Please remember to update the integrations repository with your prompt changes to ensure consistency across all deployments.

Next Steps:

Follow the documentation in x-pack/solutions/security/packages/security-ai-prompts/README.md to update the corresponding prompt files
Make the changes in the integrations repository
Test your changes in the integrations environment
Ensure prompt consistency across all deployments

This is an automated reminder to help maintain prompt consistency across repositories.

infra-vault-gh-plugin-prod · 2026-05-27T09:42:31Z

Pinging @elastic/fleet (Team:Fleet)

maxcold · 2026-05-27T10:08:48Z

@Omolola-Akinleye all changes are in x-pack/platform/plugins/shared/fleet/public/components/cloud_connector trigger request review from contextual-security-apps team. Can you update the CODEOWNERS to the correct owner?

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds the AWS “Connect Account” step to the Ingest Hub onboarding flow by integrating Fleet’s new AwsConnectSetup UI and persisting user selections across navigation.

Changes:

Wire Ingest Hub onboarding “Connect” step to Fleet’s LazyAwsConnectSetup, including step-to-step navigation (onNext)
Add session-backed onboarding flow context to preserve connector selection / entered keys across back navigation
Extend Fleet with AWS connect setup UI + create-cloud-connector hook and update cloud connector secret-reference handling + tests

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
x-pack/platform/plugins/shared/ingest_hub/kibana.jsonc	Declares Fleet as a required plugin for the new Connect step integration
x-pack/platform/plugins/shared/ingest_hub/public/onboarding/onboarding_app.tsx	Adds React Query + onboarding flow provider around the onboarding router
x-pack/platform/plugins/shared/ingest_hub/public/onboarding/step_components/connect_step.tsx	Replaces placeholder “Connect” UI with Fleet’s lazy AWS connect setup component
x-pack/platform/plugins/shared/ingest_hub/public/onboarding/onboarding_flow_context.tsx	Introduces sessionStorage-backed state for the Connect step
x-pack/platform/plugins/shared/ingest_hub/public/onboarding/onboarding_shell.tsx	Threads `onNext` into step components and advances the flow when pressed
x-pack/platform/plugins/shared/ingest_hub/test/scout/ui/tests/onboarding_connect_step.spec.ts	Adds Scout UI coverage for the Connect step behaviors
x-pack/platform/plugins/shared/fleet/public/components/cloud_connector/aws_connect_setup/*	Implements the AWS auth-type selector + sub-forms + identity federation creation flow
x-pack/platform/plugins/shared/fleet/public/components/cloud_connector/hooks/use_create_cloud_connector.ts	Adds a React Query mutation wrapper for creating cloud connectors
x-pack/platform/plugins/shared/fleet/common/types/models/cloud_connector.ts	Adds a secret-reference type guard and broadens AWS external_id typing
x-pack/platform/plugins/shared/fleet/server/services/cloud_connector.ts	Uses the new type guard when extracting/validating secret references
packages/kbn-optimizer/limits.yml	Updates optimizer budgets for Fleet and Ingest Hub bundles

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 12 comments.

criamico · 2026-05-28T10:05:19Z

+    } else {
+      setSelectedTabId(cloudConnectors.length > 0 ? TABS.EXISTING_CONNECTION : TABS.NEW_CONNECTION);
+    }
+  }, [cloudConnectors.length, isEditPage]);


A review with Claude flagged that this useEffect might create issues and suggested to run only on initial load, since it changes the selected tab every time cloudConnectors.length changes

addressed in da5b0b1

kibanamachine · 2026-05-28T11:51:04Z

💚 Build Succeeded

Buildkite Build
Commit: f14c293
Build duration: 54 mins

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	2224	2231	+7
`ingestHub`	43	44	+1
total			+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	2.8MB	2.8MB	+13.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	211.3KB	211.8KB	+521.0B
`ingestHub`	11.3KB	13.1KB	+1.8KB
total			+2.3KB

History

💛 Build #448916 was flaky 5b47ff2
💔 Build #448902 failed c16b79c
💔 Build #448888 failed 3de70d4
💔 Build #448737 failed b4fcaca
💔 Build #448179 failed 9f4a2f1
💔 Build #448160 failed 81c0a3c

- Accept onNext prop from OnboardingShell (introduced by PR elastic#271195) - Import useOnboardingFlow to read connectorId and derive authType - Wire onClick={onNext} on the Continue button - Remove duplicate @kbn/fleet-plugin from tsconfig kbn_references - Keep selectedServices/serviceVars/isNewConnection as TODO stubs until the Services step PR extends OnboardingFlowContext Co-authored-by: Cursor <cursoragent@cursor.com>

criamico

Code LGTM 🚀

rStelmach

obs-onboarding changes LGTM

- Accept onNext prop from OnboardingShell (introduced by PR elastic#271195) - Import useOnboardingFlow to read connectorId and derive authType - Wire onClick={onNext} on the Continue button - Remove duplicate @kbn/fleet-plugin from tsconfig kbn_references - Keep selectedServices/serviceVars/isNewConnection as TODO stubs until the Services step PR extends OnboardingFlowContext Co-authored-by: Cursor <cursoragent@cursor.com>

…urity-apps to cloud-services (#271728) ## Summary - Reassigns `@elastic/contextual-security-apps` co-ownership of Fleet's `cloud_connector` code to `@elastic/cloud-services`. - Adds explicit co-ownership for the server-side `cloud_connector` route and services dirs (previously only inherited from the parent `fleet` rule). - Context: [kibana#271195 (comment)](#271195 (comment)). ## Paths affected | Path | Before | After | | --- | --- | --- | | `x-pack/platform/plugins/shared/fleet/public/components/cloud_connector` | `@elastic/fleet @elastic/contextual-security-apps` | `@elastic/fleet @elastic/cloud-services` | | `x-pack/platform/plugins/shared/fleet/common/services/cloud_connectors` | `@elastic/fleet @elastic/contextual-security-apps` | `@elastic/fleet @elastic/cloud-services` | | `x-pack/platform/plugins/shared/fleet/server/routes/cloud_connector` | (inherited `@elastic/fleet`) | `@elastic/fleet @elastic/cloud-services` *(new)* | | `x-pack/platform/plugins/shared/fleet/server/services/cloud_connectors` | (inherited `@elastic/fleet`) | `@elastic/fleet @elastic/cloud-services` *(new)* | Other `cloud_security_posture` / `cloud_posture_third_party_support_callout` lines in the same block are intentionally left as-is. ## Test plan - [ ] CI CODEOWNERS validation passes. - [ ] Confirm a follow-up PR touching `fleet/public/components/cloud_connector/**` auto-requests review from `@elastic/cloud-services` (and not `@elastic/contextual-security-apps`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

## Summary Implements the **Connect Account** step of the AWS onboarding flow (issue [elastic#7620](https://github.com/elastic/ingest-dev/issues/7620)), letting users choose how Elastic authenticates to their AWS account before proceeding to subsequent steps. Plan to move the Account step later in the flow, to start with Services and show the Account step based on selected services: FI only if supported by selected services, ECF/Firehose doesn't need Account setup. ### What's added **Fleet plugin — `AwsConnectSetup` component** (exported as `LazyAwsConnectSetup`): - `AwsAuthTypeSelector`: select between **Identity Federation** (cloud connector), **Static keys** and ** Temporary keys** - `AwsIdentityFederationSetup`: tabbed UI with an **Existing Identity** selector (reuses `CloudConnectorSelector`) and a **New Identity** form (Role ARN + External ID + connector name + CloudFormation launcher). The "Create Identity" button calls the cloud connector API and auto-selects the new connector on success. - `AwsStaticKeysForm`: fields for Access Key ID, Secret Access Key - `AwsTemporaryKeysForm`: fields for Access Key ID, Secret Access Key, and Session Token - `useCreateCloudConnector`: `react-query` mutation hook wrapping `POST /api/fleet/cloud_connectors` **Ingest Hub plugin — onboarding flow wiring**: - `onNext` callback threaded from `OnboardingShell` → step components → `AwsConnectSetup`; clicking Next marks the step complete and advances to the next step - `OnboardingFlowProvider` / `useOnboardingFlow`: React context backed by `sessionStorage` (`onboarding.aws.connectStep`) holding the selected `connectorId`, entered `staticKeys` or `temporaryKeys` as a single object - Connector selection and static/temporary key fields are **preserved when navigating back** to the Connect step: initial values are passed into the sub-forms on remount, and auth type is restored from stored state - Added Scout UI tests ## Test plan - Enable feature flag: ``` feature_flags.overrides: ingestHub.onboardingEnabled: true ``` - [ ] Select **Identity Federation**, create a new identity via CloudFormation → connector appears in Existing tab and is auto-selected → Next button becomes active - [ ] Select an existing identity from the dropdown → Next button becomes active - [ ] Switch to **Static keys**, enter Access Key ID + Secret → Next button becomes active - [ ] Switch to **Temporary keys**, enter form fields → Next button becomes active - [ ] Click Next on Connect step → moves to Services step; click back → previously selected connector / entered keys are still shown - [ ] Refresh page while on Connect step → session storage restores prior selections 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Screenshots <img width="1203" height="668" alt="image" src="https://github.com/user-attachments/assets/3a70815a-a3f8-46af-aada-68c3cb3d8c15" /> <img width="1207" height="954" alt="image" src="https://github.com/user-attachments/assets/09ee3644-856e-4595-801d-80109a87260a" /> <img width="1208" height="694" alt="image" src="https://github.com/user-attachments/assets/0ef3a47a-cb4d-4c23-8dc7-080f727ce6ce" /> <img width="1200" height="685" alt="image" src="https://github.com/user-attachments/assets/ab9e3908-d41d-44f3-8400-7eab4eb5872a" /> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…urity-apps to cloud-services (elastic#271728) ## Summary - Reassigns `@elastic/contextual-security-apps` co-ownership of Fleet's `cloud_connector` code to `@elastic/cloud-services`. - Adds explicit co-ownership for the server-side `cloud_connector` route and services dirs (previously only inherited from the parent `fleet` rule). - Context: [kibana#271195 (comment)](elastic#271195 (comment)). ## Paths affected | Path | Before | After | | --- | --- | --- | | `x-pack/platform/plugins/shared/fleet/public/components/cloud_connector` | `@elastic/fleet @elastic/contextual-security-apps` | `@elastic/fleet @elastic/cloud-services` | | `x-pack/platform/plugins/shared/fleet/common/services/cloud_connectors` | `@elastic/fleet @elastic/contextual-security-apps` | `@elastic/fleet @elastic/cloud-services` | | `x-pack/platform/plugins/shared/fleet/server/routes/cloud_connector` | (inherited `@elastic/fleet`) | `@elastic/fleet @elastic/cloud-services` *(new)* | | `x-pack/platform/plugins/shared/fleet/server/services/cloud_connectors` | (inherited `@elastic/fleet`) | `@elastic/fleet @elastic/cloud-services` *(new)* | Other `cloud_security_posture` / `cloud_posture_third_party_support_callout` lines in the same block are intentionally left as-is. ## Test plan - [ ] CI CODEOWNERS validation passes. - [ ] Confirm a follow-up PR touching `fleet/public/components/cloud_connector/**` auto-requests review from `@elastic/cloud-services` (and not `@elastic/contextual-security-apps`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Accept onNext prop from OnboardingShell (introduced by PR elastic#271195) - Import useOnboardingFlow to read connectorId and derive authType - Wire onClick={onNext} on the Continue button - Remove duplicate @kbn/fleet-plugin from tsconfig kbn_references - Keep selectedServices/serviceVars/isNewConnection as TODO stubs until the Services step PR extends OnboardingFlowContext Co-authored-by: Cursor <cursoragent@cursor.com>

[AWS Onboarding] Add Connect Account step UI with credential state ma…

f71b955

…nagement Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

juliaElastic added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels May 26, 2026

remove secret fields from session storage

2a36df2

juliaElastic force-pushed the aws-connect-account-step branch from 1a3128e to 2a36df2 Compare May 26, 2026 11:37

juliaElastic and others added 6 commits May 26, 2026 13:38

Merge branch 'main' into aws-connect-account-step

869eafd

Changes from node scripts/lint_ts_projects --fix

84eb433

Changes from node scripts/regenerate_moon_projects.js --update

55c44cd

separate temporary keys, static keys instructions, select

3ceb0f2

reduce bundle size

81c0a3c

fix type errors

9f4a2f1

juliaElastic requested a review from bhapas May 27, 2026 08:32

juliaElastic marked this pull request as ready for review May 27, 2026 08:32

juliaElastic requested review from a team as code owners May 27, 2026 08:32

juliaElastic requested a review from maxcold May 27, 2026 08:32

added scout ui tests

17d0653

botelastic Bot added the Team:Fleet Team label for Observability Data Collection Fleet team label May 27, 2026

make session token required

b4fcaca

maxcold requested review from Omolola-Akinleye and removed request for maxcold May 27, 2026 10:06

update ingestHub limit

b323131

bhapas requested a review from Copilot May 27, 2026 11:23

Copilot AI reviewed May 27, 2026

View reviewed changes

address review comments

ccf03ad

juliaElastic requested a review from Copilot May 27, 2026 12:20

Copilot AI reviewed May 27, 2026

View reviewed changes

nchaulet self-requested a review May 27, 2026 13:22

juliaElastic added 3 commits May 27, 2026 15:43

address review comments

3de70d4

increase limit

c16b79c

fix checks

5b47ff2

criamico reviewed May 28, 2026

View reviewed changes

juliaElastic and others added 2 commits May 28, 2026 12:55

address review comment

da5b0b1

Merge branch 'main' into aws-connect-account-step

f14c293

bhapas approved these changes May 28, 2026

View reviewed changes

juliaElastic requested a review from criamico May 28, 2026 11:33

criamico approved these changes May 28, 2026

View reviewed changes

juliaElastic requested a review from rStelmach May 28, 2026 12:30

rStelmach approved these changes May 28, 2026

View reviewed changes

juliaElastic merged commit e975542 into elastic:main May 28, 2026
32 checks passed

kibanamachine added the v9.5.0 label May 28, 2026

Omolola-Akinleye mentioned this pull request May 28, 2026

[CODEOWNERS] Move Fleet cloud_connector ownership from contextual-security-apps to cloud-services #271728

Merged

2 tasks

github-actions Bot mentioned this pull request May 30, 2026

Failing test: Onboarding connect step - static keys path — form enables Next when credentials are filled #272028

Open

Conversation

juliaElastic commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's added

Test plan

Screenshots

Uh oh!

kibanamachine commented May 26, 2026

🤖 Prompt Changes Detected

Next Steps:

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 27, 2026

Uh oh!

maxcold commented May 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

criamico May 28, 2026

Choose a reason for hiding this comment

Uh oh!

juliaElastic May 28, 2026

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented May 28, 2026

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

Uh oh!

criamico left a comment

Choose a reason for hiding this comment

Uh oh!

rStelmach left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

juliaElastic commented May 26, 2026 •

edited

Loading