Skip to content

Add provider_permissions field for declaring integration permission requirements #1180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jsoriano merged 6 commits into from
Jun 10, 2026
Merged

Add provider_permissions field for declaring integration permission requirements #1180

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
978ed29
Support roles and permissions mapping
jeniawhite Jun 3, 2026
ad17505
Update manifest.spec.yml
jeniawhite Jun 3, 2026
ec060d5
input spec
jeniawhite Jun 3, 2026
e3607a0
CR changes
jeniawhite Jun 4, 2026
dc5e401
CR
jeniawhite Jun 4, 2026
1645339
Update spec/changelog.yml
jeniawhite Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions code/go/pkg/validator/validator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,8 @@ func TestValidateFile(t *testing.T) {
"logs_synthetic_mode": {},
"kibana_configuration_links": {},
"with_links": {},
"good_provider_permissions": {},
"good_provider_permissions_input": {},
"bad_duration_vars": {
"manifest.yml",
[]string{
Expand Down Expand Up @@ -246,6 +248,30 @@ func TestValidateFile(t *testing.T) {
"\"Dashboard with mixed by-value visualizations\" contains legacy visualization: \"Timelion time series\" (timelion, Timelion)",
},
},
"bad_provider_permissions": {
"manifest.yml",
[]string{
`field provider_permissions.0: provider is required`,
},
},
"bad_provider_permissions_old_version": {
"manifest.yml",
[]string{
`field (root): Additional property provider_permissions is not allowed`,
},
},
"bad_provider_permissions_missing_name": {
"manifest.yml",
[]string{
`field provider_permissions.0.permissions.0: name is required`,
},
},
"bad_provider_permissions_extra_field": {
"manifest.yml",
[]string{
`field provider_permissions.0.permissions.0: Additional property resources is not allowed`,
},
},
"bad_deployment_mode": {
"manifest.yml",
[]string{
Expand Down
3 changes: 3 additions & 0 deletions spec/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@
- description: Add support for semantic_text field definition.
type: enhancement
link: https://github.com/elastic/package-spec/pull/807
- description: Add provider_permissions field to package, policy_template, input, and data_stream levels for declaring provider-specific permissions.

@teresaromero teresaromero Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there any change required on the kibana side for this to be released?

@juliaElastic juliaElastic Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we will use the provider_permissions from kibana to generate a list of required permissions in the onboarding flow: https://github.com/elastic/ingest-dev/issues/7927
there should be no dependency on kibana, the new fields are additive and won't be used on old kibana versions (should be smoke tested)

@jsoriano jsoriano Jun 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As this doesn't affect existing versions of Kibana we can release this in 3.6.4, and use it on any package.

type: enhancement
link: https://github.com/elastic/package-spec/pull/0000
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
- version: 3.6.3
changes:
- description: Add optional `release` field to agentless deployment mode to explicitly declare its release stage.
Expand Down
10 changes: 10 additions & 0 deletions spec/input/manifest.spec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,8 @@ spec:
$ref: "../integration/manifest.spec.yml#/definitions/var_groups"
sections:
$ref: "../integration/manifest.spec.yml#/definitions/sections"
provider_permissions:
$ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
input:
type: string
examples:
Expand Down Expand Up @@ -146,6 +148,8 @@ spec:
$ref: "../integration/manifest.spec.yml#/definitions/var_groups"
sections:
$ref: "../integration/manifest.spec.yml#/definitions/sections"
provider_permissions:
$ref: "../integration/manifest.spec.yml#/definitions/provider_permissions"
owner:
$ref: "../integration/manifest.spec.yml#/definitions/owner"
agent:
Expand All @@ -172,6 +176,12 @@ spec:

# JSON patches for newer versions should be placed on top
versions:
- before: 3.7.0
patch:
- op: remove
path: "/properties/provider_permissions"
- op: remove
path: "/properties/policy_templates/items/properties/provider_permissions"

@jsoriano jsoriano Jun 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JSON patches would not be needed if this new setting doesn't affect existing versions of Fleet.

Suggested change
- before: 3.7.0
patch:
- op: remove
path: "/properties/provider_permissions"
- op: remove
path: "/properties/policy_templates/items/properties/provider_permissions"

- before: 3.6.0
patch:
- op: remove
Expand Down
7 changes: 7 additions & 0 deletions spec/integration/data_stream/manifest.spec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -706,10 +706,17 @@ spec:
$ref: "../../integration/manifest.spec.yml#/definitions/categories"
deprecated:
$ref: "../../integration/manifest.spec.yml#/definitions/deprecated"
provider_permissions:
$ref: "../../integration/manifest.spec.yml#/definitions/provider_permissions"
required:
- title
# JSON patches for newer versions should be placed on top
versions:
- before: 3.7.0
patch:
# provider_permissions field for provider-specific permission declarations.
- op: remove
path: "/properties/provider_permissions"

@jsoriano jsoriano Jun 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JSON patches would not be needed if this new setting doesn't affect existing versions of Fleet.

Suggested change
- before: 3.7.0
patch:
# provider_permissions field for provider-specific permission declarations.
- op: remove
path: "/properties/provider_permissions"

- before: 3.6.0
patch:
- op: add
Expand Down
96 changes: 96 additions & 0 deletions spec/integration/manifest.spec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -736,6 +736,85 @@ spec:
type: string
examples:
- httpjson
provider_permissions:
description: >
Permissions and roles this integration unit requires from the named provider.
May be declared at package, policy_template, input, and data_stream levels.

@teresaromero teresaromero Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we document how different levels of declaring this permissions work? what if i declare it at package and then at an input? does it override? Are there any cases where we might need to check semantically the meaning of this permissions across levels? Is there any case we want to avoid? or validate?

type: array
items:
type: object
additionalProperties: false
required:
- provider
properties:
provider:
description: >
Identifier of the provider these permissions apply to
(e.g. "aws", "gcp", "azure", "kubernetes", "okta").

@teresaromero teresaromero Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
(e.g. "aws", "gcp", "azure", "kubernetes", "okta").

as we have them as example on the examples i think this might be redundant. Else, we can keep them here and perhaps add a single example (reducing the lines)

type: string
examples:
- aws
- gcp
- azure
- kubernetes
- okta
- github
description:
description: Human-readable description of why these permissions are needed.
type: string
roles:
description: Pre-defined roles or managed policies to attach alongside inline permissions.
type: array
items:
type: object
additionalProperties: false
required:
- name
properties:
name:
description: Display name of the role or managed policy.
type: string
examples:
- SecurityAudit
- Storage Blob Data Reader
- roles/logging.viewer
- cluster-reader
id:
description: Provider-specific identifier for this role or managed policy.
type: string
examples:
- arn:aws:iam::aws:policy/SecurityAudit
- roles/storage.objectViewer
- 2a2b9908-6ea1-4ae2-8e65-a410df84e7d1
description:
description: Human-readable description of this role.
type: string
permissions:
description: Individual permission grants required by this integration unit.
type: array
items:
type: object
additionalProperties: false
required:
- name
properties:
name:
description: Provider-specific permission or action name.
type: string
examples:
- s3:GetObject
- ec2:DescribeInstances
- storage.objects.get
- monitoring.timeSeries.list
- Microsoft.Compute/virtualMachines/read
- Microsoft.Insights/metrics/read
- pods:list
- namespaces:get
- okta.users.read
- contents:read
description:
description: Human-readable description of why this permission is needed.
type: string
properties:
format_version:
description: The version of the package specification format used by this package.
Expand Down Expand Up @@ -766,6 +845,8 @@ spec:
$ref: "#/definitions/categories"
conditions:
$ref: "#/definitions/conditions"
provider_permissions:
$ref: "#/definitions/provider_permissions"
# requires a conditional JSON schema to update the value depending
# on the policy_templates length
policy_templates_behavior:
Expand Down Expand Up @@ -903,6 +984,8 @@ spec:
type: string
examples:
- credential_type: [cloud_connectors]
provider_permissions:
$ref: "#/definitions/provider_permissions"
required:
- title
- description
Expand All @@ -923,6 +1006,8 @@ spec:
$ref: "#/definitions/sections"
deprecated:
$ref: "#/definitions/deprecated"
provider_permissions:
$ref: "#/definitions/provider_permissions"
required:
- name
- title
Expand Down Expand Up @@ -991,6 +1076,17 @@ spec:

# JSON patches for newer versions should be placed on top
versions:
- before: 3.7.0
patch:
# provider_permissions field for provider-specific permission declarations.
- op: remove
path: "/definitions/provider_permissions"
- op: remove
path: "/properties/provider_permissions"
- op: remove
path: "/properties/policy_templates/items/properties/provider_permissions"
- op: remove
path: "/properties/policy_templates/items/properties/inputs/items/properties/provider_permissions"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
- before: 3.6.0
patch:
# Input qualifier (named inputs).
Expand Down
Loading