[Cloud-Security] Adding var-groups to support authentication vars - related to cloud connector feature

[seanrathier]

Summary

Adds var_groups configuration to the AWS integration package to enable a credential type selector in Fleet UI, improving the user experience when configuring AWS authentication methods.

Related PRs

• related [Cloud Security] [Fleet] Add var_group components and validation kibana#249449
• depends on Adding var_groups spec package-spec#1059

Changes

• Added var_groups section to package manifest with credential_type group containing:

  • Direct Access Keys (access_key_id, secret_access_key)
  • Temporary Access Keys (access_key_id, secret_access_key, session_token)
  • Cloud Connector (role_arn, external_id) - for agentless deployments
  • Assume Role (role_arn)
  • Assume Role with External ID (role_arn, external_id)
  • Shared Credentials (shared_credential_file, credential_profile_name)

• Added hide_in_var_group_options to GuardDuty aws-s3 input to hide Cloud Connector option (not supported for S3 input)

• Updated credential variables (role_arn, external_id, shared_credential_file, credential_profile_name) to show_user: true so that users can see the vars in var group options

Screenshots

Screen.Recording.2026-01-23.at.10.06.07.AM.mov

Related Issues

• closes https://github.com/elastic/security-team/issues/15398
• related [Cloud Security] [Fleet] Add var_group components and validation kibana#249449
• depends on Adding var_groups spec package-spec#1059
• depends Adding var_groups spec package-spec#1059

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: ccc4eb5

Failed CI Steps

• Check integrations aws

History

• 💔 Build #36842 failed dc1f3ed
• 💔 Build #36536 failed 38a8b03

cc @seanrathier