Authenticate Elastic Managed integrations using a federated identity
Federated identity authentication for Elastic Managed integrations reduces the administrative burden of authenticating to third-party cloud service providers by eliminating the need to keep track of credentials such as API keys or passwords. Federated identities provide a reusable, secure-by-default means of authentication, helping you to manage deployments with many integrations collecting data from multiple cloud providers.
In Elastic Stack versions 9.2 and 9.3, federated identities are called cloud connectors, and appear in the Kibana UI as Cloud Connectors.
Federated identity authentication currently supports deployments of Elastic's Cloud Security Posture Management (CSPM) and Asset Discovery integrations to AWS and Azure. For deployment instructions, refer to:
- Asset Discovery: Asset Discovery on Azure; Asset Discovery on AWS
- CSPM: CSPM on Azure; CSPM on AWS
In this version, to use cloud connector authentication for an AWS integration, your Kibana instance must be hosted on AWS. In other words, you must choose AWS hosting during Kibana setup. This is no longer required in later versions.
Federated identity names help you keep track of each identity's purpose and reuse it appropriately. For example, you could name two AWS identities aws-prod and aws-testing.
When you create a new federated identity you must name it:
-
Enter the name in the Federated Identity Name field. When you're deploying an integration, select the Existing Identity tab to reuse an existing identity by name. -
Enter the name in the Cloud Connector Name field. When you're deploying an integration, if you select Existing Connection, a dropdown menu with the names of existing cloud connectors appears.
To rename a federated identity, go to the tab that lists existing identities and click the Edit button next to the identity's name, then enter a new name.
Because names were introduced with Elastic Stack version 9.3, federated identities created in earlier versions are named automatically:
- AWS federated identities use their role ARN as the name.
- Azure federated identities use their cloud connector ID as the name.