Authenticate Elastic Managed integrations using a federated identity

Federated identity authentication for Elastic Managed integrations reduces the administrative burden of authenticating to third-party cloud service providers by eliminating the need to keep track of credentials such as API keys or passwords. Federated identities provide a reusable, secure-by-default means of authentication, helping you to manage deployments with many integrations collecting data from multiple cloud providers.

Note

In Elastic Stack versions 9.2 and 9.3, federated identities are called cloud connectors, and appear in the Kibana UI as Cloud Connectors.

Integrations that support federated identity authentication

Federated identity authentication currently supports deployments of Elastic's Cloud Security Posture Management (CSPM) and Asset Discovery integrations to AWS and Azure. For deployment instructions, refer to:

Asset Discovery: Asset Discovery on Azure; Asset Discovery on AWS
CSPM: CSPM on Azure; CSPM on AWS

Important

In this version, to use cloud connector authentication for an AWS integration, your Kibana instance must be hosted on AWS. In other words, you must choose AWS hosting during Kibana setup. This is no longer required in later versions.

Federated identity names

Federated identity names help you keep track of each identity's purpose and reuse it appropriately. For example, you could name two AWS identities aws-prod and aws-testing.

When you create a new federated identity you must name it:

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Enter the name in the Federated Identity Name field. When you're deploying an integration, select the Existing Identity tab to reuse an existing identity by name.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview in 9.3 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Enter the name in the Cloud Connector Name field. When you're deploying an integration, if you select Existing Connection, a dropdown menu with the names of existing cloud connectors appears.

To rename a federated identity, go to the tab that lists existing identities and click the Edit button next to the identity's name, then enter a new name.

Because names were introduced with Elastic Stack version 9.3, federated identities created in earlier versions are named automatically:

AWS federated identities use their role ARN as the name.
Azure federated identities use their cloud connector ID as the name.