Create organization variant of federated-identity-aws CFT and update CSPM/CAI manifest URLs

[seanrathier]

Context

deploy/cloudformation/federated-identity-aws.yml is the new combined Federated Identity CFT covering the aws package integrations, CSPM (cloud_security_posture), and Cloud Asset Inventory (cloud_asset_inventory) under a single role. It replaces:

• deploy/cloudformation/cloud-connectors-remote-role.yml (CSPM single-account)
• deploy/asset-inventory-cloudformation/cloud-connectors-remote-role.yml (CAI single-account)

However, both CSPM and CAI also have organization-account variants that include StackSet machinery for deploying cloudbeat-securityaudit roles to member accounts across an AWS Organization. No organization variant of federated-identity-aws.yml exists yet, so the org-account manifest URLs cannot be updated until one is created.

Definition of done

cloudbeat

• Create deploy/cloudformation/federated-identity-aws-organization.yml:
  • Same ElasticFederatedIdentityRole as the single-account template (GuardDuty, SecurityAudit, and all per-integration inline policies)
  • Add OrganizationalUnitIds and ScanManagementAccount parameters
  • Add ScanManagementAccountEnabled condition
  • Add CloudbeatRootRole, CloudbeatRoleStackSet, and CloudbeatManagementAccountAuditRole resources — mirroring the structure of deploy/cloudformation/cloud-connectors-remote-role-organization.yml
• Add a publish_cft.sh entry for the new org template (prefix: cloudformation-federated-identity-aws-organization)

integrations — cloud_security_posture/manifest.yml

• Update cloud_formation_cloud_connectors_template default URL (single-account) to cloudformation-federated-identity-aws-9.x.0.yml
• Update the org-account variant URL to cloudformation-federated-identity-aws-organization-9.x.0.yml
• Remove the # ACCOUNT_TYPE value should be either... comments from both entries

integrations — cloud_asset_inventory/manifest.yml

• Same URL changes as above for cloud_formation_cloud_connectors_template (both single-account and org-account)

Related

• Combined single-account CFT: [Cloud Security Integrations] Add all remaining aws package permissions to the Federated Identity CFT #7637
• CSPM org variant reference: deploy/cloudformation/cloud-connectors-remote-role-organization.yml
• CAI org variant reference: deploy/asset-inventory-cloudformation/cloud-connectors-remote-role-organization.yml