[Crowdstrike] Mask AWS access_key_id policy variable as secret

[moxarth-rathod]

Proposed commit message

  crowdstrike: Mask FDR access_key_id as a secret policy variable.

  Mask the FDR aws-s3 `access_key_id` policy variable as secret by changing
  `type` from `text` to `password` and `secret` from `false` to `true`, so AWS
  access key IDs are masked in Fleet like `secret_access_key` and
  `session_token`.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

• Closes crowdstrike: Mask AWS access_key_id policy variables as secret #20571

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[vera-review-bot]

Severity: 🟡 Medium confidence: high path: packages/crowdstrike/changelog.yml:6

The changelog link for 4.7.0 points to elastic/integrations#​1, an unrelated PR placeholder; update it to this PR (#​20615) so the entry is traceable.

Details

The new 4.7.0 entry links to #1 instead of the PR that introduces the change. elastic-package lint only rejects a non-positive number (pull/0), so this passes validation and would ship a changelog entry pointing at an unrelated 2020-era PR. Every other entry in this file (e.g. 4.6.0 -> pull/20241) links to its own PR.

Recommendation:

Point the link at this PR (20615) so the released changelog is traceable to the change that made access_key_id a secret. Use pull/99999 only as a temporary development placeholder, never a low real PR number.

Suggested change

	link: https://github.com/elastic/integrations/pull/1
	link: https://github.com/elastic/integrations/pull/20615

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

Review summary

Issues found across the latest commits 7de5ec1 — 1 medium

• 🟡 The changelog link for 4.7.0 points to elastic/integrations#​1, an unrelated PR placeholder (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

Changelog link mismatch — expected https://github.com/elastic/integrations/pull/20615 in the following file(s):

• packages/crowdstrike/changelog.yml

Tip

If expected, add the changelog-link-check:skip label to skip this check. Or, if an issue link was intended, use .../issues/<n> instead.

View Buildkite build
@moxarth-rathod

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 7de5ec1

Failed CI Steps

• 📜 Check changelog PR links

History

cc @moxarth-rathod

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport