[CFT] Report the Workload Identity role to Kibana from the WII template

[bhapas]

Summary of your changes

The Workload Identity template (deploy/cloudformation/federated-identity-wii-aws.yml) can now send the role it creates back to Kibana. The user no longer has to copy the Role ARN and the Stack ARN from the stack outputs into Kibana.

Two new optional parameters. Kibana sets them when it launches the stack. Both default to empty, and CloudFormation validates both.

• ElasticCallbackUrl: the complete URL of the Kibana callback this stack reports to. Must be empty or an https URL with a path. Kibana builds it from the route it owns, so a route change stays on the Kibana side.
• ElasticApiKey: a single-use API key with no privileges, used only for this report. Must be empty or base64. Hidden in the console (NoEcho).

When both are set, the stack creates a Lambda function and a custom resource. The function sends a POST with {"role_arn": ..., "stack_arn": ...} to ElasticCallbackUrl, authenticated with the API key. The custom resource runs after the role and all of its policies are created.

When either is empty, the stack does not create these resources and behaves as before.

How the function behaves:

• It always answers SUCCESS to CloudFormation. A failed report never fails or rolls back the stack, and the user can still copy the outputs by hand.
• It reports when the custom resource is created or updated. On delete it answers without calling Kibana.
• It tries Kibana up to four times, waiting 2, 4 and 8 seconds between tries. Each request times out after 10 seconds.
• It does not retry a 4xx answer from Kibana.
• It stops retrying when less than 40 seconds of its 90-second timeout remain, so it always has time to answer CloudFormation. The custom resource times out after 120 seconds.
• It logs callback result <status>, for example connected or failed: http 404. When Kibana could not be reached it logs the reason, for example a certificate the function does not trust. It never logs the event, the request headers or the API key, and an exception that could quote a header is logged by its type alone.
• Its role only has the AWS Lambda basic execution policy, which lets it write logs.

The Lambda code is byte for byte the callback.py that elastic/cloud-iac-provisioner#434 adds to the generated template, so both templates behave the same way. Keep the two identical.

Related Issues

Related: elastic/kibana#297690, elastic/cloud-iac-provisioner#434, https://github.com/elastic/security-team/issues/12714

Checklist

• cfn-lint 1.57.2 passes on the template.
• rain fmt --verify reports one blank line to add between WiiOidcProviderFunctionRole and WiiOidcProviderFunction, which is outside this change and already in main.
• The inline Lambda code is identical to callback.py from elastic/cloud-iac-provisioner#434 and compiles with Python 3.13 (py_compile).
• The 14 unit tests from elastic/cloud-iac-provisioner#434 (test/blueprints/test_callback.py) pass against the code extracted from this template, on Python 3.13 and 3.14.
• The custom resource's DependsOn lists every AWS::IAM::Policy in the template (17).
• The inline code is 3,867 bytes, within the CloudFormation limit for ZipFile.

[mergify]

This pull request does not have a backport label. Could you fix it @bhapas? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[seanrathier]

Added comment for discussion

[seanrathier]

I am commenting here mainly for a discussion.

This is a publicly available, unsigned S3 CFT. Do we want to have this detail of how we do our frictionless onboarding out in the public?

To be clear, I mean this ONLY for the static template; the IACP-generated one is signed so the risk is not there.