[aws.cloudtrail] Fix ARN partition grok pattern for aws-cn/aws-iso* (7.0.x backport)

[efd6]

Backport of the fix from #20403 to the 7.0.x line.

The grok processor that extracts the session name from aws.cloudtrail.user_identity.arn used the pattern arn:(aws|aws-us-gov), which silently dropped aws-cn and aws-iso* partition ARNs, leaving user.changes.name unpopulated. This widens the pattern to arn:[a-z0-9-]+.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

✅ Package owners are in sync with main.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 27dac03

Failed CI Steps

• Check integrations aws

History

cc @efd6

[github-actions]

TL;DR

Check integrations aws failed due to a CI dependency break during Terraform service image build, not from the CloudTrail grok change in this PR. The build tries to install google-cloud-sdk=467.0.0-0, but that package/version is no longer available, causing 14 AWS system tests to fail at environment setup.

Remediation

• Update the Terraform test service image dependency to a currently available Google Cloud package/version (e.g., switch from google-cloud-sdk pinning to google-cloud-cli, or pin an existing version) in the shared CI/test image used by AWS Terraform-backed system tests.
• Re-run Buildkite Check integrations aws after the dependency update (a plain retry without dependency change is likely to fail again).

Investigation details

Root Cause

The failing step is blocked in test environment provisioning (Docker Compose/Terraform service bootstrap), not ingest pipeline logic.

From the Buildkite job log (/tmp/gh-aw/agent/buildkite-job-log.txt):

• #7 [terraform 3/7] ... apt-get install google-cloud-sdk=467.0.0-0 -yq (buildkite-job-log.txt:2735)
• Package google-cloud-sdk is not available (buildkite-job-log.txt:2743)
• E: Version '467.0.0-0' for 'google-cloud-sdk' was not found (buildkite-job-log.txt:2749)
• Then system tests fail with setup errors across 14 data streams, e.g. aws/cloudtrail/default, aws/apigateway_logs/default (buildkite-job-log.txt:5565-5607).

PR scope check: changed files are limited to CloudTrail grok/changelog/version bump (packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml, packages/aws/changelog.yml, packages/aws/manifest.yml), which does not explain Terraform image package resolution failures.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/49467
• Job/step: Check integrations aws (test-integrations-aws)
• Key log excerpt:

  #7 [terraform 3/7] ... apt-get install google-cloud-sdk=467.0.0-0 -yq
  #7 4.893 Package google-cloud-sdk is not available, but is referred to by another package.
  #7 4.898 E: Version '467.0.0-0' for 'google-cloud-sdk' was not found
  failed to solve ... exit code: 100
  

Verification

• Not run locally (failure is in CI environment dependency resolution during Docker build).

Follow-up

• If needed, coordinate with CI/test-infra owners to patch the shared Terraform service image and re-trigger this PR build.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

Review summary

Issues found across the latest commits 27dac03 — 1 low

Package-level:

• 🔵 Proposed commit message

  aws: widen CloudTrail ARN partition grok to match aws-cn and aws-iso partitions
  
  Backport of the fix from PR 20403 to the 7.0.x line.
  
  The grok processor that extracts the session name from
  aws.cloudtrail.user_identity.arn matched only the aws and aws-us-gov
  partitions, so ARNs from the aws-cn and aws-iso* partitions did not match
  and user.changes.name was left unpopulated. The pattern is widened to
  accept any partition token so the session name is extracted for every
  partition. Bumps the package to 7.0.1.
  

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.4.1 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.