Install the Elastic Slack app with a UIAM service account by vigneshshanmugam · Pull Request #292776 · elastic/kibana

vigneshshanmugam · 2026-09-22T17:08:55Z

Summary

When xpack.actions.relay.uiam.enabled is on, Slack connect creates UIAM service account, adds Relay (relay-service) to assumable_by in the security plugin, and sends only uiam_service_account_id to RelayClient.startInstall.
Previously, install always sent kibana_api_key. That path is unchanged when the flag is off.
Previously created service account are deleted when disconnecting relay or on install error
The HTTP create route still accepts { name } only. Callers cannot pass assumable_by or trustedPlatformAssumers.

Live install still depends on Relay storing that id (elastic/relay-service#325) and on Agent Builder accepting the exchanged token. UIAM still snapshots the creating user's application privileges and cannot re-bound them (#284463).

@legrego On the security side, we had to made change to allow to pass additionnal assumable_by , and add a revoke method, let me know if it's seems acceptable and any change we could make there.

@vigneshshanmugam I also refactored this a lot to avoid too much duplicate code between the API key/service account path.

Identify risks

The flag is default off and Serverless-only. ECH install stays on the API key.

Test plan

node scripts/jest for the Slack app service, Relay client, UIAM and Elasticsearch service accounts, and the core service-account contract
Live Serverless install once Relay stores uiam_service_account_id

Release notes

release_note:skip

The behavior is behind xpack.actions.relay.uiam.enabled, which defaults to off.

Made with Cursor

Serverless installs behind xpack.actions.relay.uiam.enabled send a service-account id instead of an API key, and reuse of that id stays behind manage_security. Co-authored-by: Cursor <cursoragent@cursor.com>

infra-vault-gh-plugin-prod · 2026-09-22T17:09:15Z

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

Click to trigger kibana-pull-request for this PR!
Click to trigger kibana-deploy-project-from-pr for this PR!
Click to trigger kibana-deploy-cloud-from-pr for this PR!
Click to trigger kibana-entity-store-performance-from-pr for this PR!
Click to trigger kibana-storybooks-from-pr for this PR!

…vigneshshanmugam/kibana into feat/relay-uiam-service-account-install

kibanamachine · 2026-09-25T15:05:07Z

API Contract Breaking Changes

The following breaking change(s) were detected across the public OpenAPI surface, grouped by stability tier. Stable and Technical Preview changes fail the check and should be resolved; Experimental changes are informational.

Experimental — informational, not blocking merge (2)

Experimental APIs are allowed to introduce breaking changes. These are listed for visibility only and do not fail this check.

Endpoint	Reason	oasdiffId	Source
`/api/streams/{name}/content/export` `POST`	added '#/components/schemas/Kibana_HTTP_APIs__zod_v4_53___schema0' to the 'include/anyOf[subschema #2]/objects/routing/items/' request property 'allOf' list	`request-property-all-of-added`	`/opt/buildkite-agent/builds/bk-agent-prod-gcp-1790348516373054107/elastic/kibana-pull-request/kibana/oas_docs/output/kibana.yaml`
`/api/streams/{name}/content/export` `POST`	added '#/components/schemas/Kibana_HTTP_APIs__zod_v4_53___schema0' to the 'include/anyOf[subschema #2]/objects/routing/items/' request property 'allOf' list	`request-property-all-of-added`	`/opt/buildkite-agent/builds/bk-agent-prod-gcp-1790348516373054107/elastic/kibana-pull-request/kibana/oas_docs/output/kibana.serverless.yaml`

What to do

Fix the breaking change if it was unintentional.
If intentional, add an approved entry to packages/kbn-api-contracts/allowlist.json and coordinate with the owning team. Use the oasdiffId and source values from the table above to scope the allowlist entry to this specific change.

See the @kbn/api-contracts README for tier definitions and the allowlist workflow.

…-service-account-install

kibanamachine · 2026-09-29T15:13:11Z

PR size reminder

This PR has 1234 added lines of reviewable code, which is above the 500-line guideline for Nightshift PRs.

Large PRs get significantly less review engagement and take longer to merge. Consider splitting this into smaller, focused PRs before requesting review.

infra-vault-gh-plugin-prod · 2026-09-29T15:15:55Z

+    await this.writeConnection(soClient, {
+      ...connection,
+      status: RELAY_APP_CONNECTION_STATUS.notConnected,
+      apiKeyId: null,
+      tenantKey: null,


Severity: low

Disconnect now retains all attributes via ...connection, including an old error. After a failed unbind is retried successfully (or an errored install is disconnected), getStatus still includes that error alongside not_connected, so users see a stale failure even though disconnect succeeded. Clear the error when writing the retained document.

getStatus returns ...(connection.error ? { error: connection.error } : {}) regardless of status.

_{Generated by Libra. React with 👍 or 👎 to give feedback on this comment.}

…-service-account-install # Conflicts: # x-pack/platform/plugins/shared/security/server/service_accounts/es_service_accounts.test.ts # x-pack/platform/plugins/shared/security/server/service_accounts/es_service_accounts.ts # x-pack/platform/plugins/shared/security/server/service_accounts/uiam_service_accounts.ts

Co-authored-by: Cursor <cursoragent@cursor.com>

nchaulet · 2026-10-01T15:47:33Z


+const RELAY_SERVICE_ACCOUNT_NAME_PREFIX = 'nightshift-relay-agent-builder';
+
+const RELAY_SERVICE_ACCOUNT_ROLES = ['viewer'];


The uiam service account create method now require roles, that is better than using user roles, but this open the question of what role we want to user for that service account? we probably a new built in role? I would address that as a follow up

@vigneshshanmugam curious to have your thoughts on that, I think we should have a dedicated built in role for relay

I agree, viewer is too broad. Can we explore creating a dedicated role for Relay's use case? This will allow you to dynamically update the required privileges over time as well, as your requirements change.

@legrego do you have any thoughs on how we could create that role? should we just create a custom role in Kibana at runtime (it do not seems the more robust) Or should we go the way of adding a built-in role? also it seems there is not really a system role concept

…-service-account-install Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

legrego · 2026-10-06T18:07:14Z

      ...connection,
      status: RELAY_APP_CONNECTION_STATUS.error,
      apiKeyId: null,
+      serviceAccountId: null,


If the revoke step fails (errors are swallowed), then we will erase the service account id from Kibana's memory here. Won't we end up with an orphaned service account at that point?

Yes we have the same behaviour for api keys, user should still be able to manually revoke the old service account, but it avoid a out of sync state with a service account id stored in a saved object that we cannot revoke anymore, the error is logged

legrego · 2026-10-06T18:08:56Z


+const RELAY_SERVICE_ACCOUNT_NAME_PREFIX = 'nightshift-relay-agent-builder';
+
+const RELAY_SERVICE_ACCOUNT_ROLES = ['viewer'];


I agree, viewer is too broad. Can we explore creating a dedicated role for Relay's use case? This will allow you to dynamically update the required privileges over time as well, as your requirements change.

…s/assumable_by.ts Co-authored-by: Larry Gregory <lgregorydev@gmail.com>

…vigneshshanmugam/kibana into feat/relay-uiam-service-account-install

infra-vault-gh-plugin-prod · 2026-10-07T14:00:24Z

+      delete: async (request, id, params) =>
+        requireServiceAccounts().management.delete(request, id, params),


Severity: P2 (Medium)

Reject a non-forced delete when bound workloads remain; the delegate currently resolves successfully while leaving the account active.

_{Generated by Libra. React with 👍 or 👎 to give feedback on this comment.}

infra-vault-gh-plugin-prod · 2026-10-07T14:00:25Z

+      const license = await this.server.licensing.getLicense();
+      const agentId = await credential.resolveAgentId();


Severity: P3 (Low)

Add a regression test for license lookup failure after credential creation to verify cleanup runs and Relay is not called.

_{Generated by Libra. React with 👍 or 👎 to give feedback on this comment.}

kibanamachine · 2026-10-07T14:21:03Z

💔 Build Failed

Buildkite Build
Commit: 68c399a
Build duration: 25 mins

Failed CI Steps

Metrics [docs]

Unknown metric groups

workflow yaml validation

id	before	after	diff
`infosec_demo.yaml (150 steps, 270 vars)/e2e/total`	118	120	+2
`infosec_demo.yaml (150 steps, 270 vars)/e2e/validateIfConditions`	4	5	+1
`infosec_demo.yaml (150 steps, 270 vars)/e2e/validateVariables`	42	43	+1
`infosec_demo.yaml (150 steps, 270 vars)/validateIfConditions`	4	5	+1
total			+5

History

💛 Build #516968 was flaky bbe9d09
💛 Build #514608 was flaky d6775d2
💛 Build #514539 was flaky 1308e44
💛 Build #514355 was flaky 03e580a

[Significant Events] Install Slack Relay with a UIAM service account

cfa5e54

Serverless installs behind xpack.actions.relay.uiam.enabled send a service-account id instead of an API key, and reuse of that id stays behind manage_security. Co-authored-by: Cursor <cursoragent@cursor.com>

nchaulet reviewed Sep 23, 2026

View reviewed changes

Comment thread x-pack/solutions/observability/plugins/significant_events/server/lib/slack_app/service.ts Outdated

nchaulet added the ci:build-serverless-image label Sep 24, 2026

kibanamachine and others added 6 commits September 24, 2026 17:18

Update bundle limits

a52cef6

fix types error

0468841

fix types error

14d350b

Merge branch 'feat/relay-uiam-service-account-install' of github.com:…

4438ab9

…vigneshshanmugam/kibana into feat/relay-uiam-service-account-install

tmp testing

7edc252

Changes from make api-docs

ab1641d

nchaulet added 8 commits September 25, 2026 11:49

Merge branch 'main' of github.com:elastic/kibana into feat/relay-uiam…

06aff12

…-service-account-install

Merge branch 'main' of github.com:elastic/kibana into feat/relay-uiam…

3644c62

…-service-account-install

lint

25a9d4e

fix test

60c5182

Merge branch 'main' of github.com:elastic/kibana into feat/relay-uiam…

19d4ae0

…-service-account-install

fix tests

7732bf1

Merge branch 'main' of github.com:elastic/kibana into feat/relay-uiam…

71c7c80

…-service-account-install

cleanup

565dd2b

nchaulet marked this pull request as ready for review September 29, 2026 15:13

nchaulet requested review from a team as code owners September 29, 2026 15:13

nchaulet requested a review from elena-shostak September 29, 2026 15:13

nchaulet reviewed Sep 29, 2026

View reviewed changes

Comment thread x-pack/solutions/observability/plugins/significant_events/server/lib/slack_app/service.ts Outdated

nchaulet added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Sep 29, 2026

nchaulet requested a review from legrego September 29, 2026 15:14

infra-vault-gh-plugin-prod Bot reviewed Sep 29, 2026

View reviewed changes

nchaulet reviewed Sep 29, 2026

View reviewed changes

Comment thread x-pack/solutions/observability/plugins/significant_events/server/lib/slack_app/service.ts Outdated

legrego removed the request for review from elena-shostak September 29, 2026 19:26

add delete method and remove authorize

7eaae90

infra-vault-gh-plugin-prod Bot reviewed Sep 30, 2026

View reviewed changes

fix typo

57efa27

infra-vault-gh-plugin-prod Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/security/server/service_accounts/uiam_service_accounts.ts Outdated

nchaulet added 2 commits October 1, 2026 08:21

use viewer role

4ee84f5

infra-vault-gh-plugin-prod Bot reviewed Oct 1, 2026

View reviewed changes

nchaulet and others added 3 commits October 1, 2026 10:44

fix agent id

74d2195

fix merge typo

2b07587

Clear stale Slack connection error on successful disconnect.

1308e44

Co-authored-by: Cursor <cursoragent@cursor.com>

infra-vault-gh-plugin-prod Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread x-pack/solutions/observability/plugins/significant_events/server/lib/slack_app/service.ts Outdated

nchaulet reviewed Oct 1, 2026

View reviewed changes

nchaulet and others added 2 commits October 1, 2026 12:26

refacto lot of dupplicate code

d6775d2

Merge branch 'main' of github.com:elastic/kibana into feat/relay-uiam…

bbe9d09

…-service-account-install Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

legrego reviewed Oct 6, 2026

View reviewed changes

nchaulet and others added 3 commits October 7, 2026 09:19

fix after review

7c0f94c

Update x-pack/platform/plugins/shared/security/server/service_account…

74afbf7

…s/assumable_by.ts Co-authored-by: Larry Gregory <lgregorydev@gmail.com>

Merge branch 'feat/relay-uiam-service-account-install' of github.com:…

87ec692

…vigneshshanmugam/kibana into feat/relay-uiam-service-account-install

infra-vault-gh-plugin-prod Bot reviewed Oct 7, 2026

View reviewed changes

Changes from node scripts/check

68c399a


		const RELAY_SERVICE_ACCOUNT_NAME_PREFIX = 'nightshift-relay-agent-builder';

		const RELAY_SERVICE_ACCOUNT_ROLES = ['viewer'];

		delete: async (request, id, params) =>
		requireServiceAccounts().management.delete(request, id, params),

		const license = await this.server.licensing.getLicense();
		const agentId = await credential.resolveAgentId();

Conversation

vigneshshanmugam commented Sep 22, 2026 • edited by nchaulet Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Identify risks

Test plan

Release notes

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kibanamachine commented Sep 25, 2026

API Contract Breaking Changes

Experimental — informational, not blocking merge (2)

What to do

Uh oh!

kibanamachine commented Sep 29, 2026

PR size reminder

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

infra-vault-gh-plugin-prod Bot Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nchaulet Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nchaulet Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

legrego Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

nchaulet Oct 7, 2026 • edited by legrego Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

legrego Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

nchaulet Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

legrego Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Metrics [docs]

workflow yaml validation

History

Uh oh!

vigneshshanmugam commented Sep 22, 2026 •

edited by nchaulet

Loading

infra-vault-gh-plugin-prod Bot commented Sep 22, 2026 •

edited

Loading

nchaulet Oct 1, 2026 •

edited

Loading

nchaulet Oct 7, 2026 •

edited by legrego

Loading

kibanamachine commented Oct 7, 2026 •

edited

Loading