fix: enforce policy-based access control on artifact downloads by ycombinator · Pull Request #7009 · elastic/fleet-server

ycombinator · 2026-05-11T22:44:28Z

What is the problem this PR solves?

The artifact download endpoint (/api/fleet/artifacts/{id}/{sha256}) only validates the agent's API key but never checks whether the requested artifact belongs to the agent's assigned policy. This means an agent enrolled under one policy can download artifacts belonging to a different policy if it knows the artifact ID and SHA256 hash. For example, an agent enrolled under a policy with no integrations can retrieve Elastic Defend trust lists, exception lists, and other security artifacts from another policy.

How does this PR solve the problem?

Implements the authorizeArtifact() function (previously a no-op that returned nil) to enforce policy-based access control:

Adds a GetPolicy(ctx, policyID) method to the policy.Monitor interface that returns the cached policy for a given ID (reloads from ES on cache miss).
In authorizeArtifact, fetches the agent's policy via the monitor using agent.AgentPolicyID and verifies that the requested artifact (identifier + decoded_sha256) appears in the policy's inputs[].artifact_manifest.artifacts.
Returns 403 Forbidden (ErrUnauthorizedArtifact) if the artifact is not listed in the agent's assigned policy.

How to test this PR locally

Set up Fleet Server with Elasticsearch and Kibana
Create two agent policies: Victim-Policy with Elastic Defend integration (add a trusted application), and Attacker-Policy with no integrations
Create an enrollment token for Attacker-Policy and enroll an agent
Attempt to download an artifact belonging to Victim-Policy using the attacker agent's API key — should now receive 403 Forbidden instead of the artifact contents
Verify that an agent enrolled under Victim-Policy can still download its own artifacts normally (200 OK)

Design Checklist

I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

I have added tests that prove my fix is effective or that my feature works
I have added an entry in ./changelog/fragments using the changelog tool

The artifact download endpoint (/api/fleet/artifacts/{id}/{sha256}) previously only validated the agent's API key but never checked whether the requested artifact belonged to the agent's assigned policy. This allowed an agent enrolled under one policy to download artifacts from a different policy if it knew the artifact ID and SHA256 hash. Add authorizeArtifact implementation that fetches the agent's policy from the in-memory policy monitor cache and verifies the requested artifact appears in the policy's artifact_manifest before serving it. Returns 403 Forbidden if the artifact is not in the agent's policy. Resolves: elastic/security#8396 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

mergify · 2026-05-11T22:45:21Z

This pull request does not have a backport label. Could you fix it @ycombinator? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

michel-laterman · 2026-05-12T10:08:13Z

+		if !ok {
+			continue
+		}
+		amMap, ok := am.(map[string]interface{})


go's newer conventions prefers any over interface{}
this is being enforced by the go fix check that can be ran with mage check:fix

Updated in b00c5df.

michel-laterman · 2026-05-12T10:17:05Z

+
+func policyHasArtifact(pd *model.PolicyData, id, sha2 string) bool {
+	for _, input := range pd.Inputs {
+		am, ok := input["artifact_manifest"]


Should we define this artifact_manifest as a struct somewhere?

Added model.ArtifactManifest and model.ManifestEntry structs in 3e57a6e.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Defines model.ArtifactManifest and model.ManifestEntry structs so policyHasArtifact no longer navigates untyped map[string]any chains. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-05-12T13:18:17Z

TL;DR

check-ci is failing because internal/pkg/api/handleArtifacts.go now references model.ArtifactManifest, but that type was added in a generated file (internal/pkg/model/schema.go) and gets removed during CI generation. Move the type to a non-generated model file (or add it to schema source + regenerate) so go fix can compile.

Remediation

Define ArtifactManifest/ManifestEntry in a non-generated file such as internal/pkg/model/ext.go or add equivalent definitions in model/schema.json and run mage generate so generated code consistently contains the type.
Re-run mage check:ci (or at least mage generate && go fix ./...) to confirm internal/pkg/api compiles under all tags.

Investigation details

Root Cause

handleArtifacts.go now uses model.ArtifactManifest in parseArtifactManifest:

internal/pkg/api/handleArtifacts.go:192
internal/pkg/api/handleArtifacts.go:201

But the type was introduced in internal/pkg/model/schema.go (:313), which is generated (Code generated by schema-generate. DO NOT EDIT. at :5). CI runs generation before fix:

magefile.go:640-643 (check:ci runs Generate first)
magefile.go:467-470 (Generate executes go generate ./...)

Because model/schema.json does not define this model, generation drops the manual type addition, and subsequent go fix fails with undefined symbols.

Evidence

Build: https://buildkite.com/elastic/fleet-server/builds/14623
Job/step: Run check-ci (.buildkite/scripts/check_ci.sh)
Key log excerpt:

internal/pkg/api/handleArtifacts.go:192:58: undefined: model.ArtifactManifest
internal/pkg/api/handleArtifacts.go:201:21: undefined: model.ArtifactManifest
Error: running "go fix ./..." failed with exit code 1

Verification

Local reproduction of full CI flow was not completed due environment/toolchain download latency in this run; findings are based on direct Buildkite log evidence plus source/CI target inspection.

Follow-up

If you choose the schema-driven route, keep schema.go generated-only and avoid manual edits to generated files going forward.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

fix: enforce policy-based access control on artifact downloads #7009 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#7009 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

schema.go is code-generated and gets overwritten by mage generate. Moving ArtifactManifest and ManifestEntry to ext.go keeps them stable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ArtifactManifest and ManifestEntry are not ES document types and only exist to support parsing within handleArtifacts.go, so they belong there rather than in the model package. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

michel-laterman

lgtm

Agents enrolled under dummy-policy cannot download Elastic Defend artifacts because that policy has no artifact_manifest. Enroll the test agent under security-policy (which has the Elastic Defend integration) instead. Add FleetPolicyHasArtifact scaffold helper that polls .fleet-policies until the policy document references the artifact, ensuring fleet-server's policy monitor cache is up-to-date before the download attempt. Also retry the download on 403 to tolerate any remaining cache propagation lag. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ycombinator requested a review from a team as a code owner May 11, 2026 22:44

ycombinator requested review from macdewee and samuelvl May 11, 2026 22:44

ycombinator requested review from michel-laterman and samuelvl and removed request for macdewee and samuelvl May 11, 2026 22:52

ycombinator added bug Something isn't working Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team backport-active-all Automated backport with mergify to all the active branches labels May 11, 2026

ycombinator and others added 2 commits May 11, 2026 15:57

chore: add changelog fragment for artifact access control fix

15d59f8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs: document race condition tradeoffs in authorizeArtifact

d28f97a

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ycombinator requested review from cmacknz and kruskall May 11, 2026 23:09

michel-laterman reviewed May 12, 2026

View reviewed changes

ycombinator and others added 2 commits May 12, 2026 05:49

fix: use any instead of interface{} per Go conventions

b00c5df

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

refactor: add typed ArtifactManifest struct for policy input parsing

3e57a6e

Defines model.ArtifactManifest and model.ManifestEntry structs so policyHasArtifact no longer navigates untyped map[string]any chains. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ycombinator requested a review from michel-laterman May 12, 2026 12:58

ycombinator enabled auto-merge (squash) May 12, 2026 19:50

ycombinator and others added 2 commits May 12, 2026 16:17

fix: move ArtifactManifest types to non-generated model file

4568322

schema.go is code-generated and gets overwritten by mage generate. Moving ArtifactManifest and ManifestEntry to ext.go keeps them stable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

michel-laterman previously approved these changes May 13, 2026

View reviewed changes

ycombinator dismissed michel-laterman’s stale review via da781d5 May 14, 2026 01:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: enforce policy-based access control on artifact downloads#7009

fix: enforce policy-based access control on artifact downloads#7009
ycombinator wants to merge 8 commits into
elastic:mainfrom
ycombinator:fix/artifact-access-control

ycombinator commented May 11, 2026 •

edited

Loading

Uh oh!

mergify Bot commented May 11, 2026

Uh oh!

michel-laterman May 12, 2026 •

edited

Loading

Uh oh!

ycombinator May 12, 2026

Uh oh!

michel-laterman May 12, 2026

Uh oh!

ycombinator May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Root Cause

Evidence

Verification

Follow-up

Uh oh!

michel-laterman left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ycombinator commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is the problem this PR solves?

How does this PR solve the problem?

How to test this PR locally

Design Checklist

Checklist

Uh oh!

mergify Bot commented May 11, 2026

Uh oh!

michel-laterman May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ycombinator May 12, 2026

Choose a reason for hiding this comment

Uh oh!

michel-laterman May 12, 2026

Choose a reason for hiding this comment

Uh oh!

ycombinator May 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 12, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

michel-laterman left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ycombinator commented May 11, 2026 •

edited

Loading

michel-laterman May 12, 2026 •

edited

Loading