{resolvedFooterConfig.showBack && (
diff --git a/ui/components/providers/wizard/provider-wizard-modal.utils.test.ts b/ui/components/providers/wizard/provider-wizard-modal.utils.test.ts
index 6e2b090fc9..5d19ae9d16 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.utils.test.ts
+++ b/ui/components/providers/wizard/provider-wizard-modal.utils.test.ts
@@ -12,8 +12,81 @@ import {
getOrganizationsStepperOffset,
getProviderWizardDocsDestination,
getProviderWizardModalTitle,
+ getProviderWizardStepper,
} from "./provider-wizard-modal.utils";
+describe("getProviderWizardStepper", () => {
+ const labels = (steps: { label: string }[]) => steps.map((s) => s.label);
+
+ it("lists the four generic steps until a provider is picked", () => {
+ const stepper = getProviderWizardStepper({
+ mode: PROVIDER_WIZARD_MODE.ADD,
+ providerType: null,
+ currentStep: PROVIDER_WIZARD_STEP.CONNECT,
+ });
+
+ expect(labels(stepper.steps)).toEqual([
+ "Link a Provider",
+ "Authenticate Credentials",
+ "Validate Connection",
+ "Launch Scan",
+ ]);
+ expect(stepper.stepOffset).toBe(0);
+ });
+
+ it("folds the credentials step into the first one when adding an AWS account", () => {
+ const stepper = getProviderWizardStepper({
+ mode: PROVIDER_WIZARD_MODE.ADD,
+ providerType: "aws",
+ currentStep: PROVIDER_WIZARD_STEP.CONNECT,
+ });
+
+ expect(labels(stepper.steps)).toEqual([
+ "Link a Provider",
+ "Validate Connection",
+ "Launch Scan",
+ ]);
+ expect(stepper.stepOffset).toBe(0);
+ });
+
+ it("keeps the AWS stepper in sync once the wizard skips to the connection test", () => {
+ const stepper = getProviderWizardStepper({
+ mode: PROVIDER_WIZARD_MODE.ADD,
+ providerType: "aws",
+ currentStep: PROVIDER_WIZARD_STEP.TEST,
+ });
+
+ // TEST is index 2 in the wizard but the second row of the AWS stepper.
+ expect(stepper.stepOffset).toBe(-1);
+ });
+
+ it("keeps the first AWS row active if the wizard ever lands on the credentials step", () => {
+ const stepper = getProviderWizardStepper({
+ mode: PROVIDER_WIZARD_MODE.ADD,
+ providerType: "aws",
+ currentStep: PROVIDER_WIZARD_STEP.CREDENTIALS,
+ });
+
+ // CREDENTIALS has no row of its own for AWS: it folds into "Link a Provider".
+ expect(stepper.stepOffset).toBe(-1);
+ });
+
+ it("still shows the credentials step when updating AWS credentials", () => {
+ const stepper = getProviderWizardStepper({
+ mode: PROVIDER_WIZARD_MODE.UPDATE,
+ providerType: "aws",
+ currentStep: PROVIDER_WIZARD_STEP.CREDENTIALS,
+ });
+
+ expect(labels(stepper.steps)).toEqual([
+ "Link a Provider",
+ "Authenticate Credentials",
+ "Validate Connection",
+ ]);
+ expect(stepper.stepOffset).toBe(0);
+ });
+});
+
describe("getOrganizationsStepperOffset", () => {
it("keeps step 1 active during organization details", () => {
const offset = getOrganizationsStepperOffset(
diff --git a/ui/components/providers/wizard/provider-wizard-modal.utils.ts b/ui/components/providers/wizard/provider-wizard-modal.utils.ts
index 1e8f6f9248..a320521c7e 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.utils.ts
+++ b/ui/components/providers/wizard/provider-wizard-modal.utils.ts
@@ -6,8 +6,61 @@ import {
} from "@/types/organizations";
import {
PROVIDER_WIZARD_MODE,
+ PROVIDER_WIZARD_STEP,
ProviderWizardMode,
+ ProviderWizardStep,
} from "@/types/provider-wizard";
+import type { ProviderType } from "@/types/providers";
+
+import {
+ AWS_PROVIDER_WIZARD_STEPS,
+ PROVIDER_WIZARD_STEPS,
+} from "./wizard-stepper";
+
+const UPDATE_MODE_WIZARD_STEPS = PROVIDER_WIZARD_STEPS.slice(
+ 0,
+ PROVIDER_WIZARD_STEP.LAUNCH,
+);
+
+interface ProviderWizardStepperInput {
+ mode: ProviderWizardMode;
+ providerType: ProviderType | null;
+ currentStep: ProviderWizardStep;
+}
+
+/** Rows for the provider-flow stepper plus the offset that maps `currentStep` onto them. */
+export function getProviderWizardStepper({
+ mode,
+ providerType,
+ currentStep,
+}: ProviderWizardStepperInput) {
+ if (mode === PROVIDER_WIZARD_MODE.UPDATE) {
+ return { steps: UPDATE_MODE_WIZARD_STEPS, stepOffset: 0 };
+ }
+ if (providerType === "aws") {
+ // CONNECT stays on the first row; every later step shifts up one, so
+ // CREDENTIALS (no row of its own) folds into the first one too.
+ const stepOffset = currentStep === PROVIDER_WIZARD_STEP.CONNECT ? 0 : -1;
+ return { steps: AWS_PROVIDER_WIZARD_STEPS, stepOffset };
+ }
+ return { steps: PROVIDER_WIZARD_STEPS, stepOffset: 0 };
+}
+
+interface CredentialsRetryStepInput {
+ mode: ProviderWizardMode;
+ providerType: ProviderType | null;
+}
+
+/** Where "Back" from the connection test lands: AWS re-enters its one-step form. */
+export function getCredentialsRetryStep({
+ mode,
+ providerType,
+}: CredentialsRetryStepInput): ProviderWizardStep {
+ if (mode === PROVIDER_WIZARD_MODE.ADD && providerType === "aws") {
+ return PROVIDER_WIZARD_STEP.CONNECT;
+ }
+ return PROVIDER_WIZARD_STEP.CREDENTIALS;
+}
export function getOrganizationsStepperOffset(
currentStep: OrgWizardStep,
diff --git a/ui/components/providers/wizard/steps/aws/aws-connect-step.test.tsx b/ui/components/providers/wizard/steps/aws/aws-connect-step.test.tsx
new file mode 100644
index 0000000000..47475b471e
--- /dev/null
+++ b/ui/components/providers/wizard/steps/aws/aws-connect-step.test.tsx
@@ -0,0 +1,472 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useState } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ PROVIDER_FUNNEL_EVENT,
+ type ProviderFunnelDetail,
+} from "@/lib/provider-funnel/provider-funnel-events";
+import { useProviderWizardStore } from "@/store/provider-wizard/store";
+
+import { AwsConnectStep } from "./aws-connect-step";
+import type { AwsConnectUiState } from "./types";
+
+const { addProvider, addCredentialsProvider, openCloudUpgradeMock } =
+ vi.hoisted(() => ({
+ addProvider: vi.fn(),
+ addCredentialsProvider: vi.fn(),
+ openCloudUpgradeMock: vi.fn(),
+ }));
+
+vi.mock("next-auth/react", () => ({
+ useSession: () => ({
+ data: { tenantId: "tenant-abc" },
+ status: "authenticated",
+ }),
+}));
+vi.mock("@/actions/providers/providers", () => ({
+ addProvider,
+ addCredentialsProvider,
+}));
+vi.mock("@/store", () => ({
+ useCloudUpgradeStore: (
+ selector: (state: {
+ openCloudUpgrade: typeof openCloudUpgradeMock;
+ }) => unknown,
+ ) => selector({ openCloudUpgrade: openCloudUpgradeMock }),
+}));
+
+const FORM_ID = "aws-connect-test-form";
+const ROLE_ARN = "arn:aws:iam::123456789012:role/ProwlerScan";
+
+// Stands in for the wizard footer: the step only publishes its UI state.
+function Harness({
+ onConnected,
+ onSelectOrganizations,
+}: {
+ onConnected: () => void;
+ onSelectOrganizations: () => void;
+}) {
+ const [uiState, setUiState] = useState
(null);
+ return (
+ <>
+
+
+
+ );
+}
+
+function renderStep() {
+ const onConnected = vi.fn();
+ const onSelectOrganizations = vi.fn();
+ render(
+ ,
+ );
+ return { onConnected, onSelectOrganizations, user: userEvent.setup() };
+}
+
+const connectButton = () =>
+ screen.getByRole("button", { name: "Connect account" });
+
+describe("AwsConnectStep", () => {
+ const funnelSignals: ProviderFunnelDetail[] = [];
+ const recordFunnelSignal: EventListener = (event) => {
+ funnelSignals.push((event as CustomEvent).detail);
+ };
+
+ beforeEach(() => {
+ funnelSignals.length = 0;
+ window.addEventListener(PROVIDER_FUNNEL_EVENT, recordFunnelSignal);
+ vi.clearAllMocks();
+ sessionStorage.clear();
+ useProviderWizardStore.getState().reset();
+ addProvider.mockResolvedValue({ data: { id: "provider-1" } });
+ addCredentialsProvider.mockResolvedValue({ data: { id: "secret-1" } });
+ });
+
+ afterEach(() => {
+ window.removeEventListener(PROVIDER_FUNNEL_EVENT, recordFunnelSignal);
+ vi.unstubAllEnvs();
+ });
+
+ describe("in Prowler Cloud", () => {
+ beforeEach(() => {
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
+ });
+
+ it("creates the role from the shared stack and connects with just its ARN", async () => {
+ // Given
+ const { onConnected, user } = renderStep();
+
+ // Then: the button opens the shared template with the External ID filled in;
+ // the AccountId parameter defaults to Prowler Cloud's account there.
+ const quickCreate = screen.getByRole("link", {
+ name: /Create the IAM role in AWS/i,
+ });
+ expect(quickCreate).toHaveAttribute(
+ "href",
+ expect.stringContaining("prowler-scan-role.yml"),
+ );
+ expect(quickCreate).toHaveAttribute(
+ "href",
+ expect.stringContaining("param_ExternalId=tenant-abc"),
+ );
+ expect(connectButton()).toBeDisabled();
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: /Role ARN/ }),
+ ROLE_ARN,
+ );
+
+ // Then
+ expect(
+ await screen.findByText(/Account 123456789012 will be added/),
+ ).toBeVisible();
+ await waitFor(() => expect(connectButton()).toBeEnabled());
+
+ // When
+ await user.click(connectButton());
+
+ // Then
+ await waitFor(() => expect(onConnected).toHaveBeenCalledOnce());
+ const secret = Object.fromEntries(
+ (addCredentialsProvider.mock.calls[0][0] as FormData).entries(),
+ );
+ expect(secret).toMatchObject({
+ providerId: "provider-1",
+ role_arn: ROLE_ARN,
+ external_id: "tenant-abc",
+ credentials_type: "aws-sdk-default",
+ });
+ expect(funnelSignals).toContainEqual({
+ step: "account_submitted",
+ providerType: "aws",
+ via: "role",
+ outcome: "success",
+ });
+ });
+
+ it("shows an account the API already knows on the ARN field and stays on the step", async () => {
+ // Given
+ addProvider.mockResolvedValueOnce({
+ errors: [
+ {
+ detail: "Provider with this uid already exists.",
+ source: { pointer: "/data/attributes/uid" },
+ },
+ ],
+ });
+ const { onConnected, user } = renderStep();
+ await user.type(
+ screen.getByRole("textbox", { name: /Role ARN/ }),
+ ROLE_ARN,
+ );
+ await waitFor(() => expect(connectButton()).toBeEnabled());
+
+ // When
+ await user.click(connectButton());
+
+ // Then
+ expect(
+ await screen.findByText("Provider with this uid already exists."),
+ ).toBeVisible();
+ expect(onConnected).not.toHaveBeenCalled();
+ expect(funnelSignals).toContainEqual({
+ step: "account_submitted",
+ providerType: "aws",
+ via: "role",
+ outcome: "error",
+ });
+ });
+
+ it("hands the whole-organization choice to the organizations flow", async () => {
+ // Given
+ const { onSelectOrganizations, user } = renderStep();
+
+ // When
+ await user.click(
+ screen.getByRole("tab", { name: /Full AWS Organization/ }),
+ );
+
+ // Then
+ expect(onSelectOrganizations).toHaveBeenCalledOnce();
+ });
+
+ it("connects with access keys and the typed account id", async () => {
+ // Given
+ const { onConnected, user } = renderStep();
+
+ // When
+ await user.click(
+ screen.getByRole("radio", { name: /Static access keys/ }),
+ );
+ await user.type(
+ screen.getByRole("textbox", { name: /Account ID/ }),
+ "210987654321",
+ );
+ await user.type(
+ screen.getByPlaceholderText("Enter the AWS Access Key ID"),
+ "AKIAEXAMPLE",
+ );
+ await user.type(
+ screen.getByPlaceholderText("Enter the AWS Secret Access Key"),
+ "secret-value",
+ );
+ await waitFor(() => expect(connectButton()).toBeEnabled());
+ await user.click(connectButton());
+
+ // Then
+ await waitFor(() => expect(onConnected).toHaveBeenCalledOnce());
+ const provider = Object.fromEntries(
+ (addProvider.mock.calls[0][0] as FormData).entries(),
+ );
+ expect(provider).toEqual({
+ providerType: "aws",
+ providerUid: "210987654321",
+ });
+ });
+ });
+
+ describe("with access keys, when the API refuses the account", () => {
+ beforeEach(() => {
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
+ });
+
+ it("shows the refusal on the Account ID field and stays on the step", async () => {
+ // Given
+ addProvider.mockResolvedValueOnce({
+ errors: [
+ {
+ detail: "Provider with this uid already exists.",
+ source: { pointer: "/data/attributes/uid" },
+ },
+ ],
+ });
+ const { onConnected, user } = renderStep();
+ await user.click(
+ screen.getByRole("radio", { name: /Static access keys/ }),
+ );
+ await user.type(
+ screen.getByRole("textbox", { name: /Account ID/ }),
+ "210987654321",
+ );
+ await user.type(
+ screen.getByPlaceholderText("Enter the AWS Access Key ID"),
+ "AKIAEXAMPLE",
+ );
+ await user.type(
+ screen.getByPlaceholderText("Enter the AWS Secret Access Key"),
+ "secret-value",
+ );
+ await waitFor(() => expect(connectButton()).toBeEnabled());
+
+ // When
+ await user.click(connectButton());
+
+ // Then
+ expect(
+ await screen.findByText("Provider with this uid already exists."),
+ ).toBeVisible();
+ // The field wrapper carries the invalid state for the Account ID input.
+ expect(
+ screen
+ .getByRole("textbox", { name: /Account ID/ })
+ .closest("[aria-invalid]"),
+ ).toHaveAttribute("aria-invalid", "true");
+ expect(onConnected).not.toHaveBeenCalled();
+ });
+ });
+
+ describe("when the step is left and reopened within the same wizard", () => {
+ beforeEach(() => {
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
+ });
+
+ it("keeps what was typed, including the chosen access method", async () => {
+ // Given
+ const onConnected = vi.fn();
+ const onSelectOrganizations = vi.fn();
+ const user = userEvent.setup();
+ const { unmount } = render(
+ ,
+ );
+ await user.click(
+ screen.getByRole("radio", { name: /Static access keys/ }),
+ );
+ await user.type(
+ screen.getByRole("textbox", { name: /Account ID/ }),
+ "210987654321",
+ );
+ await user.type(
+ screen.getByRole("textbox", { name: /Provider alias/ }),
+ "Staging",
+ );
+
+ // When: the organizations tab or the connection test unmounts the step.
+ unmount();
+ render(
+ ,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("radio", { name: /Static access keys/ }),
+ ).toHaveAttribute("aria-checked", "true");
+ expect(screen.getByRole("textbox", { name: /Account ID/ })).toHaveValue(
+ "210987654321",
+ );
+ expect(
+ screen.getByRole("textbox", { name: /Provider alias/ }),
+ ).toHaveValue("Staging");
+ });
+
+ it("starts blank again once the wizard is reset", async () => {
+ // Given
+ const user = userEvent.setup();
+ const { unmount } = render(
+ ,
+ );
+ await user.type(
+ screen.getByRole("textbox", { name: /Role ARN/ }),
+ ROLE_ARN,
+ );
+ unmount();
+
+ // When
+ useProviderWizardStore.getState().reset();
+ render();
+
+ // Then
+ expect(screen.getByRole("textbox", { name: /Role ARN/ })).toHaveValue("");
+ });
+ });
+
+ describe("in Prowler Cloud, role creation", () => {
+ beforeEach(() => {
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
+ });
+
+ it("leads with the one-click stack and keeps the other templates behind a toggle", async () => {
+ // Given
+ const { user } = renderStep();
+
+ // Then
+ expect(
+ screen.queryByRole("link", { name: /CloudFormation Template/i }),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByRole("link", { name: /Terraform Code/i }),
+ ).not.toBeInTheDocument();
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: /Other ways to create the role/i }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("link", { name: /CloudFormation Template/i }),
+ ).toHaveAttribute("href", expect.stringContaining("prowler-scan-role"));
+ expect(
+ screen.getByRole("link", { name: /Terraform Code/i }),
+ ).toBeVisible();
+ });
+
+ it("never asks which credentials assume the role: Prowler Cloud does", async () => {
+ // Given
+ const { user } = renderStep();
+ await user.click(
+ screen.getByRole("button", { name: /Advanced options/i }),
+ );
+
+ // Then
+ expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+ expect(
+ screen.queryByPlaceholderText("Enter the AWS Access Key ID"),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.getByPlaceholderText("Enter the role session name"),
+ ).toBeVisible();
+ });
+ });
+
+ describe("in a self-hosted deployment", () => {
+ beforeEach(() => {
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
+ });
+
+ it("offers the same one-click role setup, on the shared template", async () => {
+ // Given
+ const { user } = renderStep();
+
+ // Then: the template keeps the AccountId parameter self-hosted users must edit.
+ expect(
+ screen.getByRole("link", { name: /Create the IAM role in AWS/i }),
+ ).toHaveAttribute(
+ "href",
+ expect.stringContaining("prowler-scan-role.yml"),
+ );
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: /Advanced options/i }),
+ );
+
+ // Then: keys belong to the "Static access keys" method, never to the role one.
+ expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+ expect(
+ screen.queryByPlaceholderText("Enter the AWS Access Key ID"),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.getByPlaceholderText("Enter the role session name"),
+ ).toBeVisible();
+ });
+
+ it("assumes the role with the credentials of the host running Prowler", async () => {
+ // Given
+ const { onConnected, user } = renderStep();
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: /Role ARN/ }),
+ ROLE_ARN,
+ );
+ await screen.findByText(/Account 123456789012 will be added/);
+ await waitFor(() => expect(connectButton()).toBeEnabled());
+ await user.click(connectButton());
+
+ // Then
+ await waitFor(() => expect(onConnected).toHaveBeenCalledOnce());
+ const secret = Object.fromEntries(
+ (addCredentialsProvider.mock.calls[0][0] as FormData).entries(),
+ );
+ expect(secret).toMatchObject({
+ role_arn: ROLE_ARN,
+ credentials_type: "aws-sdk-default",
+ });
+ expect(secret).not.toHaveProperty("aws_access_key_id");
+ });
+ });
+});
diff --git a/ui/components/providers/wizard/steps/aws/aws-connect-step.tsx b/ui/components/providers/wizard/steps/aws/aws-connect-step.tsx
new file mode 100644
index 0000000000..1b0d1ed47b
--- /dev/null
+++ b/ui/components/providers/wizard/steps/aws/aws-connect-step.tsx
@@ -0,0 +1,432 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { ChevronDownIcon, KeyRound, ShieldCheck } from "lucide-react";
+import { useSession } from "next-auth/react";
+import { useEffect, useState } from "react";
+import {
+ Control,
+ FieldValues,
+ Resolver,
+ UseFormReturn,
+ useForm,
+ useFormState,
+ useWatch,
+} from "react-hook-form";
+
+import { RadioCard } from "@/components/providers/radio-card";
+import { CredentialsRoleHelper } from "@/components/providers/workflow/credentials-role-helper";
+import { WizardInputField } from "@/components/providers/workflow/forms/fields";
+import { AwsRoleOptionalFields } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-optional-fields";
+import { AWSStaticCredentialsForm } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-static-credentials-form";
+import { ProviderTitleDocs } from "@/components/providers/workflow/provider-title-docs";
+import { Badge } from "@/components/shadcn/badge/badge";
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Collapsible,
+ CollapsibleContent,
+ CollapsibleTrigger,
+} from "@/components/shadcn/collapsible";
+import { Form } from "@/components/shadcn/form";
+import { useFormServerErrors } from "@/hooks/use-form-server-errors";
+import { PROVIDER_CREDENTIALS_ERROR_MAPPING } from "@/lib/error-mappings";
+import { getAWSCredentialsTemplateLinks } from "@/lib/external-urls";
+import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
+import {
+ ACCOUNT_SUBMIT_OUTCOME,
+ dispatchProviderFunnel,
+ PROVIDER_FUNNEL_STEP,
+} from "@/lib/provider-funnel/provider-funnel-events";
+import { useProviderWizardStore } from "@/store/provider-wizard/store";
+import type { AWSCredentials, AWSCredentialsRole } from "@/types";
+import type { AwsConnectDraft } from "@/types/provider-wizard";
+
+import {
+ awsKeysConnectSchema,
+ type AwsKeysConnectValues,
+ awsRoleConnectSchema,
+ type AwsRoleConnectValues,
+} from "./aws-connect.schema";
+import {
+ AWS_ONBOARDING_METHOD,
+ AwsOnboardingMethodTabs,
+} from "./aws-onboarding-method-tabs";
+import { parseAwsAccountIdFromRoleArn } from "./aws-role-arn";
+import {
+ AWS_UID_ERROR_POINTER,
+ connectAwsAccount,
+} from "./connect-aws-account";
+import {
+ AWS_ACCESS_METHOD,
+ type AwsAccessMethod,
+ type AwsConnectUiState,
+} from "./types";
+
+const ALIAS_ERROR_POINTER = "/data/attributes/alias";
+const UNIQUE_TOGETHER_ERROR_POINTER = "/data/attributes/__all__";
+
+// What the user typed survives the step unmounting (organizations tab, a step
+// back from the connection test) until the wizard closes.
+const readDraft = () => useProviderWizardStore.getState().awsConnectDraft;
+
+const initialMethod = (): AwsAccessMethod =>
+ readDraft()?.method === AWS_ACCESS_METHOD.CREDENTIALS
+ ? AWS_ACCESS_METHOD.CREDENTIALS
+ : AWS_ACCESS_METHOD.ROLE;
+
+function useDraftValues(
+ form: UseFormReturn,
+ key: keyof Pick,
+) {
+ const values = useWatch({ control: form.control });
+ useEffect(() => {
+ useProviderWizardStore
+ .getState()
+ .setAwsConnectDraft({ [key]: values as AwsConnectDraft[typeof key] });
+ }, [key, values]);
+}
+
+interface AwsConnectStepProps {
+ formId: string;
+ onConnected: () => void;
+ onSelectOrganizations: () => void;
+ onUiStateChange: (state: AwsConnectUiState) => void;
+}
+
+/** One form to register an AWS account and store its credentials. */
+export function AwsConnectStep({
+ formId,
+ onConnected,
+ onSelectOrganizations,
+ onUiStateChange,
+}: AwsConnectStepProps) {
+ // Local state needed: the access method only matters until the account is connected.
+ const [method, setMethod] = useState(initialMethod);
+ // Local state needed: the active form reports it so the method cannot change mid-submit.
+ const [isBusy, setIsBusy] = useState(false);
+
+ const isRole = method === AWS_ACCESS_METHOD.ROLE;
+
+ const chooseMethod = (next: AwsAccessMethod) => {
+ setMethod(next);
+ useProviderWizardStore.getState().setAwsConnectDraft({ method: next });
+ };
+
+ return (
+
+
+
+
+
+
+
+ Choose how Prowler should access your account.
+
+
chooseMethod(AWS_ACCESS_METHOD.ROLE)}
+ >
+
+ Recommended
+
+
+
chooseMethod(AWS_ACCESS_METHOD.CREDENTIALS)}
+ />
+
+
+ {isRole ? (
+
+ ) : (
+
+ )}
+
-
-
- A read-only IAM role must be manually created
- {isAmazonS3 ? " or updated" : ""}
-
+
+
+
);
};
diff --git a/ui/components/providers/workflow/forms/connect-account-form.tsx b/ui/components/providers/workflow/forms/connect-account-form.tsx
index ea83267cc0..f0199a0c80 100644
--- a/ui/components/providers/workflow/forms/connect-account-form.tsx
+++ b/ui/components/providers/workflow/forms/connect-account-form.tsx
@@ -9,7 +9,6 @@ import { useForm, UseFormReturn } from "react-hook-form";
import { addProvider, updateProvider } from "@/actions/providers/providers";
import { addRegistryProvider } from "@/actions/providers/registry-provider";
import { getInstalledRegistryProviderOptions } from "@/actions/registry/registry";
-import { AwsMethodSelector } from "@/components/providers/organizations/aws-method-selector";
import { AzureMethodSelector } from "@/components/providers/organizations/azure-method-selector";
import { GcpMethodSelector } from "@/components/providers/organizations/gcp-method-selector";
import { WizardInputField } from "@/components/providers/workflow/forms/fields";
@@ -50,12 +49,13 @@ export interface ConnectAccountSuccessData {
/**
* Provider types that offer an organization-onboarding method choice: exactly the
- * ones with an onboarding flow, so a new flow type cannot miss the fork.
+ * ones with an onboarding flow, so a new flow type cannot miss the fork. AWS is the
+ * exception: the wizard's own AWS step hosts its single-account/organization switch.
*/
function providerHasOrgMethod(
providerType: ProviderType | undefined,
): providerType is OrgFlowType {
- return toOrgFlowType(providerType) !== undefined;
+ return providerType !== "aws" && toOrgFlowType(providerType) !== undefined;
}
interface ConnectAccountFormProps {
@@ -507,18 +507,6 @@ export const ConnectAccountForm = ({
/>
{type === "providers" ? (
@@ -210,31 +136,7 @@ export const AWSRoleCredentialsForm = ({
isRequired
/>
-
)}
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-source.tsx b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-source.tsx
new file mode 100644
index 0000000000..491f24df81
--- /dev/null
+++ b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-source.tsx
@@ -0,0 +1,105 @@
+import { Control, UseFormSetValue } from "react-hook-form";
+
+import { WizardInputField } from "@/components/providers/workflow/forms/fields";
+import { Badge } from "@/components/shadcn/badge/badge";
+import {
+ Select,
+ SelectContent,
+ SelectItem,
+ SelectTrigger,
+ SelectValue,
+} from "@/components/shadcn/select/select";
+import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
+import { AWSCredentialsRole } from "@/types";
+
+interface AwsRoleCredentialsSourceProps {
+ control: Control