Clean up credentials for disabled inputs (#241185)

## Summary

For disabled input we don't need to store any credentials

Fixes: 
- #171922

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [x] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

Author: maxcold

x-pack/solutions/security/plugins/cloud_security_posture/common/utils/helpers.test.ts

@@ -337,5 +337,131 @@ describe('test helper methods', () => {
         'gcp.credentials.json': { value: 'unused' },
       });
     });
+
+    it('cleans all aws credential fields from disabled inputs to prevent storing unnecessary secrets', () => {
+      const mockPackagePolicy = createPackagePolicyMock();
+      mockPackagePolicy.inputs = [
+        {
+          type: 'cloudbeat/cis_aws',
+          enabled: true,
+          streams: [
+            {
+              id: 'findings',
+              enabled: true,
+              data_stream: {
+                dataset: 'cloud_security_posture.findings',
+                type: 'logs',
+              },
+              vars: {
+                'aws.credentials.type': { value: 'direct_access_keys' },
+                access_key_id: { value: 'used_key', type: 'text' },
+                secret_access_key: { value: 'used_secret', type: 'text' },
+                role_arn: { value: 'unused' },
+              },
+            },
+          ],
+        },
+        {
+          type: 'cloudbeat/cis_eks',
+          enabled: false,
+          streams: [
+            {
+              id: 'findings',
+              enabled: false,
+              data_stream: {
+                dataset: 'cloud_security_posture.findings',
+                type: 'logs',
+              },
+              vars: {
+                'aws.credentials.type': { value: 'assume_role' },
+                access_key_id: { value: 'should_be_removed', type: 'text' },
+                secret_access_key: { value: 'should_be_removed', type: 'text' },
+                role_arn: { value: 'should_be_removed' },
+                session_token: { value: 'should_be_removed', type: 'text' },
+              },
+            },
+          ],
+        },
+      ];
+
+      const cleanedPackage = cleanupCredentials(mockPackagePolicy);
+
+      // Enabled input should keep credentials based on credential type
+      expect(cleanedPackage.inputs[0].streams[0].vars).toEqual({
+        'aws.credentials.type': { value: 'direct_access_keys' },
+        access_key_id: { value: 'used_key', type: 'text' },
+        secret_access_key: { value: 'used_secret', type: 'text' },
+        role_arn: { value: undefined },
+      });
+
+      // Disabled input should have all credential fields removed
+      expect(cleanedPackage.inputs[1].streams[0].vars).toEqual({
+        'aws.credentials.type': { value: 'assume_role' },
+        access_key_id: { value: undefined, type: 'text' },
+        secret_access_key: { value: undefined, type: 'text' },
+        role_arn: { value: undefined },
+        session_token: { value: undefined, type: 'text' },
+      });
+    });
+
+    it('cleans all gcp credential fields from disabled inputs', () => {
+      const mockPackagePolicy = createPackagePolicyMock();
+      mockPackagePolicy.inputs = [
+        {
+          type: 'cloudbeat/cis_gcp',
+          enabled: true,
+          streams: [
+            {
+              id: 'findings',
+              enabled: true,
+              data_stream: {
+                dataset: 'cloud_security_posture.findings',
+                type: 'logs',
+              },
+              vars: {
+                'gcp.credentials.type': { value: 'credentials-file' },
+                'gcp.credentials.file': { value: 'used' },
+                'gcp.credentials.json': { value: 'unused' },
+              },
+            },
+          ],
+        },
+        {
+          type: 'cloudbeat/cis_gcp',
+          enabled: false,
+          streams: [
+            {
+              id: 'findings',
+              enabled: false,
+              data_stream: {
+                dataset: 'cloud_security_posture.findings',
+                type: 'logs',
+              },
+              vars: {
+                'gcp.credentials.type': { value: 'credentials-json' },
+                'gcp.credentials.file': { value: 'should_be_removed' },
+                'gcp.credentials.json': { value: 'should_be_removed' },
+              },
+            },
+          ],
+        },
+      ];
+
+      const cleanedPackage = cleanupCredentials(mockPackagePolicy);
+
+      // Enabled input should keep credentials based on credential type
+      expect(cleanedPackage.inputs[0].streams[0].vars).toEqual({
+        'gcp.credentials.type': { value: 'credentials-file' },
+        'gcp.credentials.file': { value: 'used' },
+        'gcp.credentials.json': { value: undefined },
+      });
+
+      // Disabled input should have all credential fields removed
+      expect(cleanedPackage.inputs[1].streams[0].vars).toEqual({
+        'gcp.credentials.type': { value: 'credentials-json' },
+        'gcp.credentials.file': { value: undefined },
+        'gcp.credentials.json': { value: undefined },
+      });
+    });
   });
 });

x-pack/solutions/security/plugins/cloud_security_posture/common/utils/helpers.ts

@@ -138,26 +138,30 @@ export const cleanupCredentials = (packagePolicy: NewPackagePolicy | UpdatePacka
       return {
         ...packagePolicy,
         inputs: packagePolicy.inputs.map((input) => {
-          if (input.enabled) {
-            return {
-              ...input,
-              streams: input.streams.map((stream) => {
-                const vars = stream.vars;
-                for (const field in vars) {
-                  if (!credsToKeep.includes(field) && credFields.includes(field)) {
+          return {
+            ...input,
+            streams: input.streams.map((stream) => {
+              const vars = stream.vars;
+              for (const field in vars) {
+                if (input.enabled) {
+                  // for enabled inputs, clean up unused credentials based on the selected credential type
+                  if (credFields.includes(field) && !credsToKeep.includes(field)) {
+                    vars[field].value = undefined;
+                  }
+                } else {
+                  // for disabled inputs, remove all credential fields to prevent storing unnecessary secrets
+                  if (credFields.includes(field)) {
                     vars[field].value = undefined;
                   }
                 }
-
-                return {
-                  ...stream,
-                  vars,
-                };
-              }),
-            };
-          }
-
-          return input;
+              }
+
+              return {
+                ...stream,
+                vars,
+              };
+            }),
+          };
         }),
       };
     }