diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/steps/components/package_policy_input_var_field.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/steps/components/package_policy_input_var_field.tsx
index 653986a7128de..6bd5a2e0b66c4 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/steps/components/package_policy_input_var_field.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/steps/components/package_policy_input_var_field.tsx
@@ -420,6 +420,7 @@ function SecretInputField({
           iconType="refresh"
           iconSide="left"
           size="xs"
+          data-test-subj={`button-replace${lowercaseTitle}`}
         >
           <FormattedMessage
             id="xpack.fleet.editPackagePolicy.stepConfigure.fieldSecretValueSetEditButton"
diff --git a/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts b/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
index cbde9071e80e4..43dde51967520 100644
--- a/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
+++ b/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
@@ -263,6 +263,10 @@ export function AddCisIntegrationFormPageProvider({
     return stringToFind;
   };
 
+  const getReplaceSecretButton = async (secretField: string) => {
+    return await testSubjects.find(`button-replace${secretField}`);
+  };
+
   return {
     cisAzure,
     cisAws,
@@ -295,5 +299,6 @@ export function AddCisIntegrationFormPageProvider({
     isOptionChecked,
     checkIntegrationPliAuthBlockExists,
     doesStringExist,
+    getReplaceSecretButton,
   };
 }
diff --git a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_aws.ts b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_aws.ts
index 04356a0ce0d57..cfba8bfba3979 100644
--- a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_aws.ts
+++ b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_aws.ts
@@ -124,7 +124,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getFieldValueInEditPage(DIRECT_ACCESS_KEY_ID_TEST_ID)) ===
             directAccessKeyId
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });
 
@@ -160,7 +160,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getValueInEditPage(TEMP_ACCESS_SESSION_TOKEN_TEST_ID)) ===
             tempAccessSessionToken
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });
 
@@ -249,7 +249,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getFieldValueInEditPage(DIRECT_ACCESS_KEY_ID_TEST_ID)) ===
             directAccessKeyId
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });
 
@@ -286,7 +286,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getValueInEditPage(TEMP_ACCESS_SESSION_TOKEN_TEST_ID)) ===
             tempAccessSessionToken
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });
 
diff --git a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_azure.ts b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_azure.ts
index 2554087fc3b1d..56a4a9088aa82 100644
--- a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_azure.ts
+++ b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/cspm/cis_integration_azure.ts
@@ -111,7 +111,7 @@ export default function (providerContext: FtrProviderContext) {
             CIS_AZURE_INPUT_FIELDS_TEST_SUBJECTS.TENANT_ID
           )) === tenantId
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace client secret')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('client secret')).to.not.be(null);
       });
     });
 
@@ -223,7 +223,7 @@ export default function (providerContext: FtrProviderContext) {
             CIS_AZURE_INPUT_FIELDS_TEST_SUBJECTS.TENANT_ID
           )) === tenantId
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace client secret')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('client secret')).to.not.be(null);
       });
     });
 
diff --git a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/kspm/cis_integration_eks.ts b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/kspm/cis_integration_eks.ts
index 9236f44a2ae03..564cef0d1b238 100644
--- a/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/kspm/cis_integration_eks.ts
+++ b/x-pack/test/cloud_security_posture_functional/pages/cis_integrations/kspm/cis_integration_eks.ts
@@ -72,7 +72,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getFieldValueInEditPage(DIRECT_ACCESS_KEY_ID_TEST_ID)) ===
             directAccessKeyId
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });
 
@@ -107,7 +107,7 @@ export default function (providerContext: FtrProviderContext) {
           (await cisIntegration.getValueInEditPage(TEMP_ACCESS_SESSION_TOKEN_TEST_ID)) ===
             tempAccessSessionToken
         ).to.be(true);
-        expect(await cisIntegration.doesStringExist('Replace secret access key')).to.not.be(null);
+        expect(await cisIntegration.getReplaceSecretButton('secret access key')).to.not.be(null);
       });
     });