This article illustrates how to onboard an AWS account to Dome9 using the Dome9 REST API.
This will use the CloudAccounts resource. Information required to complete this procedure must be obtained from your AWS account, either using the AWS console or API.
You can onboard the AWS account to Dome9 in Full-Protection mode or in Read-Only mode. See Dome9 Operational Modes.
Prerequisites
Dome9 information
- your Dome9 account id
- the API Key and secret for your account (see Create an API Key)
AWS cloud account information
- your AWS cloud account id
- the API Secret for your AWS account
- the Role ARN for the Dome9-Connect role
Setup the AWS account
Your AWS account must have the IAM Role, Dome9-Connect defined, with the policies Dome9-read-policy and Dome9-write-policy attached to it. You will need the External ID value used to create the Role on AWS (you must select the Require external ID option when creating the role); this can be any string.
Request
POST https://api.dome9.com/v2/CloudAccounts
{
"name":"AWS-1",
"credentials":{
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":"****************************************",
"type":"RoleBased"
},
"fullProtection":false
}
Authorization
Basic - use the API Key and secret as Username and Password, respectively.
Parameters
name - a name for the account, as it will appear in Dome9
arn - the ARN of the Dome9-Connect role in your AWS account
secret - the external ID value used to create the role in your AWS account
type - this should be set to RoleBased
fullProtection - set to true for to set the Security Groups in the account to Full-Protection in the course of onboarding, or false to leave them unchanged (relevant only if the account is being set to Full Protection).
Response
The response shows details for the new account in Dome9. The id is for the new account.
{
"id":"6*******-****-****-****-***********a",
"vendor":"aws",
"name":"AWS-1",
"externalAccountNumber":"************",
"error":null,
"creationDate":"2018-08-27T12:58:25.443973Z",
"credentials":{
"apikey":null,
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":null,
"iamUser":null,
"type":"RoleBased",
"isReadOnly":false
},
"iamSafe":null,
"netSec":{
"regions":[
{
"region":"us_east_1",
"name":"N. Virginia",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_northeast_2",
"name":"Seoul",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_south_1",
"name":"Mumbai",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"us_east_2",
"name":"Ohio",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"ca_central_1",
"name":"Central",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_2",
"name":"London",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_3",
"name":"Paris",
"hidden":true,
"newGroupBehavior":"FullManage"
}
]
},
"magellan":false,
"fullProtection":false
}
Code samples
curl -X POST https://api.dome9.com/v2/CloudAccounts \
--basic -u <key-id>:<key-secret> \
-H 'Content-Type: application/json' \
-d '{
"name":"AWS-1",
"externalAccountNumber":"****-****-****",
"credentials":{
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":"****************************************",
"type":"RoleBased"
},
"fullProtection":false,
"allowReadOnly":false
}'
Python (2.7)
import json
import requests
from requests import ConnectionError, auth
import urlparse
#Your API key
apiKey = "********-****-****-****-************" # your account API Key
# Your API secret
apiSecret = "************************" # your account API secret
headers = {
'content-type': 'application/json'
}
payload= {
"name":"<name>",
"credentials":{
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":"eVzwiL2UTNWpHt0W7dusKev2",
"type":"RoleBased"
},
"fullProtection":"false"
}
r = requests.post( "https://api.dome9.com/v2/CloudAccounts", data=json.dumps(payload), headers = headers, auth=(apiKey, apiSecret)