This article illustrates how to onboard an AWS account to Dome9 using the Dome9 REST API.

This will use the CloudAccounts resource. Information required to complete this procedure must be obtained from your AWS account, either using the AWS console or API.

You can onboard the AWS account to Dome9 in Full-Protection mode or in Read-Only mode. See Dome9 Operational Modes.

Prerequisites

Dome9 information

• your Dome9 account id
• the API Key and secret for your account (see Create an API Key)

AWS cloud account information

• your AWS cloud account id
• the API Secret for your AWS account
• the Role ARN for the Dome9-Connect role

Setup the AWS account

Your AWS account must have the IAM Role, Dome9-Connect defined, with the policies Dome9-read-policy and Dome9-write-policy attached to it. You will need the External ID value used to create the Role on AWS (you must select the Require external ID option when creating the role); this can be any string.

Request

POST https://api.dome9.com/v2/CloudAccounts

{
"name":"AWS-1",

"credentials":{
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":"****************************************",
"type":"RoleBased"
},
"fullProtection":false
}

Authorization

Basic - use the API Key and secret as Username and Password, respectively.

Parameters

name - a name for the account, as it will appear in Dome9

arn - the ARN of the Dome9-Connect role in your AWS account

secret - the external ID value used to create the role in your AWS account

type - this should be set to RoleBased

fullProtection - set to true for to set the Security Groups in the account to Full-Protection in the course of onboarding, or false to leave them unchanged (relevant only if the account is being set to Full Protection).

Response

The response shows details for the new account in Dome9. The id is for the new account.

{
"id":"6*******-****-****-****-***********a",
"vendor":"aws",
"name":"AWS-1",
"externalAccountNumber":"************",
"error":null,
"creationDate":"2018-08-27T12:58:25.443973Z",
"credentials":{
"apikey":null,
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":null,
"iamUser":null,
"type":"RoleBased",
"isReadOnly":false
},
"iamSafe":null,
"netSec":{
"regions":[
{
"region":"us_east_1",
"name":"N. Virginia",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_northeast_2",
"name":"Seoul",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_south_1",
"name":"Mumbai",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"us_east_2",
"name":"Ohio",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"ca_central_1",
"name":"Central",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_2",
"name":"London",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_3",
"name":"Paris",
"hidden":true,
"newGroupBehavior":"FullManage"
}
]
},
"magellan":false,
"fullProtection":false
}

Code samples

curl -X POST https://api.dome9.com/v2/CloudAccounts \
  --basic -u <key-id>:<key-secret> \
  -H 'Content-Type: application/json' \
  -d '{  
   "name":"AWS-1",
   "externalAccountNumber":"****-****-****",
   "credentials":{  
      "arn":"arn:aws:iam::************:role/Dome9-Connect",
      "secret":"****************************************",
      "type":"RoleBased"
   },
   "fullProtection":false,
   "allowReadOnly":false
}'

Python (2.7)

import json
import requests
from requests import ConnectionError, auth
import urlparse

#Your API key
apiKey = "********-****-****-****-************" # your account API Key

# Your API secret
apiSecret = "************************" # your account API secret

headers = {
'content-type': 'application/json'
}
payload= {
"name":"<name>",
"credentials":{
"arn":"arn:aws:iam::************:role/Dome9-Connect",
"secret":"eVzwiL2UTNWpHt0W7dusKev2",
"type":"RoleBased"
},
"fullProtection":"false"
}

r = requests.post( "https://api.dome9.com/v2/CloudAccounts", data=json.dumps(payload), headers = headers, auth=(apiKey, apiSecret)