This article illustrates how to onboard an AWS account to CloudGuard using the CloudGuard REST API.

For onboarding, use the CloudAccounts resource. Information required to complete this procedure must be obtained from your AWS account, either using the AWS console or API.

You can onboard the AWS account to CloudGuard in Full-Protection mode or in Read-Only mode. See CloudGuard Operational Modes.

Prerequisites

CloudGuard information

• your CloudGuard account ID
• the API Key and secret for your account (see Create an API Key)

AWS cloud account information

• your AWS cloud account ID
• the API Secret for your AWS account
• the Role ARN for the CloudGuard-Connect role

Set up the AWS account

Your AWS account must have the IAM Role, CloudGuard-Connect defined, with the policies CloudGuard-read-policy and CloudGuard-write-policy attached to it. You will need the External ID value used to create the Role on AWS (you must select the Require external ID option when creating the role); this can be any string.

Request

POST https://api.dome9.com/v2/CloudAccounts

{
"name":"AWS-1",

"credentials":{
"arn":"arn:aws:iam::************:role/CloudGuard-Connect",
"secret":"****************************************",
"type":"RoleBased"
},
"fullProtection":false
}

Authorization

Basic - use the API Key and secret as username and password, respectively.

Parameters

name - a name for the account, as it appears in CloudGuard

arn - the ARN of the CloudGuard-Connect role in your AWS account

secret - the external ID value used to create the role in your AWS account

type - set to RoleBased

fullProtection - set to true for setting the Security Groups in the account to Full-Protection in the course of onboarding, or false to leave them unchanged (relevant only if the account is being set to Full Protection).

Response

The response shows details for the new account in CloudGuard. The id is for the new account.

{
"id":"6*******-****-****-****-***********a",
"vendor":"aws",
"name":"AWS-1",
"externalAccountNumber":"************",
"error":null,
"creationDate":"2018-08-27T12:58:25.443973Z",
"credentials":{
"apikey":null,
"arn":"arn:aws:iam::************:role/CloudGuard-Connect",
"secret":null,
"iamUser":null,
"type":"RoleBased",
"isReadOnly":false
},
"iamSafe":null,
"netSec":{
"regions":[
{
"region":"us_east_1",
"name":"N. Virginia",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_northeast_2",
"name":"Seoul",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"ap_south_1",
"name":"Mumbai",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"us_east_2",
"name":"Ohio",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"ca_central_1",
"name":"Central",
"hidden":false,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_2",
"name":"London",
"hidden":true,
"newGroupBehavior":"FullManage"
},
{
"region":"eu_west_3",
"name":"Paris",
"hidden":true,
"newGroupBehavior":"FullManage"
}
]
},
"magellan":false,
"fullProtection":false
}

Code samples

curl -X POST https://api.dome9.com/v2/CloudAccounts \
  --basic -u <key-id>:<key-secret> \
  -H 'Content-Type: application/json' \
  -d '{  
   "name":"AWS-1",
   "externalAccountNumber":"****-****-****",
   "credentials":{  
      "arn":"arn:aws:iam::************:role/CloudGuard-Connect",
      "secret":"****************************************",
      "type":"RoleBased"
   },
   "fullProtection":false,
   "allowReadOnly":false
}'

Python (2.7)

import json
import requests
from requests import ConnectionError, auth
import urlparse

#Your API key
apiKey = "********-****-****-****-************" # your account API Key

# Your API secret
apiSecret = "************************" # your account API secret

headers = {
'content-type': 'application/json'
}
payload= {
"name":"<name>",
"credentials":{
"arn":"arn:aws:iam::************:role/CloudGuard-Connect",
"secret":"eVzwiL2UTNWpHt0W7dusKev2",
"type":"RoleBased"
},
"fullProtection":"false"
}

r = requests.post( "https://api.dome9.com/v2/CloudAccounts", data=json.dumps(payload), headers = headers, auth=(apiKey, apiSecret)