Onboard an AWS account to Dome9 using the REST API

In this topic:

    This note illustrates how to onboard an AWS account to Dome9 using the Dome9 REST API.

    This will use the CloudAccounts resource. Information required to complete this procedure must be obtained from your AWS account, either using the AWS console or API. 

    You can onboard the AWS account to Dome9 in Full-Protection mode or in Read-Only mode. See Dome9 Operational Modes.

    See also

    Onboard an AWS Account

    Prerequisites

    Dome9 information

    • your Dome9 account id
    • the API Key and secret for your Dome9 account (see Create an API Key)

    AWS cloud account information

    • your AWS cloud account id
    • the API Secret for your AWS account
    • the Role ARN for the Dome9-Connect role (described in Onboard an AWS Account)

     

    Setup the AWS account

    Your AWS account must have the IAM Role, Dome9-Connect defined, with the policies Dome9-read-policy and Dome9-write-policy attached to it. You will need the External ID value used to create the Role on AWS (you must select the Require external ID option when creating the role); this can be any string.

    For example, follow steps 3-19 in Onboard an AWS Account.

    Request

    POST https://api.dome9.com/v2/CloudAccounts

    {  
       "name":"AWS-1",
         "credentials":{  
          "arn":"arn:aws:iam::************:role/Dome9-Connect",
          "secret":"****************************************",
          "type":"RoleBased"
       },
       "fullProtection":true,
       "allowReadOnly":true
    }

    Authorization

    Basic - use the API Key and secret as Username and Password, respectively.

    Parameters 

    name - a name for the account, as it will appear in Dome9 

    arn - the ARN of the Dome9-Connect role in your AWS account

    secret - the external ID value used to create the role in your AWS account

    type - set to "RoleBased"

    fullProtection - set to true for to set the Security Groups in the account to Full-Protection in the course of onboarding, or false to leave them unchanged (relevant only if the account is being set to Full Protection).

    allowReadOnly  - set to true for Read-Only, and false for Full Protection

    Response 

     The response shows details for the new account in Dome9. The id is for the new account. 

     

     

     

    {  
       "id":"6*******-****-****-****-***********a",
       "vendor":"aws",
       "name":"AWS-1",
       "externalAccountNumber":"************",
       "error":null,
       "creationDate":"2018-08-27T12:58:25.443973Z",
       "credentials":{  
          "apikey":null,
          "arn":"arn:aws:iam::************:role/Dome9-Connect",
          "secret":null,
          "iamUser":null,
          "type":"RoleBased",
          "isReadOnly":false
       },
       "iamSafe":null,
       "netSec":{  
          "regions":[  
             {  
                "region":"us_east_1",
                "name":"N. Virginia",
                "hidden":true,
                "newGroupBehavior":"FullManage"
             },
            {  
                "region":"ap_northeast_2",
                "name":"Seoul",
                "hidden":true,
                "newGroupBehavior":"FullManage"
             },
             {  
                "region":"ap_south_1",
                "name":"Mumbai",
                "hidden":true,
                "newGroupBehavior":"FullManage"
             },
             {  
                "region":"us_east_2",
                "name":"Ohio",
                "hidden":false,
                "newGroupBehavior":"FullManage"
             },
             {  
                "region":"ca_central_1",
                "name":"Central",
                "hidden":false,
                "newGroupBehavior":"FullManage"
             },
             {  
                "region":"eu_west_2",
                "name":"London",
                "hidden":true,
                "newGroupBehavior":"FullManage"
             },
             {  
                "region":"eu_west_3",
                "name":"Paris",
                "hidden":true,
                "newGroupBehavior":"FullManage"
             }
          ]
       },
       "magellan":false,
       "fullProtection":false,
       "allowReadOnly":false
    }

     

      Code examples

    curl -X POST https://api.dome9.com/v2/CloudAccounts \
      --basic -u <key-id>:<key-secret> \
      -H 'Content-Type: application/json' \
      -H 'Accept: application/json'  
      -d '{  
       "name":"AWS-1",
         "credentials":{  
          "arn":"arn:aws:iam::************:role/Dome9-Connect",
          "secret":"****************************************",
          "type":"RoleBased"
       },
       "fullProtection":"true",
       "allowReadOnly":"true"
    }'

     Python

    import json
    import requests
    from requests import ConnectionError, auth
    from urllib.parse import urlparse

    #Your API key
    apiKey = "********-****-****-****-************" # your account API Key

    # Your API secret
    apiSecret = "************************" # your account API secret

    headers = {
    'Accept': 'application/json'
    }
    payload= {
    "name":"<name>",
    "credentials":{
    "arn":"arn:aws:iam::************:role/Dome9-Connect",
    "secret":"eVzwiL2UTNWpHt0W7dusKev2",
    "type":"RoleBased"
    },
    "fullProtection":"false",
    "allowReadOnly":"false"
    }

    r = requests.post( "https://api.dome9.com/v2/CloudAccounts", data=payload, headers = headers, auth=(apiKey, apiSecret)