> Source: [sk147832](https://support.checkpoint.com/results/sk/sk147832)

# sk147832 - How to onboard an AWS account to CloudGuard using the REST API

| Property | Value |
|----------|-------|
| Solution ID | sk147832 |
| Date Created | 2019-02-24 |
| Last Modified | 2022-08-08 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Solution

This article illustrates how to onboard an AWS account to CloudGuard using the CloudGuard REST API.

For onboarding, use the [CloudAccounts](https://docs.cloudguard.dome9.com/reference/cloudaccounts_post_post_v2cloudaccounts) resource. Information required to complete this procedure must be obtained from your AWS account, either using the AWS console or API.

You can onboard the AWS account to CloudGuard in Full-Protection mode or in Read-Only mode. See [CloudGuard Operational Modes](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/CloudGuard-PM-Admin-Guide/Documentation/Assets/AWSSGMgmt.htm#Manage).

Prerequisites
-------------

### CloudGuard information

* your CloudGuard account ID
* the API Key and secret for your account (see [Create an API Key](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/CloudGuard-PM-Admin-Guide/Default.htm#cshid=API_V2))

### AWS cloud account information

* your AWS cloud account ID
* the API Secret for your AWS account
* the Role ARN for the *CloudGuard-Connect* role

### Set up the AWS account

Your AWS account must have the IAM Role, *CloudGuard-Connect* defined, with the policies *CloudGuard-read-policy* and *CloudGuard-write-policy* attached to it. You will need the *External ID* value used to create the Role on AWS (you must select the *Require external ID*option when creating the role); this can be any string.

Request
-------

POST https://api.dome9.com/v2/CloudAccounts

{   
"name":"AWS-1",  

"credentials":{   
"arn":"arn:aws:iam::\*\*\*\*\*\*\*\*\*\*\*\*:role/CloudGuard-Connect",  
"secret":"\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*",  
"type":"RoleBased"  
},  
"fullProtection":false  
}{#s-51}

### Authorization

Basic - use the API Key and secret as username and password, respectively.

### Parameters

**name** - a name for the account, as it appears in CloudGuard

**arn** - the ARN of the CloudGuard-Connect role in your AWS account

**secret** - the external ID value used to create the role in your AWS account

**type** - set to **RoleBased**

**fullProtection** - set to **true** for setting the Security Groups in the account to Full-Protection in the course of onboarding, or **false**to leave them unchanged (relevant only if the account is being set to Full Protection).

Response
--------

The response shows details for the new account in CloudGuard. The **id** is for the new account.

{   
"id":"6\*\*\*\*\*\*\*-\*\*\*\*-\*\*\*\*-\*\*\*\*-\*\*\*\*\*\*\*\*\*\*\*a",  
"vendor":"aws",  
"name":"AWS-1",  
"externalAccountNumber":"\*\*\*\*\*\*\*\*\*\*\*\*",  
"error":null,  
"creationDate":"2018-08-27T12:58:25.443973Z",  
"credentials":{   
"apikey":null,  
"arn":"arn:aws:iam::\*\*\*\*\*\*\*\*\*\*\*\*:role/CloudGuard-Connect",  
"secret":null,  
"iamUser":null,  
"type":"RoleBased",  
"isReadOnly":false  
},  
"iamSafe":null,  
"netSec":{   
"regions":\[   
{   
"region":"us_east_1",  
"name":"N. Virginia",  
"hidden":true,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"ap_northeast_2",  
"name":"Seoul",  
"hidden":true,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"ap_south_1",  
"name":"Mumbai",  
"hidden":true,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"us_east_2",  
"name":"Ohio",  
"hidden":false,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"ca_central_1",  
"name":"Central",  
"hidden":false,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"eu_west_2",  
"name":"London",  
"hidden":true,  
"newGroupBehavior":"FullManage"  
},  
{   
"region":"eu_west_3",  
"name":"Paris",  
"hidden":true,  
"newGroupBehavior":"FullManage"  
}  
\]  
},  
"magellan":false,  
"fullProtection":false  
}{#s-347}

Code samples
------------

    curl -X POST https://api.dome9.com/v2/CloudAccounts \
      --basic -u <key-id>:<key-secret> \
      -H 'Content-Type: application/json' \
      -d '{  
       "name":"AWS-1",
       "externalAccountNumber":"****-****-****",
       "credentials":{  
          "arn":"arn:aws:iam::************:role/CloudGuard-Connect",
          "secret":"****************************************",
          "type":"RoleBased"
       },
       "fullProtection":false,
       "allowReadOnly":false
    }'

### Python (2.7)

    import json
    import requests
    from requests import ConnectionError, auth
    import urlparse

#Your API key  
apiKey = "\*\*\*\*\*\*\*\*-\*\*\*\*-\*\*\*\*-\*\*\*\*-\*\*\*\*\*\*\*\*\*\*\*\*" # your account API Key

```

```

# Your API secret  
apiSecret = "\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*" # your account API secret

```

```

headers = {  
'content-type': 'application/json'  
}  
payload= {  
"name":"\<name\>",  
"credentials":{  
"arn":"arn:aws:iam::\*\*\*\*\*\*\*\*\*\*\*\*:role/CloudGuard-Connect",  
"secret":"eVzwiL2UTNWpHt0W7dusKev2",  
"type":"RoleBased"  
},  
"fullProtection":"false"  
}

```

```

r = requests.post( "https://api.dome9.com/v2/CloudAccounts", data=json.dumps(payload), headers = headers, auth=(apiKey, apiSecret)

```

```

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content