To ingest the VPC flow logs from Amazon S3 buckets to Prisma Cloud, you need an AWS logging account. If you need flow logs ingestion, after onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The APIs in this category can be used to configure and manage these logging accounts.
openapi: 3.2.0
info:
version: v1
title: Prisma Cloud REST API Doc AWS Logging Accounts API
contact: {}
license:
name: Public
description: To ingest the VPC flow logs from Amazon S3 buckets to Prisma Cloud, you need an AWS logging account. If you need flow logs ingestion, after onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The APIs in this category can be used to configure and manage these logging accounts.
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: AWS Logging Accounts
description: To ingest the VPC flow logs from Amazon S3 buckets to Prisma Cloud, you need an AWS logging account. If you need flow logs ingestion, after onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The APIs in this category can be used to configure and manage these logging accounts.
paths:
/v1/cloudAccounts/awsLoggingAccounts:
get:
tags:
- AWS Logging Accounts
summary: Get all AWS Logging Accounts
description: Get the list of all the AWS Logging accounts and its details.
operationId: getLoggingArchiveAccounts
parameters:
- name: awsPartition
in: query
description: AWS Partition Name (optional)
required: false
schema:
type: string
responses:
'200':
description: Successfully retrieved list of accounts
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/LoggingArchiveAccountModel'
'204':
description: No logging archive accounts exists for customer
'401':
description: Unauthorized Access
security:
- x-redlock-auth: []
x-public: 'true'
post:
tags:
- AWS Logging Accounts
summary: Add AWS Logging Account
description: Add new AWS logging account.
operationId: saveLoggingAccount
requestBody:
$ref: '#/components/requestBodies/LoggingArchiveAccountModel'
responses:
'200':
description: successful operation
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/LoggingArchiveAccountModel'
'201':
description: Successfully created account
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/cft:
post:
tags:
- AWS Logging Accounts
summary: Generate a New CFT Template
description: Dynamically generate a CFT for the AWS Logging Account.
operationId: generate-log-account-cft
requestBody:
$ref: '#/components/requestBodies/LoggingAccountCFTRequest'
responses:
'200':
description: success
'400':
description: bad_request
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/permissionsStatus:
post:
tags:
- AWS Logging Accounts
summary: Get Logging Account Status
description: Get the status of the AWS logging account based on filter criteria such as, ID, name, RoleRN, and bucket.
operationId: checkLoggingAccountStatus
requestBody:
$ref: '#/components/requestBodies/LoggingArchiveAccountModel'
responses:
'200':
description: Successfully completed status check for logging account
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/CloudAccountStatus'
'401':
description: Unauthorized Access
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{accountId}:
get:
tags:
- AWS Logging Accounts
summary: Get Logging Account By ID
description: Get details of a logging account by ID.
operationId: getLoggingArchiveAccount
parameters:
- name: accountId
in: path
required: true
schema:
type: string
responses:
'200':
description: Successfully retrieved account
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/LoggingArchiveAccountModel'
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
'404':
description: Account not found
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{accountId}/buckets/{bucketName}:
delete:
tags:
- AWS Logging Accounts
summary: Delete an S3 bucket
description: Delete an S3 bucket in a logging account.
operationId: deleteBucket
parameters:
- name: accountId
in: path
description: AWS Logging Account ID
required: true
schema:
type: string
- name: bucketName
in: path
description: AWS S3 Bucket Name
required: true
schema:
type: string
responses:
'200':
description: successful operation
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/BucketModel'
'204':
description: Successfully deleted bucket
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
'404':
description: Account or bucket not found.
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{accountId}/cft:
get:
tags:
- AWS Logging Accounts
summary: Regenerate CFT for an Existing Account
description: Dynamically generate a CFT for an existing Log Account.
operationId: generate-log-account-cft-existing
parameters:
- name: accountId
in: path
description: Account ID
required: true
schema:
type: string
responses:
'200':
description: success
'400':
description: bad_request
'404':
description: Account or bucket not found.
security:
- x-redlock-auth: []
x-public: 'true'
post:
tags:
- AWS Logging Accounts
summary: Regenerate CFT for New RoleName
description: Regenerate a new CFT for an existing logging account if roleName changes.
operationId: generate-log-account-cft-role
parameters:
- name: accountId
in: path
description: Account ID
required: true
schema:
type: string
requestBody:
$ref: '#/components/requestBodies/LoggingAccountCFTRequest'
responses:
'200':
description: success
'400':
description: bad_request
'404':
description: Account or bucket not found.
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{accountId}/role/{roleName}/externalId:
get:
tags:
- AWS Logging Accounts
summary: Get External ID of an Account
description: Get external ID of an AWS Logging Accountby account ID and rolename.
operationId: 'Get External ID '
parameters:
- name: accountId
in: path
description: AWS AccountId
required: true
schema:
type: string
- name: roleName
in: path
description: AWS Role Name
required: true
schema:
type: string
responses:
'200':
description: success
content:
application/json; charset=UTF-8:
schema:
type: string
'400':
description: bad_request
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}:
put:
tags:
- AWS Logging Accounts
summary: Update Logging Account
description: Update details of the logging account.
operationId: updateLoggingAccount
parameters:
- name: loggingAccountId
in: path
description: AWS Logging Account ID
required: true
schema:
type: string
requestBody:
$ref: '#/components/requestBodies/LoggingArchiveAccountModel'
responses:
'204':
description: No content
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
security:
- x-redlock-auth: []
x-public: 'true'
delete:
tags:
- AWS Logging Accounts
summary: Delete a Logging Account by ID
description: Delete an AWS logging account based on account ID.
operationId: deleteLoggingAccount
parameters:
- name: loggingAccountId
in: path
required: true
schema:
type: string
responses:
'204':
description: No content
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/buckets:
get:
tags:
- AWS Logging Accounts
summary: List S3 Bucket Names
description: Get a list of all the S3 bucket names associated to a logging account.
operationId: getBuckets
parameters:
- name: loggingAccountId
in: path
description: AWS Logging Account ID
required: true
schema:
type: string
responses:
'200':
description: Successfully retrieved buckets
content:
application/json; charset=UTF-8:
schema:
type: array
items:
type: object
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
'404':
description: Account not found
security:
- x-redlock-auth: []
x-public: 'true'
post:
tags:
- AWS Logging Accounts
summary: Add an S3 bucket
description: Add an S3 bucket to the existing logging account.
operationId: saveBucket
parameters:
- name: loggingAccountId
in: path
description: AWS Logging Account ID
required: true
schema:
type: string
requestBody:
$ref: '#/components/requestBodies/BucketModel'
responses:
'200':
description: Successfully saved bucket
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/BucketModel'
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
'404':
description: Account not found.
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/buckets/{bucketName}:
get:
tags:
- AWS Logging Accounts
summary: Get all S3 Buckets
description: Get the list of all S3 bucket and its details associated with a logging account.
operationId: getBucketDetails
parameters:
- name: loggingAccountId
in: path
required: true
schema:
type: string
- name: bucketName
in: path
required: true
schema:
type: string
responses:
'200':
description: Successfully retrieved bucket
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/BucketModel'
'401':
description: Unauthorized Access
'404':
description: Resource not found
security:
- x-redlock-auth: []
x-public: 'true'
put:
tags:
- AWS Logging Accounts
summary: Update S3 Bucket Details
description: Update details of an S3 bucket associated to a specific logging account.
operationId: updateBucket
parameters:
- name: loggingAccountId
in: path
description: AWS Logging Account ID
required: true
schema:
type: string
- name: bucketName
in: path
description: AWS S3 Bucket Name
required: true
schema:
type: string
requestBody:
$ref: '#/components/requestBodies/BucketModel'
responses:
'200':
description: Successfully updated bucket
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/BucketModel'
'400':
description: Bad Request. Data validation failed.
'401':
description: Unauthorized Access
'404':
description: Account or bucket not found.
security:
- x-redlock-auth: []
x-public: 'true'
/v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/permissionsStatus:
get:
tags:
- AWS Logging Accounts
summary: Get Logging Account Status - GET
description: Get status of a logging account based on ID.
operationId: getLoggingAccountStatus
parameters:
- name: loggingAccountId
in: path
required: true
schema:
type: string
responses:
'200':
description: List of logging account statuses
content:
application/json; charset=UTF-8:
schema:
type: array
items:
type: object
'400':
description: Invalid parameter
'401':
description: Unauthorized Access
'404':
description: Account not found
security:
- x-redlock-auth: []
x-public: 'true'
post:
tags:
- AWS Logging Accounts
summary: Get Logging Account Status - POST
description: 'Get detailed status of a logging account based on ID, name, roleRN or bucket name. '
operationId: checkLoggingAccountStatusForProvidedAccount
parameters:
- name: loggingAccountId
in: path
required: true
schema:
type: string
requestBody:
$ref: '#/components/requestBodies/LoggingArchiveAccountModel'
responses:
'200':
description: Successfully completed status check for existing logging account
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/CloudAccountStatus'
'400':
description: Invalid parameter
'401':
description: Unauthorized Access
'404':
description: Logging Account doesn't exist
security:
- x-redlock-auth: []
x-public: 'true'
components:
schemas:
CloudAccountStatus:
type: object
properties:
id:
type: string
name:
type: string
status:
type: string
statusMessage:
$ref: '#/components/schemas/AccountStatusMessage'
LoggingAccountCFTRequest:
type: object
properties:
awsPartition:
type: string
externalId:
type: string
loggingAccountId:
type: string
loggingAccountRoleName:
type: string
trustedEntity:
type: string
partitionName:
type: string
enum:
- US_GLOBAL
- US_GOV
- CHINA
loggingAccountBuckets:
type: array
items:
$ref: '#/components/schemas/BucketModel'
LoggingArchiveAccountModel:
type: object
required:
- externalId
- loggingAccountBuckets
- loggingAccountId
- loggingAccountName
- loggingAccountRoleArn
- loggingAccountRoleName
- status
properties:
loggingAccountId:
type: string
description: CSP Cloud Account Id
loggingAccountName:
type: string
description: Account Name
loggingAccountRoleName:
type: string
description: Account Role Name
readOnly: true
loggingAccountRoleArn:
type: string
description: Account Role ARN
externalId:
type: string
description: External Id for Account
readOnly: true
status:
type: string
description: Account status
readOnly: true
loggingAccountBuckets:
type: string
description: List of buckets associated with account
description: Logging Archive Account Model
BucketModel:
type: object
required:
- bucketName
- bucketRegion
- loggingAccountId
properties:
bucketName:
type: string
description: S3 Bucket Name
bucketRegion:
type: string
description: S3 Bucket Region
bucketPathPrefixes:
type: string
description: Bucket Path Prefixes
keyArn:
type: string
description: CMS Key ARN
loggingAccountId:
type: integer
format: int32
description: Log Archive Account Id
featureMap:
type: object
description: Monitored account and bucket purpose details
additionalProperties:
type: array
items:
type: string
lastUpdatedTs:
type: integer
format: int64
description: Last Updated Timestamp
description: Model for S3 Bucket
AccountStatusMessage:
type: object
properties:
message:
type: string
staticMessage:
type: boolean
requestBodies:
LoggingArchiveAccountModel:
content:
application/json:
schema:
$ref: '#/components/schemas/LoggingArchiveAccountModel'
LoggingAccountCFTRequest:
content:
application/json:
schema:
$ref: '#/components/schemas/LoggingAccountCFTRequest'
description: Logging Account CFT
required: true
BucketModel:
content:
application/json:
schema:
$ref: '#/components/schemas/BucketModel'
securitySchemes:
x-redlock-auth:
description: The x-redlock-auth value is a JSON Web Token (JWT).
in: header
name: x-redlock-auth
type: apiKey