Skip to main content

update-aws-feature 

dci update-aws-feature [body]

Updates an AWS feature for an existing CloudConnect account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents, require a CloudFormation stack ID, or handle StackSet member role ARNs.

Pass the request body as name: value arguments or pipe JSON on stdin — see Command structure.

Requires confirmation

Changing enabledFeatures can switch off data ingestion for the account, so the CLI gates this command like a delete: interactive terminals prompt, scripts pass --yes (or set DCI_CONFIRM_DESTRUCTIVE=1), and --dry-run prints the intended call without sending it.

s3Bucket and s3BucketRegion are required together and only apply to CloudTrail real-time anomaly detection.

Examples​

# Preview the change locally; the CLI treats this command as destructive and asks for confirmation.
dci update-aws-feature <account-id> --dry-run enabledFeatures: [real-time-data], s3Bucket: "acme-cloudtrail-logs", s3BucketRegion: us-east-1
# Replace the account's enabled features, including the CloudTrail bucket real-time anomaly detection reads from.
dci update-aws-feature <account-id> --yes < feature.json
# feature.json
{"enabledFeatures": ["real-time-data"],
 "s3Bucket": "acme-cloudtrail-logs", "s3BucketRegion": "us-east-1"}
# The updated record as JSON, to confirm `supportedFeatures[].hasRequiredPermissions`.
dci update-aws-feature <account-id> --yes --output json < feature.json

Request​

Content-Type: application/json

FieldTypeRequiredDescription
s3BucketstringS3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion.
s3BucketRegionstringAWS region of the S3 bucket. Required together with s3Bucket.
enabledFeaturesarray of stringyesDeclares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When "real-time-data" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed.
Raw JSON schema
{
  "type": "object",
  "required": [
    "enabledFeatures"
  ],
  "properties": {
    "s3Bucket": {
      "type": "string",
      "description": "S3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion."
    },
    "s3BucketRegion": {
      "type": "string",
      "description": "AWS region of the S3 bucket. Required together with s3Bucket.",
      "example": "us-east-1"
    },
    "enabledFeatures": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Declares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When \"real-time-data\" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed.",
      "example": [
        "real-time-data"
      ]
    }
  }
}

Output​

OK - Feature updated successfully.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

FieldTypeDescription
accountIDstringThe AWS account ID.
roleArnstringThe ARN of the IAM role.
s3BucketstringS3 bucket name for real-time anomaly detection. Present only if real-time is enabled.
s3BucketRegionstringAWS region of the S3 bucket. Present only if s3Bucket exists.
supportedFeaturesarray of objectList of supported features and their permission status.
supportedFeatures[].namestringFeature name.
supportedFeatures[].hasRequiredPermissionsbooleanWhether the role has the required permissions for this feature.
enabledFeaturesarray of stringList of supported AWS features enabled by the caller. Returned in the same order as provided.
timeLinkedstringISO 8601 timestamp of when the role was linked.
Raw JSON schema
{
  "type": "object",
  "properties": {
    "accountID": {
      "type": "string",
      "description": "The AWS account ID.",
      "example": "123456789012"
    },
    "roleArn": {
      "type": "string",
      "description": "The ARN of the IAM role.",
      "example": "arn:aws:iam::123456789012:role/DoiTRole"
    },
    "s3Bucket": {
      "type": "string",
      "description": "S3 bucket name for real-time anomaly detection. Present only if real-time is enabled."
    },
    "s3BucketRegion": {
      "type": "string",
      "description": "AWS region of the S3 bucket. Present only if s3Bucket exists.",
      "example": "us-east-1"
    },
    "supportedFeatures": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "Feature name.",
            "example": "spot-scaling"
          },
          "hasRequiredPermissions": {
            "type": "boolean",
            "description": "Whether the role has the required permissions for this feature."
          }
        }
      },
      "description": "List of supported features and their permission status."
    },
    "enabledFeatures": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of supported AWS features enabled by the caller. Returned in the same order as provided."
    },
    "timeLinked": {
      "type": "string",
      "description": "ISO 8601 timestamp of when the role was linked.",
      "example": "2024-01-15T10:30:00Z"
    }
  }
}

Errors​

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping
HTTP statusExit codeError codeMeaning
40030VALIDATION_ERRORThe arguments or request body were rejected. Review the command's flags and payload.
40110AUTHENTICATION_FAILEDNot signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
40311PERMISSION_DENIEDThe DoiT user or the active customer context does not have access.
50040API_SERVER_ERRORThe API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: updateawsfeature