メインコンテンツへスキップ

create-account-role 

dci create-account-role [body]

Creates or updates a CloudConnect document for an AWS account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents or require a CloudFormation stack ID.

Pass the request body as name: value arguments or pipe JSON on stdin — see Command structure.

Creates or updates the CloudConnect record for the account, so re-running with the same accountID updates the existing connection. s3Bucket and s3BucketRegion are only needed for CloudTrail real-time anomaly detection and must be given together. After connecting, dci get-cloud-connect-supported-features <account-id> shows which features the role has sufficient permissions for.

Examples​

# Connect an AWS account by registering the IAM role DoiT assumes, with the features to enable.
dci create-account-role accountID: "123456789012", roleArn: "arn:aws:iam::123456789012:role/DoiTRole", enabledFeatures: [real-time-data]
The account record: `roleArn`, `enabledFeatures`, `timeLinked`, and `supportedFeatures` with `hasRequiredPermissions` per feature.
# Enable real-time anomaly detection, which also needs the CloudTrail S3 bucket and its region.
dci create-account-role < role.json
# role.json
{"accountID": "123456789012",
 "roleArn": "arn:aws:iam::123456789012:role/DoiTRole",
 "enabledFeatures": ["real-time-data"],
 "s3Bucket": "acme-cloudtrail-logs", "s3BucketRegion": "us-east-1"}
# The resulting record as JSON, to check `supportedFeatures[].hasRequiredPermissions` in a script.
dci create-account-role --output json < role.json

Request​

Content-Type: application/json

FieldTypeRequiredDescription
accountIDstringyesThe AWS account ID.
roleArnstringyesThe ARN of the IAM role created for DoiT access.
s3BucketstringS3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion.
s3BucketRegionstringAWS region of the S3 bucket. Required together with s3Bucket.
enabledFeaturesarray of stringyesDeclares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When "real-time-data" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed.
Raw JSON schema
{
  "type": "object",
  "required": [
    "accountID",
    "roleArn",
    "enabledFeatures"
  ],
  "properties": {
    "accountID": {
      "type": "string",
      "description": "The AWS account ID.",
      "example": "123456789012"
    },
    "roleArn": {
      "type": "string",
      "description": "The ARN of the IAM role created for DoiT access.",
      "example": "arn:aws:iam::123456789012:role/DoiTRole"
    },
    "s3Bucket": {
      "type": "string",
      "description": "S3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion."
    },
    "s3BucketRegion": {
      "type": "string",
      "description": "AWS region of the S3 bucket. Required together with s3Bucket.",
      "example": "us-east-1"
    },
    "enabledFeatures": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Declares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When \"real-time-data\" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed.",
      "example": [
        "real-time-data"
      ]
    }
  }
}

Output​

OK - Role created/updated successfully.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

FieldTypeDescription
accountIDstringThe AWS account ID.
roleArnstringThe ARN of the IAM role.
s3BucketstringS3 bucket name for real-time anomaly detection. Present only if real-time is enabled.
s3BucketRegionstringAWS region of the S3 bucket. Present only if s3Bucket exists.
supportedFeaturesarray of objectList of supported features and their permission status.
supportedFeatures[].namestringFeature name.
supportedFeatures[].hasRequiredPermissionsbooleanWhether the role has the required permissions for this feature.
enabledFeaturesarray of stringList of supported AWS features enabled by the caller. Returned in the same order as provided.
timeLinkedstringISO 8601 timestamp of when the role was linked.
Raw JSON schema
{
  "type": "object",
  "properties": {
    "accountID": {
      "type": "string",
      "description": "The AWS account ID.",
      "example": "123456789012"
    },
    "roleArn": {
      "type": "string",
      "description": "The ARN of the IAM role.",
      "example": "arn:aws:iam::123456789012:role/DoiTRole"
    },
    "s3Bucket": {
      "type": "string",
      "description": "S3 bucket name for real-time anomaly detection. Present only if real-time is enabled."
    },
    "s3BucketRegion": {
      "type": "string",
      "description": "AWS region of the S3 bucket. Present only if s3Bucket exists.",
      "example": "us-east-1"
    },
    "supportedFeatures": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "Feature name.",
            "example": "spot-scaling"
          },
          "hasRequiredPermissions": {
            "type": "boolean",
            "description": "Whether the role has the required permissions for this feature."
          }
        }
      },
      "description": "List of supported features and their permission status."
    },
    "enabledFeatures": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of supported AWS features enabled by the caller. Returned in the same order as provided."
    },
    "timeLinked": {
      "type": "string",
      "description": "ISO 8601 timestamp of when the role was linked.",
      "example": "2024-01-15T10:30:00Z"
    }
  }
}

Errors​

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping
HTTP statusExit codeError codeMeaning
40030VALIDATION_ERRORThe arguments or request body were rejected. Review the command's flags and payload.
40110AUTHENTICATION_FAILEDNot signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
40311PERMISSION_DENIEDThe DoiT user or the active customer context does not have access.
40921RESOURCE_CONFLICTThe operation conflicts with the resource's current state.
50040API_SERVER_ERRORThe API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: createaccountrole