Add Cloud Accounts Using Cloudaware API

Cloudaware uses OAuth to authenticate requests to the Cloudaware API. This guide explains how to add cloud accounts to Cloudaware using External APIs.

Prerequisites

Before you begin, make sure you have:

Administrator access to Cloudaware.
A Google Cloud account. A free trial account can be used.
A Google Cloud project approved by Cloudaware Support for access to the Cloudaware External API.
Cloud account details required by the selected API request, such as account identifiers, authentication or role details, usage type, and display name.

During this guide, you will generate:

A long-lived Cloudaware OAuth token.
A Google Cloud API key for the approved project.

Get an OAuth Token

Log in to Cloudaware → Admin.
In the left menu, select OAUTH → +CREATE NEW TOKEN → CREATE TOKEN.

note
You might be redirected to a Force.com page to grant access to Cloudaware OAuth 2.0. Click Allow to continue.
Click Copy To Clipboard to copy the token, and store it securely.
Click GOT IT, CLOSE WINDOW to proceed.
To revoke a token, click the three dots → Revoke → Yes, Revoke.
To generate another token, click +CREATE NEW TOKEN.
If your environment has IP restrictions, update the OAuth policy settings as described below.

warning

You can have 4 active tokens at a time. The Use Count column shows how many times each token has been used.

IP Relaxation Tip

Log in to Cloudaware → Setup.
Type Apps in the search bar, then go to Connected Apps → Manage Connected Apps and click the Cloudaware OAuth 2.0 app.
Click Edit Policies.
In IP Relaxation, select Relax IP restrictions.
Click Save.

Get a Google Cloud API Key

An API key is required to send requests to the Cloudaware API.

Create a Google Cloud account.
Create a Google Cloud project.
Submit an access request to Cloudaware Support at support@cloudaware.com, including the full email address of the associated Google Cloud account.
Get the confirmation from the Cloudaware Support team that API access has been granted before proceeding with the next step.
Activate API access:
- Go to Google Cloud Console.
- Open the navigation menu → APIs & Services → Library.
- Filter by Private.
Select external.endpoints.cloudaware-vm.cloud.goog → Enable.
Go back to APIs & Services → Credentials → Create Credentials → API Key.
Select the external.endpoints.cloudaware-vm.cloud.goog API in the API restrictions dropdown. Click Create.
Copy the API key to your clipboard.

Set Up API Explorer

The Google APIs Explorer allows you to explore and test APIs.

Open Google APIs Explorer.
Click the gear icon → Set API key / OAuth 2.0 Client ID.
Paste the API key, leave OAuth 2.0 Client ID blank, and click Save.
Go to Services → External API v1 → select external.amazon.account.create to add AWS accounts to Cloudaware.

Fill out the form.

Use the following values:

Field	Value
`token`	Paste the OAuth token generated earlier. Select fields in Request body to match the sample below.
`sandbox`	Select `true` if your Salesforce org is a sandbox. Otherwise, select `false`.
`Request body`	Specify the `role`, `name` and `usage` properties.

Sample request body without values:

{
  "role": {
    "externalId": "<external_id>",
    "roleArn": "arn:aws:iam::<account_id>:role/<role_name>",
    "trustedAccount": {
      "accountId": "<trusted_account_id>",
      "partition": "<partition>"
    }
  },
  "name": "<account_name>",
  "usages": []
}

Where:

role.externalId: External ID for the Cloudaware Collector. Leave unset if you haven’t generated one in Cloudaware Admin UI.
role.roleArn: Full ARN of the IAM role you create in the AWS account being onboarded. Format: arn:aws:iam::<account_id>:role/<role_name>.
role.trustedAccount.accountId: The Cloudaware account ID used for role assumption. The account ID is 814021343637 for the aws partition and 321683528484 for the aws-us-gov partition. You can verify the account ID in the Mappings section of the Cloudaware CloudFormation template.
role.trustedAccount.partition: Almost always "aws" for standard commercial AWS accounts. Only changes to "aws-cn" if an account lives in AWS China, or "aws-us-gov" if it's in GovCloud.
name: A display name for this account as it will show up in Cloudaware, for example, Prod - US-East.
usages: Specifies the basic ("COLLECTOR") and add-on ("MONITORING", "ELM", and "CONFLUX") functionality to enable for the AWS account added to Cloudaware. If left blank, "COLLECTOR" is set by default.

Click Authorize and Execute.

List of APIs

The following APIs are available:

external.amazon.accounts.create
external.amazon.accounts.list
external.amazon.accounts.remove
external.amazon.accounts.update
external.applications.batch.upsert
external.applications.list
external.applications.remove
external.applications.tiers.remove
external.azure.activeDirectories.create
external.azure.activeDirectories.list
external.azure.activeDirectories.remove
external.azure.activeDirectories.update
external.azure.applications.list
external.azure.applications.remove
external.azure.applications.update
external.azure.subscriptions.create
external.azure.subscriptions.list
external.azure.subscriptions.remove
external.azure.subscriptions.update
external.compliance.policies.executeTests
external.compliance.policies.generate
external.compliance.schema.list
external.compliance.types.filter
external.compliance.types.get
external.compliance.types.list
external.incidents.create
external.newRelic.accounts.create
external.newRelic.accounts.getAll
external.newRelic.accounts.remove
external.newRelic.accounts.rotateApiKey
external.newRelic.accounts.update
external.session.create
external.tunhub.tunnels.getAll
external.tunhub.tunnels.routes.getAll
external.tunhub.tunnels.swapChannels
external.tunhub.tunnels.update

Prerequisites​

Get an OAuth Token​

IP Relaxation Tip​

Get a Google Cloud API Key​

Set Up API Explorer​

List of APIs​