Cloud Connect AWS

deprecated

The Cloud Connect AWS service collection has been superseded by the CSPM Registration service collection and is now deprecated. Developers should move code over to use the new operations available within the updated collection.

This service collection is deprecated.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
CreateOrUpdateAWSSettings create_or_update_aws_settings	Create or update Global Settings which are applicable to all provisioned AWS accounts
DeleteAWSAccounts delete_aws_accounts	Delete a set of AWS Accounts by specifying their IDs
GetAWSAccounts get_aws_accounts	Retrieve a set of AWS Accounts by specifying their IDs
GetAWSSettings get_aws_settings	Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts
ProvisionAWSAccounts provision_aws_accounts	Provision AWS Accounts by specifying details about the accounts to provision
QueryAWSAccounts query_aws_accounts	Search for provisioned AWS Accounts by providing an FQL filter and paging details.
QueryAWSAccountsForIDs query_aws_accounts_for_ids	Search for provisioned AWS Accounts by providing an FQL filter and paging details.
UpdateAWSAccounts update_aws_accounts	Update AWS Accounts by specifying the ID of the account and details to update
VerifyAWSAccountAccess verify_aws_account_access	Performs an Access Verification check on the specified AWS Account IDs

---

CreateOrUpdateAWSSettings

Create or update Global Settings which are applicable to all provisioned AWS accounts

Method POST

Route /cloud-connect-aws/entities/settings/v1

Scope AWS accounts: WRITE

PEP 8 create_or_update_aws_settings

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cloudtrail_bucket_owner_id body · string

AWS IAM ID for bucket owner.

static_external_id body · string

AWS cross-account role secret.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.create_or_update_aws_settings(cloudtrail_bucket_owner_id="string",
                                                static_external_id="string")
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateOrUpdateAWSSettings(cloudtrail_bucket_owner_id="string",
                                            static_external_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cloudtrail_bucket_owner_id": "string",
            "static_external_id": "string"
        }
    ]
}

response = falcon.command("CreateOrUpdateAWSSettings", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudtrail_bucket_owner_id := "string"
  static_external_id := "string"

  response, err := client.CloudConnectAws.CreateOrUpdateAWSSettings(
    &cloud_connect_aws.CreateOrUpdateAWSSettingsParams{
      Body: &models.ModelsModifyAWSCustomerSettingsV1{
        Resources: []interface{}{
          {
          CloudtrailBucketOwnerID: &cloudtrail_bucket_owner_id,
          StaticExternalID: &static_external_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.createOrUpdateAWSSettings(
  {
    resources: [{
        cloudtrailBucketOwnerId: "string",
        staticExternalId: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::create_or_update_aws_settings;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsModifyAwsCustomerSettingsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsModifyAwsCustomerSettingsV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = create_or_update_aws_settings(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

body = Falcon::ModelsModifyAWSCustomerSettingsV1.new(
  resources: [{
      cloudtrail_bucket_owner_id: 'string',
      static_external_id: 'string'
    }]
)

response = api.create_or_update_aws_settings(body)

puts response

Responses

201 Created

[
  {
    "cloudtrail_bucket_owner_id": "string",
    "created_timestamp": "string",
    "last_modified_timestamp": "string",
    "static_external_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloudtrail_bucket_owner_id": "string",
      "created_timestamp": "string",
      "last_modified_timestamp": "string",
      "static_external_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloudtrail_bucket_owner_id": "string",
      "created_timestamp": "string",
      "last_modified_timestamp": "string",
      "static_external_id": "string"
    }
  ]
}

---

---

DeleteAWSAccounts

Delete a set of AWS Accounts by specifying their IDs

Method DELETE

Route /cloud-connect-aws/entities/accounts/v1

Scope AWS accounts: WRITE

PEP 8 delete_aws_accounts

Parameters

ids query · string or list of strings

IDs of accounts to remove

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_accounts(ids=id_list)
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAWSAccounts(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAWSAccounts",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudConnectAws.DeleteAWSAccounts(
    &cloud_connect_aws.DeleteAWSAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.deleteAWSAccounts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::delete_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_aws_accounts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.delete_aws_accounts(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetAWSAccounts

Retrieve a set of AWS Accounts by specifying their IDs

Method GET

Route /cloud-connect-aws/entities/accounts/v1

Scope AWS accounts: READ

PEP 8 get_aws_accounts

Parameters

ids query · string or list of strings

IDs of accounts to retrieve details

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_accounts(ids=id_list)
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAWSAccounts(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAWSAccounts",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudConnectAws.GetAWSAccounts(
    &cloud_connect_aws.GetAWSAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.getAWSAccounts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::get_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_aws_accounts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.get_aws_accounts(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "access_health": {},
    "alias": "string",
    "cid": "string",
    "cloudformation_stack_id": "string",
    "cloudformation_url": "string",
    "cloudtrail_bucket_owner_id": "string",
    "cloudtrail_bucket_region": "string",
    "created_timestamp": "string",
    "external_id": "string",
    "iam_role_arn": "string",
    "id": "string",
    "last_modified_timestamp": "string",
    "last_scanned_timestamp": "string",
    "policy_version": "string",
    "provisioning_state": "string",
    "rate_limit_reqs": 0,
    "rate_limit_time": 0,
    "template_version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

---

---

GetAWSSettings

Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts

Method GET

Route /cloud-connect-aws/combined/settings/v1

Scope AWS accounts: READ

PEP 8 get_aws_settings

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_aws_settings()
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetAWSSettings()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAWSSettings")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudConnectAws.GetAWSSettings(
    &cloud_connect_aws.GetAWSSettingsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.getAWSSettings();

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::get_aws_settings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_aws_settings(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.get_aws_settings

puts response

Responses

200 OK

[
  {
    "cloudtrail_bucket_owner_id": "string",
    "created_timestamp": "string",
    "last_modified_timestamp": "string",
    "static_external_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloudtrail_bucket_owner_id": "string",
      "created_timestamp": "string",
      "last_modified_timestamp": "string",
      "static_external_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloudtrail_bucket_owner_id": "string",
      "created_timestamp": "string",
      "last_modified_timestamp": "string",
      "static_external_id": "string"
    }
  ]
}

---

---

ProvisionAWSAccounts

Provision AWS Accounts by specifying details about the accounts to provision

Method POST

Route /cloud-connect-aws/entities/accounts/v1

Scope AWS accounts: WRITE

PEP 8 provision_aws_accounts

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

mode query · string

Mode for provisioning. Allowed values are:

Available values (2)

cloudformation

manual

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

cloudtrail_bucket_owner_id body · string

AWS IAM ID for bucket owner.

cloudtrail_bucket_region body · string

AWS region for bucket.

external_id body · string

AWS cross-account role secret.

iam_role_arn body · string

ARN used for cross-account role.

id body · string

AWS account ID.

rate_limit_reqs body · integer

rate_limit_time body · integer

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.provision_aws_accounts(cloudtrail_bucket_owner_id="string",
                                         cloudtrail_bucket_region="string",
                                         external_id="string",
                                         iam_role_arn="string",
                                         id="string",
                                         mode="string",
                                         rate_limit_reqs=integer,
                                         rate_limit_time=integer)
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ProvisionAWSAccounts(cloudtrail_bucket_owner_id="string",
                                       cloudtrail_bucket_region="string",
                                       external_id="string",
                                       iam_role_arn="string",
                                       id="string",
                                       mode="string",
                                       rate_limit_reqs=integer,
                                       rate_limit_time=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cloudtrail_bucket_owner_id": "string",
            "cloudtrail_bucket_region": "string",
            "external_id": "string",
            "iam_role_arn": "string",
            "id": "string",
            "rate_limit_reqs": integer,
            "rate_limit_time": integer
        }
    ]
}

response = falcon.command("ProvisionAWSAccounts",
                          mode="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudtrail_bucket_owner_id := "string"
  cloudtrail_bucket_region := "string"
  external_id := "string"
  iam_role_arn := "string"
  id := "string"
  rate_limit_reqs := integer
  rate_limit_time := integer
  mode := "string"

  response, err := client.CloudConnectAws.ProvisionAWSAccounts(
    &cloud_connect_aws.ProvisionAWSAccountsParams{
      Body: &models.ModelsCreateAWSAccountsV1{
        Resources: []interface{}{
          {
          CloudtrailBucketOwnerID: &cloudtrail_bucket_owner_id,
          CloudtrailBucketRegion: &cloudtrail_bucket_region,
          ExternalID: &external_id,
          IamRoleArn: &iam_role_arn,
          ID: &id,
          RateLimitReqs: &rate_limit_reqs,
          RateLimitTime: &rate_limit_time,
          },
        },
      },
      Mode: &mode,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.provisionAWSAccounts(
  {  // body
      resources: [{
          cloudtrailBucketOwnerId: "string",
          cloudtrailBucketRegion: "string",
          externalId: "string",
          iamRoleArn: "string",
          id: "string",
          rateLimitReqs: integer,
          rateLimitTime: integer
        }]
  },
  "string"  // mode
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::provision_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateAwsAccountsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateAwsAccountsV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = provision_aws_accounts(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // mode
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

body = Falcon::ModelsCreateAWSAccountsV1.new(
  resources: [{
      cloudtrail_bucket_owner_id: 'string',
      cloudtrail_bucket_region: 'string',
      external_id: 'string',
      iam_role_arn: 'string',
      id: 'string',
      rate_limit_reqs: integer,
      rate_limit_time: integer
    }]
)

response = api.provision_aws_accounts(body)

puts response

Responses

201 Created

[
  {
    "access_health": {},
    "alias": "string",
    "cid": "string",
    "cloudformation_stack_id": "string",
    "cloudformation_url": "string",
    "cloudtrail_bucket_owner_id": "string",
    "cloudtrail_bucket_region": "string",
    "created_timestamp": "string",
    "external_id": "string",
    "iam_role_arn": "string",
    "id": "string",
    "last_modified_timestamp": "string",
    "last_scanned_timestamp": "string",
    "policy_version": "string",
    "provisioning_state": "string",
    "rate_limit_reqs": 0,
    "rate_limit_time": 0,
    "template_version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

---

---

QueryAWSAccounts

Search for provisioned AWS Accounts by providing an FQL filter and paging details.

Method GET

Route /cloud-connect-aws/combined/accounts/v1

Scope AWS accounts: READ

PEP 8 query_aws_accounts

Parameters

limit query · integer

The maximum records to return. [1-1000]. Defaults to 100.

offset query · integer

The offset to start retrieving records from

sort query · string

The property to sort by (e.g. alias.desc or state.asc).

filter query · string

The filter expression that should be used to limit the results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.query_aws_accounts(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.QueryAWSAccounts(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryAWSAccounts",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.CloudConnectAws.QueryAWSAccounts(
    &cloud_connect_aws.QueryAWSAccountsParams{
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.queryAWSAccounts(
  integer,  // limit
  integer,  // offset
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::query_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_aws_accounts(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.query_aws_accounts(limit: integer,
                                  offset: integer,
                                  sort: 'string',
                                  filter: 'string')

puts response

Responses

200 OK

[
  {
    "access_health": {},
    "alias": "string",
    "cid": "string",
    "cloudformation_stack_id": "string",
    "cloudformation_url": "string",
    "cloudtrail_bucket_owner_id": "string",
    "cloudtrail_bucket_region": "string",
    "created_timestamp": "string",
    "external_id": "string",
    "iam_role_arn": "string",
    "id": "string",
    "last_modified_timestamp": "string",
    "last_scanned_timestamp": "string",
    "policy_version": "string",
    "provisioning_state": "string",
    "rate_limit_reqs": 0,
    "rate_limit_time": 0,
    "template_version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

---

---

QueryAWSAccountsForIDs

Search for provisioned AWS Accounts by providing an FQL filter and paging details.

Method GET

Route /cloud-connect-aws/queries/accounts/v1

Scope AWS accounts: READ

PEP 8 query_aws_accounts_for_ids

Parameters

limit query · integer

The maximum records to return. [1-1000]. Defaults to 100.

offset query · integer

The offset to start retrieving records from

sort query · string

The property to sort by (e.g. alias.desc or state.asc).

filter query · string

The filter expression that should be used to limit the results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.query_aws_accounts_for_ids(filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.QueryAWSAccountsForIDs(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryAWSAccountsForIDs",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.CloudConnectAws.QueryAWSAccountsForIDs(
    &cloud_connect_aws.QueryAWSAccountsForIDsParams{
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.queryAWSAccountsForIDs(
  integer,  // limit
  integer,  // offset
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::query_aws_accounts_for_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_aws_accounts_for_ids(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.query_aws_accounts_for_ids(limit: integer,
                                          offset: integer,
                                          sort: 'string',
                                          filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

UpdateAWSAccounts

Update AWS Accounts by specifying the ID of the account and details to update

Method PATCH

Route /cloud-connect-aws/entities/accounts/v1

Scope AWS accounts: WRITE

PEP 8 update_aws_accounts

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cloudtrail_bucket_owner_id body · string

AWS IAM ID for bucket owner.

cloudtrail_bucket_region body · string

AWS region for bucket.

external_id body · string

AWS cross-account role secret.

iam_role_arn body · string

ARN used for cross-account role.

id body · string

AWS account ID.

rate_limit_reqs body · integer

rate_limit_time body · integer

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.update_aws_accounts(cloudtrail_bucket_owner_id="string",
                                      cloudtrail_bucket_region="string",
                                      external_id="string",
                                      iam_role_arn="string",
                                      id="string",
                                      rate_limit_reqs=integer,
                                      rate_limit_time=integer)
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.UpdateAWSAccounts(cloudtrail_bucket_owner_id="string",
                                    cloudtrail_bucket_region="string",
                                    external_id="string",
                                    iam_role_arn="string",
                                    id="string",
                                    rate_limit_reqs=integer,
                                    rate_limit_time=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cloudtrail_bucket_owner_id": "string",
            "cloudtrail_bucket_region": "string",
            "external_id": "string",
            "iam_role_arn": "string",
            "id": "string",
            "rate_limit_reqs": integer,
            "rate_limit_time": integer
        }
    ]
}

response = falcon.command("UpdateAWSAccounts", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudtrail_bucket_owner_id := "string"
  cloudtrail_bucket_region := "string"
  external_id := "string"
  iam_role_arn := "string"
  id := "string"
  rate_limit_reqs := integer
  rate_limit_time := integer

  response, err := client.CloudConnectAws.UpdateAWSAccounts(
    &cloud_connect_aws.UpdateAWSAccountsParams{
      Body: &models.ModelsUpdateAWSAccountsV1{
        Resources: []interface{}{
          {
          CloudtrailBucketOwnerID: &cloudtrail_bucket_owner_id,
          CloudtrailBucketRegion: &cloudtrail_bucket_region,
          ExternalID: &external_id,
          IamRoleArn: &iam_role_arn,
          ID: &id,
          RateLimitReqs: &rate_limit_reqs,
          RateLimitTime: &rate_limit_time,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.updateAWSAccounts(
  {
    resources: [{
        cloudtrailBucketOwnerId: "string",
        cloudtrailBucketRegion: "string",
        externalId: "string",
        iamRoleArn: "string",
        id: "string",
        rateLimitReqs: integer,
        rateLimitTime: integer
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::update_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsUpdateAwsAccountsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsUpdateAwsAccountsV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = update_aws_accounts(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

body = Falcon::ModelsUpdateAWSAccountsV1.new(
  resources: [{
      cloudtrail_bucket_owner_id: 'string',
      cloudtrail_bucket_region: 'string',
      external_id: 'string',
      iam_role_arn: 'string',
      id: 'string',
      rate_limit_reqs: integer,
      rate_limit_time: integer
    }]
)

response = api.update_aws_accounts(body)

puts response

Responses

200 OK

[
  {
    "access_health": {},
    "alias": "string",
    "cid": "string",
    "cloudformation_stack_id": "string",
    "cloudformation_url": "string",
    "cloudtrail_bucket_owner_id": "string",
    "cloudtrail_bucket_region": "string",
    "created_timestamp": "string",
    "external_id": "string",
    "iam_role_arn": "string",
    "id": "string",
    "last_modified_timestamp": "string",
    "last_scanned_timestamp": "string",
    "policy_version": "string",
    "provisioning_state": "string",
    "rate_limit_reqs": 0,
    "rate_limit_time": 0,
    "template_version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_health": {},
      "alias": "string",
      "cid": "string",
      "cloudformation_stack_id": "string",
      "cloudformation_url": "string",
      "cloudtrail_bucket_owner_id": "string",
      "cloudtrail_bucket_region": "string",
      "created_timestamp": "string",
      "external_id": "string",
      "iam_role_arn": "string",
      "id": "string",
      "last_modified_timestamp": "string",
      "last_scanned_timestamp": "string",
      "policy_version": "string",
      "provisioning_state": "string",
      "rate_limit_reqs": 0,
      "rate_limit_time": 0,
      "template_version": "string"
    }
  ]
}

---

---

VerifyAWSAccountAccess

Performs an Access Verification check on the specified AWS Account IDs

Method POST

Route /cloud-connect-aws/entities/verify-account-access/v1

Scope AWS accounts: WRITE

PEP 8 verify_aws_account_access

Parameters

ids query · string or list of strings

IDs of accounts to verify access on

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.verify_aws_account_access(ids=id_list)
print(response)

Operation ID

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.VerifyAWSAccountAccess(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("VerifyAWSAccountAccess",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_connect_aws"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudConnectAws.VerifyAWSAccountAccess(
    &cloud_connect_aws.VerifyAWSAccountAccessParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.verifyAWSAccountAccess(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_connect_aws_api::verify_aws_account_access;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = verify_aws_account_access(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudConnectAws.new

response = api.verify_aws_account_access(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "id": "string",
    "reason": "string",
    "successful": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "id": "string",
      "reason": "string",
      "successful": false
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "id": "string",
      "reason": "string",
      "successful": false
    }
  ]
}