create_account_role
Creates or updates a CloudConnect document for an AWS account by providing the IAM role ARN and declaring which features to enable. Supports optional S3 bucket configuration for real-time anomaly detection.
Instructions
Manage cloud provider connections and check feature availability for connected accounts. Creates or updates a CloudConnect document for an AWS account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents or require a CloudFormation stack ID.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| roleArn | Yes | The ARN of the IAM role created for DoiT access. | |
| s3Bucket | No | S3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion. | |
| accountID | Yes | The AWS account ID. | |
| s3BucketRegion | No | AWS region of the S3 bucket. Required together with s3Bucket. | |
| customerContext | No | Scope the request to a specific customer by ID. Required for DoiT employees (whose token isn't tied to a single customer); omit for direct customer users. | |
| enabledFeatures | Yes | Declares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When "real-time-data" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed. |