openapi: 3.2.0
info:
  version: v1
  title: Prisma Cloud REST API Doc AWS Logging Accounts API
  contact: {}
  license:
    name: Public
  description: To ingest the VPC flow logs from Amazon S3 buckets to Prisma Cloud, you need an AWS logging account. If you need flow logs ingestion, after onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The APIs in this category can be used to configure and manage these logging accounts.
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: AWS Logging Accounts
  description: To ingest the VPC flow logs from Amazon S3 buckets to Prisma Cloud, you need an AWS logging account. If you need flow logs ingestion, after onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The APIs in this category can be used to configure and manage these logging accounts.
paths:
  /v1/cloudAccounts/awsLoggingAccounts:
    get:
      tags:
      - AWS Logging Accounts
      summary: Get all AWS Logging Accounts
      description: Get the list of all the AWS Logging accounts and its details.
      operationId: getLoggingArchiveAccounts
      parameters:
      - name: awsPartition
        in: query
        description: AWS Partition Name (optional)
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successfully retrieved list of accounts
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/LoggingArchiveAccountModel'
        '204':
          description: No logging archive accounts exists for customer
        '401':
          description: Unauthorized Access
      security:
      - x-redlock-auth: []
      x-public: 'true'
    post:
      tags:
      - AWS Logging Accounts
      summary: Add AWS Logging Account
      description: Add new AWS logging account.
      operationId: saveLoggingAccount
      requestBody:
        $ref: '#/components/requestBodies/LoggingArchiveAccountModel'
      responses:
        '200':
          description: successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/LoggingArchiveAccountModel'
        '201':
          description: Successfully created account
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/cft:
    post:
      tags:
      - AWS Logging Accounts
      summary: Generate a New CFT Template
      description: Dynamically generate a CFT for the AWS Logging Account.
      operationId: generate-log-account-cft
      requestBody:
        $ref: '#/components/requestBodies/LoggingAccountCFTRequest'
      responses:
        '200':
          description: success
        '400':
          description: bad_request
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/permissionsStatus:
    post:
      tags:
      - AWS Logging Accounts
      summary: Get Logging Account Status
      description: Get the status of the AWS logging account based on filter criteria such as, ID, name, RoleRN, and bucket.
      operationId: checkLoggingAccountStatus
      requestBody:
        $ref: '#/components/requestBodies/LoggingArchiveAccountModel'
      responses:
        '200':
          description: Successfully completed status check for logging account
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/CloudAccountStatus'
        '401':
          description: Unauthorized Access
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{accountId}:
    get:
      tags:
      - AWS Logging Accounts
      summary: Get Logging Account By ID
      description: Get details of a logging account by ID.
      operationId: getLoggingArchiveAccount
      parameters:
      - name: accountId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successfully retrieved account
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/LoggingArchiveAccountModel'
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
        '404':
          description: Account not found
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{accountId}/buckets/{bucketName}:
    delete:
      tags:
      - AWS Logging Accounts
      summary: Delete an S3 bucket
      description: Delete an S3 bucket in a logging account.
      operationId: deleteBucket
      parameters:
      - name: accountId
        in: path
        description: AWS Logging Account ID
        required: true
        schema:
          type: string
      - name: bucketName
        in: path
        description: AWS S3 Bucket Name
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/BucketModel'
        '204':
          description: Successfully deleted bucket
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
        '404':
          description: Account or bucket not found.
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{accountId}/cft:
    get:
      tags:
      - AWS Logging Accounts
      summary: Regenerate CFT for an Existing Account
      description: Dynamically generate a CFT for an existing Log Account.
      operationId: generate-log-account-cft-existing
      parameters:
      - name: accountId
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
        '400':
          description: bad_request
        '404':
          description: Account or bucket not found.
      security:
      - x-redlock-auth: []
      x-public: 'true'
    post:
      tags:
      - AWS Logging Accounts
      summary: Regenerate CFT for New RoleName
      description: Regenerate a new CFT for an existing logging account if roleName changes.
      operationId: generate-log-account-cft-role
      parameters:
      - name: accountId
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/LoggingAccountCFTRequest'
      responses:
        '200':
          description: success
        '400':
          description: bad_request
        '404':
          description: Account or bucket not found.
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{accountId}/role/{roleName}/externalId:
    get:
      tags:
      - AWS Logging Accounts
      summary: Get External ID of an Account
      description: Get external ID of an AWS Logging Accountby account ID and rolename.
      operationId: 'Get External ID '
      parameters:
      - name: accountId
        in: path
        description: AWS AccountId
        required: true
        schema:
          type: string
      - name: roleName
        in: path
        description: AWS Role Name
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
        '400':
          description: bad_request
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}:
    put:
      tags:
      - AWS Logging Accounts
      summary: Update Logging Account
      description: Update details of the logging account.
      operationId: updateLoggingAccount
      parameters:
      - name: loggingAccountId
        in: path
        description: AWS Logging Account ID
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/LoggingArchiveAccountModel'
      responses:
        '204':
          description: No content
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
      security:
      - x-redlock-auth: []
      x-public: 'true'
    delete:
      tags:
      - AWS Logging Accounts
      summary: Delete a Logging Account by ID
      description: Delete an AWS logging account based on account ID.
      operationId: deleteLoggingAccount
      parameters:
      - name: loggingAccountId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No content
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/buckets:
    get:
      tags:
      - AWS Logging Accounts
      summary: List S3 Bucket Names
      description: Get a list of all the S3 bucket names associated to a logging account.
      operationId: getBuckets
      parameters:
      - name: loggingAccountId
        in: path
        description: AWS Logging Account ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successfully retrieved buckets
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: object
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
        '404':
          description: Account not found
      security:
      - x-redlock-auth: []
      x-public: 'true'
    post:
      tags:
      - AWS Logging Accounts
      summary: Add an S3 bucket
      description: Add an S3 bucket to the existing logging account.
      operationId: saveBucket
      parameters:
      - name: loggingAccountId
        in: path
        description: AWS Logging Account ID
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/BucketModel'
      responses:
        '200':
          description: Successfully saved bucket
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/BucketModel'
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
        '404':
          description: Account not found.
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/buckets/{bucketName}:
    get:
      tags:
      - AWS Logging Accounts
      summary: Get all S3 Buckets
      description: Get the list of all S3 bucket and its details associated with a logging account.
      operationId: getBucketDetails
      parameters:
      - name: loggingAccountId
        in: path
        required: true
        schema:
          type: string
      - name: bucketName
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successfully retrieved bucket
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/BucketModel'
        '401':
          description: Unauthorized Access
        '404':
          description: Resource not found
      security:
      - x-redlock-auth: []
      x-public: 'true'
    put:
      tags:
      - AWS Logging Accounts
      summary: Update S3 Bucket Details
      description: Update details of an S3 bucket associated to a specific logging account.
      operationId: updateBucket
      parameters:
      - name: loggingAccountId
        in: path
        description: AWS Logging Account ID
        required: true
        schema:
          type: string
      - name: bucketName
        in: path
        description: AWS S3 Bucket Name
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/BucketModel'
      responses:
        '200':
          description: Successfully updated bucket
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/BucketModel'
        '400':
          description: Bad Request. Data validation failed.
        '401':
          description: Unauthorized Access
        '404':
          description: Account or bucket not found.
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /v1/cloudAccounts/awsLoggingAccounts/{loggingAccountId}/permissionsStatus:
    get:
      tags:
      - AWS Logging Accounts
      summary: Get Logging Account Status - GET
      description: Get status of a logging account based on ID.
      operationId: getLoggingAccountStatus
      parameters:
      - name: loggingAccountId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: List of logging account statuses
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: object
        '400':
          description: Invalid parameter
        '401':
          description: Unauthorized Access
        '404':
          description: Account not found
      security:
      - x-redlock-auth: []
      x-public: 'true'
    post:
      tags:
      - AWS Logging Accounts
      summary: Get Logging Account Status - POST
      description: 'Get detailed status of a logging account based on ID, name, roleRN or bucket name. '
      operationId: checkLoggingAccountStatusForProvidedAccount
      parameters:
      - name: loggingAccountId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/LoggingArchiveAccountModel'
      responses:
        '200':
          description: Successfully completed status check for existing logging account
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/CloudAccountStatus'
        '400':
          description: Invalid parameter
        '401':
          description: Unauthorized Access
        '404':
          description: Logging Account doesn't exist
      security:
      - x-redlock-auth: []
      x-public: 'true'
components:
  schemas:
    CloudAccountStatus:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        statusMessage:
          $ref: '#/components/schemas/AccountStatusMessage'
    LoggingAccountCFTRequest:
      type: object
      properties:
        awsPartition:
          type: string
        externalId:
          type: string
        loggingAccountId:
          type: string
        loggingAccountRoleName:
          type: string
        trustedEntity:
          type: string
        partitionName:
          type: string
          enum:
          - US_GLOBAL
          - US_GOV
          - CHINA
        loggingAccountBuckets:
          type: array
          items:
            $ref: '#/components/schemas/BucketModel'
    LoggingArchiveAccountModel:
      type: object
      required:
      - externalId
      - loggingAccountBuckets
      - loggingAccountId
      - loggingAccountName
      - loggingAccountRoleArn
      - loggingAccountRoleName
      - status
      properties:
        loggingAccountId:
          type: string
          description: CSP Cloud Account Id
        loggingAccountName:
          type: string
          description: Account Name
        loggingAccountRoleName:
          type: string
          description: Account Role Name
          readOnly: true
        loggingAccountRoleArn:
          type: string
          description: Account Role ARN
        externalId:
          type: string
          description: External Id for Account
          readOnly: true
        status:
          type: string
          description: Account status
          readOnly: true
        loggingAccountBuckets:
          type: string
          description: List of buckets associated with account
      description: Logging Archive Account Model
    BucketModel:
      type: object
      required:
      - bucketName
      - bucketRegion
      - loggingAccountId
      properties:
        bucketName:
          type: string
          description: S3 Bucket Name
        bucketRegion:
          type: string
          description: S3 Bucket Region
        bucketPathPrefixes:
          type: string
          description: Bucket Path Prefixes
        keyArn:
          type: string
          description: CMS Key ARN
        loggingAccountId:
          type: integer
          format: int32
          description: Log Archive Account Id
        featureMap:
          type: object
          description: Monitored account and bucket purpose details
          additionalProperties:
            type: array
            items:
              type: string
        lastUpdatedTs:
          type: integer
          format: int64
          description: Last Updated Timestamp
      description: Model for S3 Bucket
    AccountStatusMessage:
      type: object
      properties:
        message:
          type: string
        staticMessage:
          type: boolean
  requestBodies:
    LoggingArchiveAccountModel:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/LoggingArchiveAccountModel'
    LoggingAccountCFTRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/LoggingAccountCFTRequest'
      description: Logging Account CFT
      required: true
    BucketModel:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BucketModel'
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey