---
updatedAt: 2025-09-16T00:21:51.000Z
agentTools:
projectIndex: https://docs.cgn.portal.checkpoint.com/llms.txt
---
# Post
Add a new AWS cloud account to CloudGuard
Onboarding an AWS cloud account manually (legacy method) requires CloudGuard to obtain permissions to access the account.
For more information, see the procedure on the onboarding with API on the Secure Knowledge center:
How to onboard an AWS account to CloudGuard using the REST API
# OpenAPI definition
```json
{
"info": {
"title": "Onboarding",
"version": "v2"
},
"openapi": "3.0.0",
"servers": [
{
"url": "https://api.dome9.com/",
"description": "US region"
},
{
"url": "https://api.{region}.dome9.com/",
"description": "Other regions",
"variables": {
"region": {
"enum": [
"eu1",
"ap1",
"ap2",
"ap3",
"cace1"
],
"default": "eu1"
}
}
}
],
"paths": {
"/v2/CloudAccounts": {
"post": {
"tags": [
"Aws Cloud Account"
],
"summary": "Post",
"operationId": "CloudAccounts_Post_post_/v2/CloudAccounts",
"responses": {
"201": {
"description": "Created",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountViewModel"
}
}
}
}
},
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountViewModel"
}
},
"application/x-www-form-urlencoded": {
"schema": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountViewModel"
}
}
},
"description": "The new AWS account data",
"required": true
},
"description": "Add a new AWS cloud account to CloudGuard
\r\nOnboarding an AWS cloud account manually (legacy method) requires CloudGuard to obtain permissions to access the account.
\r\nFor more information, see the procedure on the onboarding with API on the Secure Knowledge center:
How to onboard an AWS account to CloudGuard using the REST API"
}
}
},
"components": {
"schemas": {
"Dome9.Web.Api.Models.CloudAccountRegionConfigurationViewModel": {
"type": "object",
"properties": {
"region": {
"description": "[Required] Dome9 representation value for the AWS region",
"enum": [
"us_east_1",
"us_west_1",
"eu_west_1",
"ap_southeast_1",
"ap_northeast_1",
"us_west_2",
"sa_east_1",
"az_1_region_a_geo_1",
"az_2_region_a_geo_1",
"az_3_region_a_geo_1",
"ap_southeast_2",
"mellanox_region",
"us_gov_west_1",
"eu_central_1",
"ap_northeast_2",
"ap_south_1",
"us_east_2",
"ca_central_1",
"eu_west_2",
"eu_west_3",
"eu_north_1",
"cn_north_1",
"cn_northwest_1",
"us_gov_east_1",
"ap_east_1",
"me_south_1",
"af_south_1",
"eu_south_1",
"ap_northeast_3",
"me_central_1",
"ap_south_2",
"ap_southeast_3",
"ap_southeast_4",
"eu_central_2",
"eu_south_2",
"il_central_1",
"ca_west_1",
"mx_central_1",
"ap_southeast_5",
"ap_southeast_7",
"westus",
"eastus",
"eastus2",
"northcentralus",
"westus2",
"southcentralus",
"centralus",
"usgovlowa",
"usgovvirginia",
"northeurope",
"westeurope",
"eastasia",
"southeastasia",
"japaneast",
"japanwest",
"brazilsouth",
"australiaeast",
"australiasoutheast",
"centralindia",
"southindia",
"westindia",
"canadaeast",
"westcentralus",
"chinaeast",
"chinanorth",
"canadacentral",
"germanycentral",
"germanynortheast",
"koreacentral",
"uksouth",
"ukwest",
"koreasouth",
"francecentral",
"francesouth",
"germanywestcentral",
"usdodcentral",
"usdodeast",
"usgovarizona",
"usgovtexas",
"australiacentral",
"australiacentral2",
"chinaeast2",
"chinanorth2",
"southafricanorth",
"southafricawest",
"uaecentral",
"uaenorth",
"ussecwest",
"usseceast",
"germanynorth",
"switzerlandwest",
"norwaywest",
"norwayeast",
"switzerlandnorth",
"westus3",
"swedencentral",
"chinanorth3",
"brazilsoutheast",
"eastus2euap",
"jioindiawest",
"jioindiacentral",
"qatarcentral",
"spaincentral",
"italynorth",
"polandcentral",
"mexicocentral",
"asia",
"asia_east1",
"asia_northeast1",
"asia_south1",
"asia_southeast1",
"australia_southeast1",
"europe",
"europe_north1",
"europe_west1",
"europe_west2",
"europe_west3",
"europe_west4",
"northamerica_northeast1",
"southamerica_east1",
"us",
"us_central1",
"us_east1",
"us_east4",
"us_west1",
"us_west2",
"global",
"asia_east2",
"eur4",
"nam4",
"europe_west6",
"japan_west",
"asia_northeast2",
"asia_northeast3",
"us_west3",
"us_west4",
"asia_southeast2",
"nam3",
"nam5",
"nam6",
"nam7",
"nam10",
"nam_eur_asia1",
"eur3",
"eur5",
"asia1",
"nam11",
"eu",
"northamerica_northeast2",
"southamerica_west1",
"us_east5",
"us_south1",
"europe_central2",
"europe_southwest1",
"europe_west8",
"europe_west9",
"europe_west10",
"europe_west12",
"asia_south2",
"australia_southeast2",
"me_central1",
"me_central2",
"me_west1",
"ap_sydney_1",
"ap_melbourne_1",
"sa_saopaulo_1",
"sa_vinhedo_1",
"ca_montreal_1",
"ca_toronto_1",
"sa_santiago_1",
"eu_paris_1",
"eu_marseille_1",
"eu_frankfurt_1",
"ap_hyderabad_1",
"ap_mumbai_1",
"il_jerusalem_1",
"eu_milan_1",
"ap_osaka_1",
"ap_tokyo_1",
"mx_queretaro_1",
"eu_amsterdam_1",
"me_jeddah_1",
"ap_singapore_1",
"af_johannesburg_1",
"ap_seoul_1",
"ap_chuncheon_1",
"eu_madrid_1",
"eu_stockholm_1",
"eu_zurich_1",
"me_abudhabi_1",
"me_dubai_1",
"uk_london_1",
"uk_cardiff_1",
"us_ashburn_1",
"us_phoenix_1",
"us_sanjose_1",
"us_gov_ashburn_1",
"us_gov_chicago_1",
"us_gov_phoenix_1",
"us_langley_1",
"us_luke_1",
"uk_gov_london_1",
"uk_gov_cardiff_1",
"sa_bogota_1",
"us_chicago_1",
"sa_valparaiso_1",
"mx_monterrey_1",
"eu_jovanovac_1",
"ap_singapore_2"
],
"type": "string"
},
"name": {
"description": "[Readonly] The region name",
"type": "string"
},
"hidden": {
"description": "[Deprecated]",
"type": "boolean"
},
"newGroupBehavior": {
"description": "[Required] The Protection Mode that Dome9 will apply to new security groups detected in the cloud account.
ReadOnly New Security Groups will be included in Dome9 in Read-Only mode, without changes to any of the rules
FullManage New Security Groups will be included in Dome9 in Full Protection mode, without changes to any of the rules
Reset New Security Groups will be included in Dome9 in Full Protection mode, and all inbound and outbound rules will be cleared",
"enum": [
"ReadOnly",
"FullManage",
"Reset"
],
"type": "string"
}
}
},
"Dome9.Web.Api.Models.CloudAccountCredentialsViewModel": {
"type": "object",
"properties": {
"apikey": {
"description": "[Deprecated]",
"type": "string"
},
"arn": {
"description": "[Required] AWS Role ARN (to be assumed by Dome9 System)",
"type": "string"
},
"secret": {
"description": "[Required] The AWS role External ID (Dome9 System will have to use this secret in order to assume the role)",
"type": "string"
},
"iamUser": {
"description": "[Deprecated]",
"type": "string"
},
"type": {
"description": "[Required] The cloud account onbiarding method. Should be set to \"RoleBased\" as other methods are deprecated",
"enum": [
"UserBased",
"RoleBased"
],
"type": "string"
},
"isReadOnly": {
"description": "[Readonly] The credential permission state.\r\nThis filed is determined based on the operation response status performed by Dome9 on the target AWS cloud account.",
"type": "boolean"
}
}
},
"Dome9.Web.Api.Models.CloudAccountViewModel": {
"type": "object",
"properties": {
"id": {
"format": "uuid",
"description": "[Readonly] The Dome9 id",
"type": "string",
"example": "00000000-0000-0000-0000-000000000000"
},
"vendor": {
"description": "[Readonly] The cloud provider (AWS)",
"enum": [
"aws",
"hp",
"mellanox",
"awsgov",
"azure",
"google",
"awschina",
"azuregov",
"kubernetes",
"azurechina",
"terraform",
"generic",
"kubernetesruntimeassurance",
"shiftleft",
"sourcecodeassurance",
"imageassurance",
"alibaba",
"cft",
"containerregistry",
"oci",
"ocigov",
"ocigovuk",
"CIEM"
],
"type": "string"
},
"name": {
"description": "The cloud account name",
"type": "string"
},
"externalAccountNumber": {
"description": "[Readonly] The AWS account number",
"type": "string"
},
"error": {
"description": "[Readonly] credentials error status",
"type": "string"
},
"isFetchingSuspended": {
"description": "[Readonly] fetching suspending status",
"type": "boolean"
},
"creationDate": {
"format": "date-time",
"description": "[Readonly] account creation date",
"type": "string"
},
"credentials": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountCredentialsViewModel",
"description": "[Required] The information needed for Dome9 System in order to connect to the AWS cloud account"
},
"iamSafe": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountIamSafeViewModel",
"description": "[Readonly] The IamSafety configuration of the AWS cloud account"
},
"netSec": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountNetSecViewModel",
"description": "[Readonly] The network security configuration for the AWS cloud account."
},
"magellan": {
"description": "[Readonly] Flag to determine if Magellan is enabled/disabled for the account",
"type": "boolean"
},
"fullProtection": {
"description": "[Required] As part of the AWS account onboarding, the account security groups are imported. \r\nThis flag determines whether to enable Tamper Protection mode for those security groups.",
"type": "boolean"
},
"allowReadOnly": {
"description": "[Required] Determines the AWS cloud account operation mode.\r\nFor \"Manage\" set to true, for \"Readonly\" set to false.",
"type": "boolean"
},
"organizationId": {
"description": "The unique identifier (ID) of an AWS organization. E.g. 9w9xc7rq7p",
"type": "string"
},
"organizationalUnitId": {
"format": "uuid",
"type": "string",
"example": "00000000-0000-0000-0000-000000000000"
},
"organizationalUnitPath": {
"type": "string"
},
"organizationalUnitName": {
"type": "string"
},
"lambdaScanner": {
"description": "Flag indicating if lambda scanner is enabled/disabled for the account",
"type": "boolean"
},
"serverless": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.SeverlessConfigViewModel"
},
"onboardingMode": {
"enum": [
"Undefined",
"Legacy",
"CloudGuardManaged",
"CustomerManaged"
],
"type": "string"
}
}
},
"Dome9.Web.Api.Models.CloudAccountIamSafeViewModel": {
"type": "object",
"properties": {
"awsGroupArn": {
"type": "string"
},
"awsPolicyArn": {
"type": "string"
},
"mode": {
"enum": [
"OptIn",
"Mandatory"
],
"type": "string"
},
"state": {
"enum": [
"Enabled",
"Disabled"
],
"type": "string"
},
"excludedIamEntities": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountIamSafeIamEntitiesViewModel"
},
"restrictedIamEntities": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountIamSafeIamEntitiesViewModel"
}
}
},
"Dome9.Web.Api.Models.CloudAccountNetSecViewModel": {
"type": "object",
"properties": {
"regions": {
"description": "List of network security configuration per AWS region",
"type": "array",
"items": {
"$ref": "#/components/schemas/Dome9.Web.Api.Models.CloudAccountRegionConfigurationViewModel"
}
}
}
},
"Dome9.Web.Api.Models.SeverlessConfigViewModel": {
"type": "object",
"properties": {
"codeAnalyzerEnabled": {
"type": "boolean"
},
"codeDependencyAnalyzerEnabled": {
"type": "boolean"
}
}
},
"Dome9.Web.Api.Models.CloudAccountIamSafeIamEntitiesViewModel": {
"type": "object",
"properties": {
"rolesArns": {
"type": "array",
"items": {
"type": "string"
}
},
"usersArns": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"securitySchemes": {
"basic": {
"type": "http",
"scheme": "basic"
}
}
},
"security": [
{
"basic": []
}
],
"x-readme": {
"explorer-enabled": true,
"proxy-enabled": true
}
}
```