Set up AWS access through an env zero environment

Creates a Cloud Compass draft and an “env zero aws roles” environment, in the “env zero setup” project of the given deployment credential, and deploys it with that credential. The plan waits for approval.

POST /aws-access-setups

Set up AWS access through an env zero environment

cURL

curl --request POST \
  --url https://api.env0.com/aws-access-setups \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "organizationId": "<string>",
  "deploymentCredentialId": "<string>",
  "includeCostData": true,
  "deployAccountIds": [
    "<string>"
  ],
  "deployRolePolicyArns": [
    "<string>"
  ],
  "deployRolePermissionsBoundaryArn": "<string>",
  "deployProjectIds": [
    "<string>"
  ],
  "deployTrustedPrincipalArn": "<string>",
  "organizationUnitIds": [
    "<string>"
  ]
}
'

200

{
  "setupId": "<string>",
  "organizationId": "<string>",
  "accountMode": "single",
  "includeCostData": true,
  "deployAccountIds": [
    "<string>"
  ],
  "deploySignInMethod": "oidc",
  "draftId": "<string>",
  "projectId": "<string>",
  "environmentId": "<string>",
  "deploymentLogId": "<string>",
  "status": "planning",
  "deployCredentials": [
    {
      "awsAccountId": "<string>",
      "credentialId": "<string>"
    }
  ],
  "deployRolePolicyArns": [
    "<string>"
  ],
  "deployRolePermissionsBoundaryArn": "<string>",
  "deployProjectIds": [
    "<string>"
  ],
  "deployTrustedPrincipalArn": "<string>",
  "planSummary": {
    "added": 123,
    "changed": 123,
    "destroyed": 123
  },
  "failure": {
    "phase": "plan",
    "message": "<string>"
  },
  "approvalsPending": true,
  "cloudCompassCredentialId": "<string>"
}

Authorizations

Authorization · string · header · required

env zero API authentication is done via API keys. An API Key can either be created by an organization administrator, in which case it will not be connected to any specific user, or via Personal API Keys to authenticate as a user.

Creating an API Key with a Specific Role

• Once you've created your organization, you can set up and manage API Keys.
• Navigate to the Organization Settings page and click the API Keys tab.
• Click Add API Key and enter a name for your key in the Name field. This name is for reference purposes only and isn't used directly in authentication.

❗️Save Your API Key ID and secret The secret will not be available after you close this window.

Creating a Personal API Key

• Click on your avatar (located on the top right of the screen)
• Click on Personal Settings
• Select the API Keys tab
• Click Add API Key, and enter a name for your key in the Name field. This name is for reference purposes and isn't used directly in authentication.

❗️Save your API Key ID & secret The secret will not be available after you close this window.

Using an API Key to Authenticate

Authentication of the env zero API is done using the Basic Authentication method. Each request made should include the API Key ID as the username, and the API Key secret as the password. For example, when using curl, we can include these parameters via flag --user {API Key ID}:{API Key Secret}.

API Key Permissions

When creating an API key through the organization settings, you will need to choose if you’d like to grant it Organization Admin or User permissions. In case of the latter, you can assign fine-grained permissions per project. Personal API Keys can be created through the user’s profile page and will have the same permissions as the user has.

Rate Limits

env zero API allows up to 1K requests per 60 seconds, requests are aggregated by IP, HTTP Method and URI. If you exceed this limit, you will receive a 429 status code.

Body

application/json

organizationId · string · required

deploymentCredentialId · string · required

An organization-level AWS_OIDC or AWS_ASSUMED_ROLE_FOR_DEPLOYMENT credential that deploys the setup.

Required string length: 1 - 128

accountMode · enum<string> · required

Available options: single, organization

includeCostData · boolean

Defaults to true. False skips the CUR 2.0 export and the cost sync.

signInMethod · enum<string>

How CloudQuery signs in to the Cloud Compass read role: assume_role (the default), with the tenant sync role and an External ID, or oidc, with the tenant's web identity.

Available options: assume_role, oidc

deployAccountIds · string[]

Organization mode only: member accounts that get a deploy role and a deployment credential.

Maximum array length: 200

Pattern: ^\d{12}$

deployRolePolicyArns · string[]

Organization mode only: AWS managed policy ARNs of the member accounts' deploy roles. Defaults to AdministratorAccess.

Required array length: 1 - 10 elements

deployRolePermissionsBoundaryArn · string

Organization mode only: a customer managed policy ARN, whose path and name each member account must have, as the deploy roles' permissions boundary.

deployProjectIds · string[]

Organization mode only, needed with deployAccountIds unless deployTrustedPrincipalArn is given: the env zero projects whose deployments may sign in to the deploy roles. AWS refuses any other project's deployments; adding a project means a Retry with the new list.

Maximum array length: 20

An env zero project ID, as the deploy roles' trust names it.

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

deployTrustedPrincipalArn · string

Organization mode only: the IAM role of the organization's self-hosted agent. The deploy roles then trust that role, with the organization ID as External ID, instead of env zero's OIDC tokens.

organizationUnitIds · string[]

Organization mode only: the OUs Cloud Compass reads, picked before the apply. Empty reads the whole Organization. With it, env zero creates the Cloud Compass credential once the apply finishes, as it does for one account; without it, the client picks the OUs then.

Maximum array length: 1000

Pattern: ^(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}|r-[0-9a-z]{4,32})$

Response

200 - application/json

setupId · string · required

The ID of the setup environment.

organizationId · string · required

accountMode · enum<string> · required

Available options: single, organization

includeCostData · boolean · required

deployAccountIds · string[] · required

Organization mode: the member accounts that get a deploy role.

Pattern: ^\d{12}$

deploySignInMethod · enum<string> · required

How deployments sign in to the deploy roles. oidc: env zero's OIDC tokens of the setup's projects. assume_role: the organization's self-hosted agent role.

Available options: oidc, assume_role

draftId · string · required

The Cloud Compass draft the environment creates the read role for.

projectId · string · required

environmentId · string · required

deploymentLogId · string · required

status · enum<string> · required

Where the setup environment is. done: the apply finished and env zero read its outputs, so the Cloud Compass draft can be verified.

Available options: planning, waiting_for_approval, applying, done, failed

deployCredentials · object[] · required

The deployment credentials registered from the outputs, one per member account.

Show child attributes

deployRolePolicyArns · string[]

Organization mode: the deploy roles' managed policies, when not AdministratorAccess.

deployRolePermissionsBoundaryArn · string

Organization mode: the deploy roles' permissions boundary.

deployProjectIds · string[]

Organization mode with OIDC deploy roles: the projects whose deployments may sign in to them.

deployTrustedPrincipalArn · string

Organization mode: the self-hosted agent role the deploy roles trust instead of OIDC tokens.

planSummary · object

Known once the plan ran.

Show child attributes

failure · object

Show child attributes

approvalsPending · boolean

waiting_for_approval only: env zero approved the plan, which still waits, so the setup project's approval policy needs more approvers. They approve it in env zero.

cloudCompassCredentialId · string

done only, on a read: the active Cloud Compass credential created from the draft, which outlives the draft.