Support for Cross-Account Role Authentication

[POST] /qps/rest/2.0/create/am/awsassetdataconnector

Creates an AWS asset data connector using Cross-Account Role Authentication.

Qualys supports the creation of EC2 connectors using a cross-account access role. This allows you to grant Qualys access to your AWS EC2 instances without sharing your AWS security credentials. Qualys will access your AWS EC2 instances by assuming the IAM role that you create in your AWS account.

To get started you’ll need an IAM role created using your AWS account.You can update your existing EC2 connectors to now use cross-account access roles. Note that this migration of your existing EC2 connector to cross account role is unidirectional and cannot be reverted.

You can create only one connector for each unique AWS account. It’s recommended that you merge multiple EC2 connectors into one by removing duplicate connectors before you upgrade to ARN.

Permissions required - Managers with full scope.

Sample 1 - Create a new connectorSample 1 - Create a new connector

Create connector when you already have the ARN generated from your AWS account

API request

curl -u "USERNAME:PASSWORD" -H "Content-type: text/xml" -X "POST"
--data-binary @- "<qualys_base_url>/qps/rest/2.0/create/am/awsassetdataconnector" < file.xml
Note: "file.xml" contains the request POST data.

Request POST data

<?xml version="1.0" encoding="UTF-8" ?>
<ServiceRequest>
    <data>
        <AwsAssetDataConnector>
            <name>user_john</name>
            <arn>arn:aws:iam::705355653965:role/ARN_UPGRADE</arn>
            <externalId>pod13-xxxxxx-xxxxx</externalId>
            <endpoints>
                <add>
                    <AwsEndpointSimple>
                        <regionCode>ap-south-1</regionCode>
                    </AwsEndpointSimple>
                </add>
            </endpoints>
            <disabled>false</disabled>
        </AwsAssetDataConnector>
    </data>
</ServiceRequest>

Response

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://qualysapi.qualys.com/qps/xsd/2.0/am/aws_asset_data_connector.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <AwsAssetDataConnector>
            <id>19803</id>
            <name>user_john</name>
            <awsAccountId>205767712438</awsAccountId>
            <connectorState>QUEUED</connectorState>
            <type>AWS</type>
            <defaultTags>
                <list/>
            </defaultTags>
            <activation>
                <list/>
            </activation>
            <disabled>false</disabled>
            <isGovCloudConfigured>false</isGovCloudConfigured>
            <isChinaConfigured>false</isChinaConfigured>
            <arn>arn:aws:iam::705355653965:role/ARN_UPGRADE</arn>
            <externalId>pod13-xxxxxx-xxxxx</externalId>
            <qualysAwsAccountId>383031258652</qualysAwsAccountId>
            <endpoints>
                <list>
                    <AwsEndpointSimple>
                        <regionCode>ap-south-1</regionCode>
                    </AwsEndpointSimple>
                </list>
            </endpoints>
            <allRegions>false</allRegions>
        </AwsAssetDataConnector>
    </data>
</ServiceResponse>

Sample 2 - Create a new connector when you want to provide the ARN laterSample 2 - Create a new connector when you want to provide the ARN later

If you have dependencies and cannot provide the ARN at the time of creation, you could always provide the ARN at a later stage. In this case, the AWS connector is created with an INCOMPLETE state.

API request

curl -u "USERNAME:PASSWORD" -H "Content-type: text/xml" -X "POST"
--data-binary @- "<qualys_base_url>/qps/rest/2.0/create/am/awsassetdataconnector" < file.xml
Note: "file.xml" contains the request POST data.

Request POST data (file.xml)

<?xml version="1.0" encoding="UTF-8"?>
<ServiceRequest>
    <data>
        <AwsAssetDataConnector>
            <name>user_john</name>
            <endpoints>
                <add>
                    <AwsEndpointSimple>
                        <regionCode>ap-south-1</regionCode>
                    </AwsEndpointSimple>
                </add>
            </endpoints>
            <disabled>false</disabled>
        </AwsAssetDataConnector>
    </data>
</ServiceRequest>

XML output

<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://qualysapi.qualys.com/qps/xsd/2.0/am/aws_asset_data_connector.xsd">
    <responseCode>SUCCESS</responseCode>
    <count>1</count>
    <data>
        <AwsAssetDataConnector>
            <id>19201</id>
            <name>my-aws-connector</name>
            <awsAccountId>205767712438</awsAccountId>
            <connectorState>INCOMPLETE</connectorState>
            <type>AWS</type>
            <defaultTags>
                <list/>
            </defaultTags>
            <activation>
                <list/>
            </activation>
            <disabled>false</disabled>
            <isGovCloudConfigured>false</isGovCloudConfigured>
            <externalId>pod13-xxxxxx-xxxxx</externalId>
            <qualysAwsAccountId>383031258652</qualysAwsAccountId>
            <endpoints>
                <list>
                    <AwsEndpointSimple>
                        <regionCode>ap-south-1</regionCode>
                    </AwsEndpointSimple>
                </list>
            </endpoints>
            <allRegions>false</allRegions>
        </AwsAssetDataConnector>
    </data>
</ServiceResponse>

XSD

<platform API server>/qps/xsd/2.0/am/aws_asset_data-connector.xsd