mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-30 15:24:22 +00:00
docs(api): use mintlify for API specs
This commit is contained in:
pedrooot committed
1 parent
f831171a21
commit
77089eba57
136 files changed
+23969
No files matched your search
@@ -0,0 +1,266 @@
|
||||
---
|
||||
title: "Create Provider Secret"
|
||||
api: "POST /api/v1/providers/secrets"
|
||||
description: "Add credentials/secrets to authenticate with a cloud provider."
|
||||
---
|
||||
|
||||
Configure authentication credentials for a cloud provider. This endpoint stores the necessary secrets (API keys, role ARNs, service account keys) to allow Prowler to scan your cloud infrastructure.
|
||||
|
||||
## Use Cases
|
||||
|
||||
- **AWS Role Assumption**: Configure IAM role ARN for cross-account access
|
||||
- **Azure Service Principal**: Store client ID, client secret, and tenant ID
|
||||
- **GCP Service Account**: Upload service account JSON key
|
||||
- **Static Credentials**: Store API keys or access keys (not recommended for production)
|
||||
|
||||
## Request Body
|
||||
|
||||
The request follows the JSON:API specification:
|
||||
|
||||
```json
|
||||
{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"attributes": {
|
||||
"name": "Production AWS Credentials",
|
||||
"secret_type": "role",
|
||||
"secret": {
|
||||
"role_arn": "arn:aws:iam::123456789012:role/ProwlerRole",
|
||||
"external_id": "unique-external-id"
|
||||
}
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Attributes
|
||||
|
||||
- `name` (optional, string, nullable) - Descriptive name for the secret (3-100 characters)
|
||||
- `secret_type` (required, enum) - Type of secret:
|
||||
- `role` - IAM role assumption (AWS)
|
||||
- `service_account` - Service account key (GCP)
|
||||
- `static` - Static key-value pairs (API keys, credentials)
|
||||
- `secret` (required, object) - The actual secret data (varies by secret_type)
|
||||
|
||||
### Secret Types and Formats
|
||||
|
||||
**AWS Role (`role`):**
|
||||
```json
|
||||
{
|
||||
"secret": {
|
||||
"role_arn": "arn:aws:iam::123456789012:role/ProwlerRole",
|
||||
"external_id": "your-external-id"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**GCP Service Account (`service_account`):**
|
||||
```json
|
||||
{
|
||||
"secret": {
|
||||
"service_account_key": "{\"type\":\"service_account\",\"project_id\":\"my-project\",...}"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Azure Service Principal (`static`):**
|
||||
```json
|
||||
{
|
||||
"secret": {
|
||||
"client_id": "aaaabbbb-cccc-dddd-eeee-ffff00001111",
|
||||
"client_secret": "your-client-secret",
|
||||
"tenant_id": "tenant-uuid"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Static Credentials (`static`):**
|
||||
```json
|
||||
{
|
||||
"secret": {
|
||||
"access_key_id": "AKIAIOSFODNN7EXAMPLE",
|
||||
"secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Example Requests
|
||||
|
||||
### AWS Role Assumption
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/providers/secrets" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json" \
|
||||
-d '{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role",
|
||||
"secret_type": "role",
|
||||
"secret": {
|
||||
"role_arn": "arn:aws:iam::123456789012:role/ProwlerRole",
|
||||
"external_id": "prowler-external-id-12345"
|
||||
}
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### GCP Service Account
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/providers/secrets" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json" \
|
||||
-d '{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"attributes": {
|
||||
"name": "GCP Service Account",
|
||||
"secret_type": "service_account",
|
||||
"secret": {
|
||||
"service_account_key": "{\"type\":\"service_account\",\"project_id\":\"my-project-123\",\"private_key_id\":\"key-id\",\"private_key\":\"-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----\\n\",\"client_email\":\"prowler@my-project.iam.gserviceaccount.com\",\"client_id\":\"123456789\",\"auth_uri\":\"https://accounts.google.com/o/oauth2/auth\",\"token_uri\":\"https://oauth2.googleapis.com/token\"}"
|
||||
}
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
## Response
|
||||
|
||||
### Success Response (201 Created)
|
||||
|
||||
Returns the created secret metadata (sensitive data is not returned):
|
||||
|
||||
```json
|
||||
{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role",
|
||||
"secret_type": "role",
|
||||
"inserted_at": "2024-01-15T10:30:00Z",
|
||||
"updated_at": "2024-01-15T10:30:00Z"
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Response Fields
|
||||
|
||||
- `id` (UUID) - Unique identifier for the secret
|
||||
- `name` (string, nullable) - Descriptive name (3-100 characters)
|
||||
- `secret_type` (enum) - Type: `role`, `service_account`, or `static`
|
||||
- `inserted_at` (datetime, read-only) - Creation timestamp
|
||||
- `updated_at` (datetime, read-only) - Last modification timestamp
|
||||
|
||||
### Error Responses
|
||||
|
||||
**400 Bad Request** - Invalid secret format
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "400",
|
||||
"title": "Invalid Secret Format",
|
||||
"detail": "Role ARN format is invalid"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**404 Not Found** - Provider does not exist
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "404",
|
||||
"title": "Provider Not Found",
|
||||
"detail": "Provider with ID 'provider-uuid' not found"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**422 Unprocessable Entity** - Validation error
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "422",
|
||||
"title": "Validation Error",
|
||||
"detail": "secret_type is required",
|
||||
"source": {
|
||||
"pointer": "/data/attributes/secret_type"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
After creating a secret:
|
||||
|
||||
1. **Test Connection**: Verify the credentials work
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/providers/{provider_id}/connection" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY"
|
||||
```
|
||||
|
||||
2. **Run First Scan**: Execute a security scan
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/scans" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-d '{"data": {"type": "scans", "attributes": {"provider_id": "provider-uuid"}}}'
|
||||
```
|
||||
|
||||
<Warning>
|
||||
**Security Critical:**
|
||||
- Secrets are encrypted at rest in Prowler's database
|
||||
- Use role assumption (AWS) or service accounts (GCP) instead of static credentials
|
||||
- Never log or expose secret values
|
||||
- Rotate credentials regularly
|
||||
- Use least-privilege IAM policies
|
||||
- For AWS, always use an external ID for role assumption
|
||||
</Warning>
|
||||
|
||||
<Note>
|
||||
The secret data itself is never returned in API responses after creation. Only metadata about the secret is accessible via the API.
|
||||
</Note>
|
||||
|
||||
<Tip>
|
||||
**AWS Best Practice:** Create a dedicated IAM role with the `SecurityAudit` managed policy and a trust relationship allowing Prowler to assume it. Use an external ID for additional security.
|
||||
</Tip>
|
||||
@@ -0,0 +1,73 @@
|
||||
---
|
||||
title: "Delete Provider Secret"
|
||||
api: "DELETE /api/v1/providers/secrets/{id}"
|
||||
description: "Remove a provider secret permanently."
|
||||
---
|
||||
|
||||
Delete a provider secret. This removes the credentials used to authenticate with a cloud provider.
|
||||
|
||||
## Path Parameters
|
||||
|
||||
- `id` (required) - UUID of the secret to delete
|
||||
|
||||
## Example Request
|
||||
|
||||
```bash
|
||||
curl -X DELETE "https://api.prowler.com/api/v1/providers/secrets/{id}" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json"
|
||||
```
|
||||
|
||||
## Response
|
||||
|
||||
### Success Response (204 No Content)
|
||||
|
||||
Returns no content on successful deletion.
|
||||
|
||||
### Error Responses
|
||||
|
||||
**404 Not Found** - Secret does not exist
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "404",
|
||||
"title": "Not Found",
|
||||
"detail": "Secret not found"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**409 Conflict** - Secret is in use
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "409",
|
||||
"title": "Secret In Use",
|
||||
"detail": "Cannot delete secret that is currently associated with an active provider. Remove the provider first or update it to use different credentials."
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
<Warning>
|
||||
**Deleting a secret will:**
|
||||
- Immediately prevent Prowler from accessing the cloud provider
|
||||
- Stop all scheduled scans for the associated provider
|
||||
- Make it impossible to run new scans until new credentials are added
|
||||
|
||||
This action cannot be undone.
|
||||
</Warning>
|
||||
|
||||
<Note>
|
||||
Before deleting a secret, ensure:
|
||||
- The provider is no longer needed, OR
|
||||
- New credentials have been added and tested, OR
|
||||
- The provider has been deleted or updated to use different credentials
|
||||
</Note>
|
||||
|
||||
<Tip>
|
||||
Instead of deleting a secret when rotating credentials, use the update endpoint to replace the old credentials with new ones. This ensures zero downtime.
|
||||
</Tip>
|
||||
@@ -0,0 +1,133 @@
|
||||
---
|
||||
title: "List Provider Secrets"
|
||||
api: "GET /api/v1/providers/secrets"
|
||||
description: "Retrieve a list of all provider secrets with filtering options."
|
||||
---
|
||||
|
||||
Retrieve metadata about all provider secrets. Note that the actual secret values are never returned - only metadata such as names, types, and timestamps.
|
||||
|
||||
## Query Parameters
|
||||
|
||||
### Filtering
|
||||
|
||||
- `filter[provider]`, `filter[provider__in]` - Filter by provider UUID(s)
|
||||
- `filter[secret_type]`, `filter[secret_type__in]` - Filter by type: `static`, `role`, `service_account`
|
||||
- `filter[name]`, `filter[name__icontains]` - Filter by secret name
|
||||
|
||||
### Pagination
|
||||
|
||||
- `page[number]` - Page number to retrieve (default: 1)
|
||||
- `page[size]` - Number of results per page (default: 20, max: 100)
|
||||
|
||||
### Sorting
|
||||
|
||||
- `sort` - Field to sort by:
|
||||
- `inserted_at` - Oldest first
|
||||
- `-inserted_at` - Newest first (default)
|
||||
- `name` - Alphabetically
|
||||
- `-name` - Reverse alphabetically
|
||||
|
||||
### Field Selection
|
||||
|
||||
- `fields[provider-secrets]` - Specify which fields to return: `inserted_at`, `updated_at`, `name`, `secret_type`, `provider`
|
||||
|
||||
### Include Related Resources
|
||||
|
||||
- `include` - Include related resources: `provider`
|
||||
|
||||
## Example Request
|
||||
|
||||
```bash
|
||||
curl -X GET "https://api.prowler.com/api/v1/providers/secrets?filter[secret_type]=role&include=provider" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json"
|
||||
```
|
||||
|
||||
## Response
|
||||
|
||||
### Success Response (200 OK)
|
||||
|
||||
Returns a paginated list of secret metadata:
|
||||
|
||||
```json
|
||||
{
|
||||
"data": [
|
||||
{
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid-1",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role",
|
||||
"secret_type": "role",
|
||||
"inserted_at": "2024-01-15T10:30:00Z",
|
||||
"updated_at": "2024-01-15T10:30:00Z"
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid-2",
|
||||
"attributes": {
|
||||
"name": "GCP Service Account",
|
||||
"secret_type": "service_account",
|
||||
"inserted_at": "2024-01-10T08:15:00Z",
|
||||
"updated_at": "2024-01-10T08:15:00Z"
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid-2"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"meta": {
|
||||
"page": {
|
||||
"number": 1,
|
||||
"size": 20,
|
||||
"total": 2,
|
||||
"total_pages": 1
|
||||
}
|
||||
},
|
||||
"links": {
|
||||
"self": "https://api.prowler.com/api/v1/providers/secrets?page[number]=1",
|
||||
"first": "https://api.prowler.com/api/v1/providers/secrets?page[number]=1",
|
||||
"last": "https://api.prowler.com/api/v1/providers/secrets?page[number]=1"
|
||||
},
|
||||
"included": [
|
||||
{
|
||||
"type": "providers",
|
||||
"id": "provider-uuid",
|
||||
"attributes": {
|
||||
"provider": "aws",
|
||||
"uid": "123456789012",
|
||||
"alias": "Production AWS - US"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Response Fields
|
||||
|
||||
- `id` (UUID) - Unique identifier for the secret
|
||||
- `name` (string, nullable) - Descriptive name (3-100 characters)
|
||||
- `secret_type` (enum) - Type: `role`, `service_account`, or `static`
|
||||
- `inserted_at` (datetime, read-only) - When secret was created
|
||||
- `updated_at` (datetime, read-only) - Last modification time
|
||||
|
||||
<Note>
|
||||
Secret values are never returned via the API. Only metadata about secrets is accessible.
|
||||
</Note>
|
||||
|
||||
<Warning>
|
||||
Regularly audit your secrets list to identify and remove unused credentials.
|
||||
</Warning>
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
title: "Retrieve Provider Secret"
|
||||
api: "GET /api/v1/providers/secrets/{id}"
|
||||
description: "Fetch metadata about a specific provider secret by its ID."
|
||||
---
|
||||
|
||||
Retrieve metadata about a specific provider secret. The actual secret values are never returned - only information about the secret.
|
||||
|
||||
## Path Parameters
|
||||
|
||||
- `id` (required) - The UUID of the secret to retrieve
|
||||
|
||||
## Query Parameters
|
||||
|
||||
### Field Selection
|
||||
|
||||
- `fields[provider-secrets]` - Specify which fields to return: `inserted_at`, `updated_at`, `name`, `secret_type`, `provider`
|
||||
|
||||
### Include Related Resources
|
||||
|
||||
- `include` - Include related resources: `provider`
|
||||
|
||||
## Example Request
|
||||
|
||||
```bash
|
||||
curl -X GET "https://api.prowler.com/api/v1/providers/secrets/{id}?include=provider" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json"
|
||||
```
|
||||
|
||||
## Response
|
||||
|
||||
### Success Response (200 OK)
|
||||
|
||||
Returns secret metadata:
|
||||
|
||||
```json
|
||||
{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role",
|
||||
"secret_type": "role",
|
||||
"inserted_at": "2024-01-15T10:30:00Z",
|
||||
"updated_at": "2024-01-15T10:30:00Z"
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"included": [
|
||||
{
|
||||
"type": "providers",
|
||||
"id": "provider-uuid",
|
||||
"attributes": {
|
||||
"provider": "aws",
|
||||
"uid": "123456789012",
|
||||
"alias": "Production AWS - US"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Response Fields
|
||||
|
||||
- `id` (UUID) - Unique identifier for the secret
|
||||
- `name` (string, nullable) - Descriptive name (3-100 characters)
|
||||
- `secret_type` (enum) - Type: `role`, `service_account`, or `static`
|
||||
- `inserted_at` (datetime, read-only) - When secret was created
|
||||
- `updated_at` (datetime, read-only) - Last modification time
|
||||
|
||||
### Error Responses
|
||||
|
||||
**404 Not Found** - Secret does not exist
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "404",
|
||||
"title": "Not Found",
|
||||
"detail": "Secret not found"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
<Note>
|
||||
Secret values are never returned via the API. If you need to update credentials, use the update endpoint with new secret data.
|
||||
</Note>
|
||||
@@ -0,0 +1,168 @@
|
||||
---
|
||||
title: "Update Provider Secret"
|
||||
api: "PATCH /api/v1/providers/secrets/{id}"
|
||||
description: "Update a provider secret's credentials or metadata."
|
||||
---
|
||||
|
||||
Update an existing provider secret. This is typically used to rotate credentials or update the secret name.
|
||||
|
||||
## Path Parameters
|
||||
|
||||
- `id` (required) - UUID of the secret to update
|
||||
|
||||
## Request Body
|
||||
|
||||
```json
|
||||
{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"name": "Updated Secret Name",
|
||||
"secret": {
|
||||
"role_arn": "arn:aws:iam::123456789012:role/NewProwlerRole",
|
||||
"external_id": "new-external-id"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Attributes
|
||||
|
||||
- `name` (optional, string, nullable) - Update the secret name (3-100 characters)
|
||||
- `secret` (optional, object) - Update the secret data (format depends on secret_type)
|
||||
- `secret_type` (read-only) - Cannot be changed after creation
|
||||
|
||||
<Note>
|
||||
The `secret_type` cannot be changed. If you need a different secret type, create a new secret and delete the old one.
|
||||
</Note>
|
||||
|
||||
## Example Requests
|
||||
|
||||
### Update AWS Role ARN
|
||||
```bash
|
||||
curl -X PATCH "https://api.prowler.com/api/v1/providers/secrets/{id}" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json" \
|
||||
-d '{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role - Rotated",
|
||||
"secret": {
|
||||
"role_arn": "arn:aws:iam::123456789012:role/ProwlerRoleV2",
|
||||
"external_id": "prowler-external-id-67890"
|
||||
}
|
||||
}
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Update Azure Credentials
|
||||
```bash
|
||||
curl -X PATCH "https://api.prowler.com/api/v1/providers/secrets/{id}" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-H "Content-Type: application/vnd.api+json" \
|
||||
-d '{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"secret": {
|
||||
"client_id": "aaaabbbb-cccc-dddd-eeee-ffff00001111",
|
||||
"client_secret": "new-rotated-client-secret",
|
||||
"tenant_id": "tenant-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
## Response
|
||||
|
||||
### Success Response (200 OK)
|
||||
|
||||
Returns the updated secret metadata:
|
||||
|
||||
```json
|
||||
{
|
||||
"data": {
|
||||
"type": "provider-secrets",
|
||||
"id": "secret-uuid",
|
||||
"attributes": {
|
||||
"name": "Production AWS Role - Rotated",
|
||||
"secret_type": "role",
|
||||
"inserted_at": "2024-01-15T10:30:00Z",
|
||||
"updated_at": "2024-01-20T14:45:00Z"
|
||||
},
|
||||
"relationships": {
|
||||
"provider": {
|
||||
"data": {
|
||||
"type": "providers",
|
||||
"id": "provider-uuid"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Error Responses
|
||||
|
||||
**400 Bad Request** - Invalid secret format
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "400",
|
||||
"title": "Invalid Secret Format",
|
||||
"detail": "Role ARN format is invalid"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**404 Not Found** - Secret does not exist
|
||||
```json
|
||||
{
|
||||
"errors": [
|
||||
{
|
||||
"status": "404",
|
||||
"title": "Not Found",
|
||||
"detail": "Secret not found"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
After updating credentials:
|
||||
|
||||
1. **Test Connection**: Verify the new credentials work
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/providers/{provider_id}/connection" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY"
|
||||
```
|
||||
|
||||
2. **Run Scan**: Confirm scanning works with new credentials
|
||||
```bash
|
||||
curl -X POST "https://api.prowler.com/api/v1/scans" \
|
||||
-H "Authorization: Bearer YOUR_API_KEY" \
|
||||
-d '{"data": {"type": "scans", "attributes": {"provider_id": "provider-uuid"}}}'
|
||||
```
|
||||
|
||||
<Warning>
|
||||
**Credential Rotation Best Practices:**
|
||||
- Test new credentials before updating in production
|
||||
- Keep old credentials valid until confirming new ones work
|
||||
- Update secrets during maintenance windows
|
||||
- Verify connection status after updates
|
||||
- Monitor for authentication failures in scans
|
||||
</Warning>
|
||||
|
||||
<Tip>
|
||||
When rotating AWS roles, create the new role first, update the secret, test it, then delete the old role to ensure zero downtime.
|
||||
</Tip>
|
||||
Reference in new issue
Block a user