Create Role | Eon Docs

curl -X POST https://{account-domain}.console.eon.io/api/v1/roles \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "name": "string",
  "permissionGrants": [
    {
      "permission": "inventory.view"
    }
  ]
}'

{
  "role": {
    "id": "daa42222-6ad2-5d37-bb26-4f2a9cba73da",
    "name": "My custom role",
    "isBuiltInRole": false,
    "permissionGrants": [
      {
        "permission": "inventory.view",
        "accessConditionId": "Non-PII only."
      }
    ],
    "accessConditions": [
      {
        "id": "Non-PII only",
        "effect": "INCLUSIVE",
        "expression": {
          "group": {
            "operator": "AND",
            "operands": [
              {
                "resourceType": {
                  "operator": "IN",
                  "resourceTypes": [
                    "AWS_EC2",
                    "AWS_RDS"
                  ]
                }
              },
              {
                "environment": {
                  "operator": "IN",
                  "environments": [
                    "PROD",
                    "PROD_INTERNAL"
                  ]
                }
              }
            ]
          },
          "resourceType": {
            "operator": "IN",
            "resourceTypes": [
              "AWS_EC2"
            ]
          },
          "dataClasses": {
            "operator": "CONTAINS_ANY_OF",
            "dataClasses": [
              "PII"
            ]
          },
          "environment": {
            "operator": "IN",
            "environments": [
              "PROD"
            ]
          },
          "apps": {
            "operator": "CONTAINS_ANY_OF",
            "apps": [
              "string"
            ]
          },
          "cloudProvider": {
            "operator": "IN",
            "cloudProviders": [
              "AWS"
            ]
          },
          "accountId": {
            "operator": "IN",
            "accountIds": [
              "string"
            ]
          },
          "sourceRegion": {
            "operator": "IN",
            "regions": [
              "string"
            ]
          },
          "vpc": {
            "operator": "IN",
            "vpcs": [
              "string"
            ]
          },
          "subnets": {
            "operator": "CONTAINS_ANY_OF",
            "subnets": [
              "string"
            ]
          },
          "resourceGroupName": {
            "operator": "IN",
            "resourceGroupNames": [
              "string"
            ]
          },
          "resourceName": {
            "operator": "CONTAINS",
            "resourceNames": [
              "string"
            ]
          },
          "resourceId": {
            "operator": "IN",
            "resourceIds": [
              "string"
            ]
          },
          "tagKeys": {
            "operator": "CONTAINS_ANY_OF",
            "tagKeys": [
              "string"
            ]
          },
          "tagKeyValues": {
            "operator": "CONTAINS_ANY_OF",
            "tagKeyValues": [
              {
                "key": "string",
                "value": "string"
              }
            ]
          }
        }
      }
    ],
    "restoreDestinationLimits": {
      "effect": "INCLUSIVE",
      "restoreAccountProviderIds": [
        "123456789012",
        "987654321098"
      ]
    }
  }
}

Creates a custom role.

When creating a role, you’ll specify a list of permissions and, optionally, data access conditions. Data access conditions let you restrict the resources a permission is granted for. For example, for a particular role, you can set data access conditions to allow access only to resources without PII.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.

namestringRequired

Role display name. Must be unique in your Eon account.

permissionGrantslist of objectsRequired

Permissions granted by the role.

accessConditionslist of objectsOptional

If present, the ID of the set of access conditions that restrict the resources the permission is granted for. The ID must be present in an entry in accessConditions, and the permission itself must support access conditions. If omitted, the permission is granted for all resources.

restoreDestinationLimitsobjectOptional

Limits the restore accounts that can be used as restore destinations for operations granted by the role.

Response

Role created.

roleobject

Role.

Errors

400

Bad Request Error

409

Conflict Error