---
title: "Create an AWS cloud authentication intake mapping"
method: POST
path: "/api/v2/wif/aws/intake_mapping"
tags: ["Cloud Authentication"]
---

# Create an AWS cloud authentication intake mapping

`POST /api/v2/wif/aws/intake_mapping`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/wif/aws/intake_mapping`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/wif/aws/intake_mapping/post.ts> (a function with typed inputs; its response is checked against the schema)

Create an AWS cloud authentication intake mapping to authorize an AWS ARN pattern for Agent authentication. The AWS account must already be integrated with Datadog, and managed API key rotation must be enabled for the organization. Patterns that conflict with existing intake or persona mappings are rejected.

## Request body

- AWSCloudAuthIntakeMappingCreateRequest: Request used to create an AWS cloud authentication intake mapping.
  - `data` AWSCloudAuthIntakeMappingCreateData, required: Data for creating an AWS cloud authentication intake mapping.
    - `attributes` AWSCloudAuthIntakeMappingCreateAttributes, required: Attributes for creating an AWS cloud authentication intake mapping.
      - `arn_pattern` string, required: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions.
    - `type` 'aws_cloud_auth_intake_mapping', required: Type identifier for AWS cloud authentication intake mapping.

## Response `201`

Created

- AWSCloudAuthIntakeMappingResponse: Response containing a single AWS cloud authentication intake mapping.
  - `data` AWSCloudAuthIntakeMappingDataResponse, required: Data for AWS cloud authentication intake mapping response.
    - `attributes` AWSCloudAuthIntakeMappingAttributesResponse, required: Attributes for AWS cloud authentication intake mapping response.
      - `arn_pattern` string, required: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions.
      - `par_enrollment_enabled` boolean: Whether the mapping allows Private Action Runner enrollment. This attribute may be omitted when enrollment is disabled. Enrollment permission is managed separately from the ARN pattern.
    - `id` string, required: Unique identifier for the intake mapping.
    - `type` 'aws_cloud_auth_intake_mapping', required: Type identifier for AWS cloud authentication intake mapping.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)