---
title: "Create or update an AWS account role"
method: POST
path: "/core/v1/cloudconnect/aws/accounts"
tags: ["Cloud Connect"]
---

# Create or update an AWS account role

`POST /core/v1/cloudconnect/aws/accounts`

Creates or updates a CloudConnect document for an AWS account.
Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents
or require a CloudFormation stack ID.

## Request body

- object
  - `accountID` string, required — The AWS account ID.
  - `roleArn` string, required — The ARN of the IAM role created for DoiT access.
  - `s3Bucket` string — S3 bucket name for CloudTrail real-time anomaly detection. Required together with s3BucketRegion.
  - `s3BucketRegion` string — AWS region of the S3 bucket. Required together with s3Bucket.
  - `enabledFeatures` string[], required — Declares which supported AWS features the caller intends to enable. Values must match feature names configured in awsFeaturePermissions on app/cloud-connect. The value is persisted and returned in account responses. When "real-time-data" is included, s3Bucket and s3BucketRegion are required; when it is not included, s3Bucket and s3BucketRegion are not allowed.

## Response `200`

OK - Role created/updated successfully.

- AwsAccountResponse
  - `accountID` string — The AWS account ID.
  - `roleArn` string — The ARN of the IAM role.
  - `s3Bucket` string — S3 bucket name for real-time anomaly detection. Present only if real-time is enabled.
  - `s3BucketRegion` string — AWS region of the S3 bucket. Present only if s3Bucket exists.
  - `supportedFeatures` AwsSupportedFeature[] — List of supported features and their permission status.
    - `name` string — Feature name.
    - `hasRequiredPermissions` boolean — Whether the role has the required permissions for this feature.
  - `enabledFeatures` string[] — List of supported AWS features enabled by the caller. Returned in the same order as provided.
  - `timeLinked` string — ISO 8601 timestamp of when the role was linked.

## Other responses

- `400` — Bad Request - The server cannot process the request, often due to a malformed request.
- `401` — Unauthorized - Invalid API key.
- `403` — Forbidden - The client is not authorized to perform the request.
- `409` — Conflict - Account already exists.
- `500` — Internal Server Error - Something went wrong with the DoiT API server.

---

[API](https://skmtc.dev/doit/apis/doit-cloud-intelligence.md) · [All operations](https://skmtc.dev/doit/apis/doit-cloud-intelligence/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/doit/doit-cloud-intelligence/revisions/9416402fc119/schema)