Removing Intelligence from AWS Environments with API

Offboarding removes the SNS subscription between AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. and CloudGuard Intelligence. After the SNS subscription is removed Intelligence no longer receives data from CloudTrail or Flow Logs for that specific CloudGuard account.

Note - Offboarding does not delete the SNS topic, S3 Buckets, or S3 Event Notifications.

To offboard an AWS account from CloudGuard Intelligence, send the API request through an API platform, such as Postman, or use code to run the API request automatically.

Prerequisites

Important - If you did onboarding with a CloudFormation stack, you must first do the steps in "On your AWS account" in Removing Intelligence from AWS Environments

Before offboarding your AWS environments with API, make sure that you have prepared:

CloudGuard account information: API key and secret for your account, see V2 API.
AWS account information: ID of your AWS account (Account Number).
Make sure the AWS environment shows in your CloudGuard account. Go to Assets > Environments. If the selected environment is connected to CloudGuard Intelligence, then below Network Traffic or Account Activity a green check mark shows.

Notes:

Before you do these steps, it is necessary to remove the onboarded stack on your AWS account.
Offboarding from Intelligence is a full offboarding of all S3 buckets A bucket is a container for objects stored in Amazon S3 (Amazon Simple Storage Service). for network traffic and account activity.

To offboard manually with API

Request

POST /v2/view/magellan/disable-magellan-for-cloud-account

Copy

"cloudAccountId": "......"
"Vendor": "AWS"

For API documentation and code examples, see API Reference.

Authorization

Basic Authorization: Use the API key and secret as username and password.

Parameters

cloudAccountId - AWS account ID that contains the S3 bucket, which must be onboarded to CloudGuard Intelligence.
vendor - Name of the cloud provider.

Response

200 – OK

Offboarding Verification

When the offboarding is complete, make sure the subscription is removed from your AWS SNS topic.