Create cloud onboarding deployment Experimental; added in 9.5.0

POST /api/fleet/cloud_onboarding_deployments
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/cloud_onboarding_deployments

Refer to Spaces for more information.

Create a new Fleet cloud onboarding deployment.

[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • authMethod string

    Authentication method for managed integrations.

    Values are identity_federation or static_keys.

  • connectorId string

    ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.

    Minimum length is 1, maximum length is 255.

  • dataFormat string

    Data format: ecs or otel.

    Values are ecs or otel.

  • globalRegion string

    Global AWS region from the Service Settings step.

    Maximum length is 64.

  • mechanisms array[string] Required

    Delivery mechanisms active in this deployment.

    Not more than 10 elements. Values are managed_integration, ecf, or agent_based.

  • provider string Required

    Cloud provider.

    Values are aws, azure, or gcp.

  • services array[string] Required

    Service IDs to be covered by this deployment.

    At least 1 but not more than 1000 elements. Minimum length of each is 1.

  • serviceVars object

    Per-service config keyed by instance ID.

    Hide serviceVars attribute Show serviceVars attribute object
    • * object Additional properties

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • item object Required

      Additional properties are NOT allowed.

      Hide item attributes Show item attributes object
      • agentPolicyId string

        Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.

      • apiKeyId string

        Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.

      • attemptCount number Required

        Number of deployment attempts, including the current one.

        Minimum value is 1.

      • authMethod string

        Authentication method for managed integrations.

        Values are identity_federation or static_keys.

      • connectorId string

        ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.

      • dataFormat string

        Data format: ecs or otel.

        Values are ecs or otel.

      • deploymentId string

        Opaque deployment identifier; for AWS, the CFN stack ARN.

      • deploymentName string

        Opaque deployment name; for AWS, the CFN stack name.

      • ecfStacks array[object]

        ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.

        Not more than 10 elements.

        Hide ecfStacks attributes Show ecfStacks attributes object
        • family string Required

          ECF template family.

          Values are unified, otel, or crowdstrike.

        • stackName string Required

          CloudFormation stack name (128-char AWS limit).

          Minimum length is 1, maximum length is 128.

        • templateVersion string Required

          ECF semantic version resolved at launch time, e.g. "1.10.0".

          Minimum length is 1, maximum length is 32.

      • globalRegion string

        Global AWS region from the Service Settings step.

      • id string Required
      • mechanisms array[string] Required

        Delivery mechanism: managed_integration, ecf, or agent_based.

        Not more than 10 elements. Values are managed_integration, ecf, or agent_based.

      • packagePolicyIds array[string]

        Package policy IDs created for managed_integration services.

        Not more than 100 elements.

      • provider string Required

        Cloud provider.

        Values are aws, azure, or gcp.

      • services array[string] Required

        Service IDs covered by this deployment.

        Not more than 1000 elements.

      • serviceVars object

        Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.

        Hide serviceVars attribute Show serviceVars attribute object
        • * object Additional properties
      • status string Required

        Deployment status.

        Values are pending, deploying, succeeded, or failed.

      • statusMessage string

        Error context when status is failed.
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/cloud_onboarding_deployments 
curl \
 --request POST 'https://localhost:5601/api/fleet/cloud_onboarding_deployments' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "agent_based"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics"
  ],
  "serviceVars": {
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1"
      ]
    }
  }
}'
Request examples
Create a new AWS cloud onboarding deployment using an Elastic Agent (agent-based) 
{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "agent_based"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics"
  ],
  "serviceVars": {
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1"
      ]
    }
  }
}
Create a new AWS cloud onboarding deployment using Elastic Cloud Forwarder (ECF) 
{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "ecf"
  ],
  "provider": "aws",
  "services": [
    "cloudfront_logs"
  ],
  "serviceVars": {
    "cloudfront_logs": {
      "regions": [
        "us-east-1"
      ],
      "s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
    }
  }
}
Create a new AWS cloud onboarding deployment using identity federation (managed integration) 
{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "managed_integration"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics",
    "cloudtrail"
  ],
  "serviceVars": {
    "cloudtrail": {
      "regions": [
        "us-east-1"
      ],
      "s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
    },
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1",
        "eu-west-1"
      ]
    }
  }
}
Response examples (200)
Agent-based deployment — agentPolicyId set after the agent policy is selected or created 
{
  "item": {
    "agentPolicyId": "agent-policy-id-1",
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-2",
    "mechanisms": [
      "agent_based"
    ],
    "provider": "aws",
    "services": [
      "cloudwatch_metrics"
    ],
    "serviceVars": {
      "cloudwatch_metrics": {
        "namespace": "AWS/EC2",
        "regions": [
          "us-east-1"
        ]
      }
    },
    "status": "pending"
  }
}
ECF deployment — apiKeyId set after the Elasticsearch API key is created for the ECF service 
{
  "item": {
    "apiKeyId": "es-api-key-id-1",
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-3",
    "mechanisms": [
      "ecf"
    ],
    "provider": "aws",
    "services": [
      "cloudfront_logs"
    ],
    "serviceVars": {
      "cloudfront_logs": {
        "regions": [
          "us-east-1"
        ],
        "s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
      }
    },
    "status": "pending"
  }
}
Managed integration deployment — packagePolicyIds set after deployment completes 
{
  "item": {
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-1",
    "mechanisms": [
      "managed_integration"
    ],
    "packagePolicyIds": [
      "package-policy-id-1"
    ],
    "provider": "aws",
    "services": [
      "cloudwatch_metrics",
      "cloudtrail"
    ],
    "serviceVars": {
      "cloudtrail": {
        "regions": [
          "us-east-1"
        ],
        "s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
      },
      "cloudwatch_metrics": {
        "namespace": "AWS/EC2",
        "regions": [
          "us-east-1",
          "eu-west-1"
        ]
      }
    },
    "status": "pending"
  }
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}