Skip to main content

Generate the CFT Template Link (AWS)



Generates the AWS Cloudformation Stack Quick create link with S3 presigned CFT URL. The Generated CFT template will include Prisma Cloud generated externalId and the permissions based on selected features.

The response contains createStackLinkWithS3PresignedUrl key whose value can be used to create IAM role via AWS CloudFormation stack.

There are 2 ways to create IAM role:

  1. [Manual] If you are logged into your AWS Management console, directly open the value of the createStackLinkWithS3PresignedUrl key on a new tab in the browser.

  2. [Automation] Else, you can extract the actual S3 Presigned CFT URL from the createStackLinkWithS3PresignedUrl key by splitting at templateURL= and url decoding the last index of the split(i.e right part of the split). This extracted decoded link can be used to create or update the IAM role CloudFormation stack.

    NOTE: The createStackLinkWithS3PresignedUrl link is valid for 1hr



    accountType stringrequired

    Possible values: [account, organization]

    Cloud Account Type

    accountId stringrequired

    Account Id

    awsPartition string

    Possible values: [us-east-1, us-gov-west-1]

    Applicable only for Prisma Government Stack( and given if the Cloud account Global Deployment option is enabled

    • us-east-1 - AWS Commercial/Global account

    • us-gov-west-1 - AWS GovCloud account.

    features string[]

    Features for which the permissions should be generated and included in the template.

    To get a list of all the supported features, call Get Supported Features endpoint

    customMemberRoleNameEnabled boolean

    Applicable only when accountType is organization the default is false. However, if set to true, you will be prompted to provide member role when using the terraform CFT template.

    cftType string

    Possible values: [org_member, org_management, org_management_member, account]

    The type of cft that you want to download.

    useTenantExternalId boolean

    Set it to true to use tenantExternalId. The default is false.


Template Generated Successfully

    createStackLinkWithS3PresignedUrl string

    AWS Cloudformation Stack Quick Create link.

    externalId string