How to delete cloud accounts from Prisma Compute using an API endpoint?
Objective
The objective of the article is to inform the user about the correct api endpoints which can be used to delete/remove cloud accounts (Manage > Cloud accounts), along with their associated credentials.
This practice is aimed to specially help those who are unable to delete their cloud accounts due to a dependency like credentials in use. The error message shown in the screenshot below indicates that a cloud account cannot be deleted if it has any active dependencies (credentials) present on the Console.
Environment
- Prisma Cloud Compute - SaaS
Procedure
- Let us look at an example of a cloud account entry as shown in the picture below:
There are a few API calls that need to be made in order to delete this account from the Console.
- The first API call made was to check the existence of the account as well as it's credentials, hence it was a GET request call made to "<PATH_TO_CONSOLE>/api/v1/credentials/755...../usages?project=Central+Console" (where 755... is the cloud account ID)
- The second API call made was to delete the cloud scan entry from the list of accounts, hence it was a DELETE request call made to "<PATH_TO_CONSOLE>/api/v1/cloud-scan-rules/755..?project=Central+Console"
- The third and final API call made was to delete the credentials associated with the particular account, hence it was again a DELETE request call made to "<PATH_TO_CONSOLE/api/v1/credentials/755...?project=Central+Console"
The three API calls as explained above helped in successfully removing the cloud account entry from the Console (Compute > Manage > Cloud accounts).
Additional Information
The deletion of cloud accounts should usually happen with a single click of the delete icon present on the Compute Console User Interface. However, there might be some accounts onboarded via CSPM which were not migrated correctly to the Compute Console and for deletion of old account entries like these, we need to use API calls to clean up the accounts view on the Compute side.
Next step after removing stale accounts, would be to try a fresh onboard of the same account via CSPM or CWP, whichever works best along with selection of the necessary options (cloud discovery, agentless scans..) to successfully complete the sync of the accounts and make sure the results of these scans are recent as well as valid.