Bulk Onboarding

API- and CLI-driven onboarding of cloud accounts into Firefly, without using the Firefly onboarding wizard. Intended for bulk onboarding, CI/CD pipelines, and organizations whose security teams require a reviewable, scriptable integration path.

When to use this

The Firefly console wizard (Settings > Integrations > Add New) is the fastest way to connect a single account, subscription, or project. Use the headless flows below instead when you need to:

• Onboard many accounts at once — an AWS Organization, an Azure management group, a GCP folder tree

• Drive onboarding from a CI/CD pipeline rather than clicking through the console

• Give a security team a template or script they can review, diff, and approve before it runs, rather than a wizard they have to trust

• Re-run onboarding repeatably as new accounts are added to an org, tenant, or project hierarchy

Each guide below covers the provider CLI (aws, az, gcloud) and the Firefly API end to end: creating credentials, granting the minimum required permissions, registering the integration with Firefly, and verifying that data is flowing. Firefly also ships Terraform modules for each provider; those are documented separately under each provider's integration guide.

Guides

• AWS — Onboard one or many AWS accounts using the aws CLI, CloudFormation, and the Firefly API. Includes the AWS Organizations / StackSet path for onboarding at scale.

• Azure — Onboard one or many Azure subscriptions using the az CLI and an ARM template that registers the integration with Firefly automatically. Includes management-group deployment and service principal credential rotation.

• Google Cloud — Onboard one or many GCP projects using the gcloud CLI and the Firefly API. Includes organization-level folder discovery and the IAM org-policy checks to run before you start.

Prerequisites common to all three

• Admin access to the Firefly console, to create an API key pair (Settings > Users > Create Key Pair)

• curl and jq

• The relevant provider CLI installed and authenticated (aws, az, or gcloud)

• Sufficient IAM/RBAC permissions in the target cloud to create the read-only role, service principal, or service account that Firefly will use

Provider-specific prerequisites are listed on each guide.