TABLE OF CONTENTS

Introduction

Aqua runs a nightly CleanUp task to automatically remove disconnected Aqua Enforcers. The minimum interval for this task is one day.

Sometimes it might be desirable to clear disconnected Aqua Enforcers ad-hoc. 

This can be accomplished by leveraging the Aqua API.


Applicability

The commands have been tested in Aqua SaaS only.


Prerequisites

Make sure curl and jq have been installed.

Please open a Support Ticket should you need assistance retrieving the Bearer Token and the Console URL for your Aqua instance.


Steps/Procedure

AQUATOKEN=eyJhbGciOiJSUzI1NiIsIn...

# Query all disconnected AEs from the 'default' enforcer group
AQUA_USE_API_URL='https://xxxxxxxxxx.cloud.aquasec.com/api/v1/hosts?batch_name=default&page=1&pagesize=200&type=enforcer'

curl -H "Authorization: Bearer $AQUATOKEN" --request GET --url "$AQUA_USE_API_URL" | jq '.result[] | select( ."status" == "closed" )' | jq -r .id > disconnected_AEs.txt


# Clear all disconnected AEs as per earlier query
AQUA_USE_API_URL='https://xxxxxxxxxx.cloud.aquasec.com/api/v1/hosts'

for ID in $(cat disconnected_AEs.txt) ; do curl -H "Authorization: Bearer $AQUATOKEN" --request DELETE --url "$AQUA_USE_API_URL/$ID" ; done



Additional Resources

[1] https://docs.aquasec.com/saas/workload-protection/settings/settings-cleanup/

image