Overview

Aqua CSPM (CloudSploit) allows per-cloud-account customization of plugin settings such as EC2 Max Instances (maxInstances). The Aqua Console updates these values through REST APIs. The same workflow can be automated with direct API calls when configuring many accounts or regions.

This article documents the API sequence to list, create, and update maxInstances overrides for a specific cloud account key.


Prerequisites

  • Valid CSPM API credentials with permission to manage overrides
  • Base URL for your CSPM API region (example host: https://api.cloudsploit.com)
  • Cloud account already onboarded in CSPM (known key record)


API Workflow Overview

StepMethodEndpointPurpose
1GET/v2/keysList cloud accounts; note id for the target account (key_id in override responses)
2GET/v2/overrides?plugin=maxInstancesList existing maxInstances overrides
3GET/v2/overrides/{override_id}Read current value, key_id, and customization_id
4PUT/v2/overrides/{override_id}Update an existing override
5POST/v2/overridesCreate a new override when none exists


Create vs. update: If an override already exists for the account and plugin, use PUT. Creating again with POST returns 409 Conflict.


Step 1 — Identify the cloud account key

GET https://api.cloudsploit.com/v2/keys

Locate the target AWS account entry and record its id. This value corresponds to key_id in override objects.


Step 2 — Find an existing maxInstances override

GET https://api.cloudsploit.com/v2/overrides?plugin=maxInstances

Match the override whose key_id equals the account id from Step 1. Record the override id.


Step 3 — Read current override details

GET https://api.cloudsploit.com/v2/overrides/{override_id}

Confirm value, key_id, and customization_id before updating.


Step 4 — Update an existing override

PUT https://api.cloudsploit.com/v2/overrides/{override_id}
Content-Type: application/json

{
  "value": "70"
}

A successful response returns 200 OK with the updated value (for example, changing 50 to 70).

Verify with another GET to /v2/overrides/{override_id}.


Step 5 — Create a new override

When no override exists for the account and plugin:

POST https://api.cloudsploit.com/v2/overrides
Content-Type: application/json

{
  "key_id": "<account_key_id>",
  "customization_id": "<customization_id>",
  "value": "70"
}

Use customization_id from plugin customization metadata or from an existing override of the same plugin type in your tenant.


Per-Region and Per-Account Considerations

  • Overrides are tied to CSPM cloud account keys (key_id), not to Aqua Application Scopes
  • Each onboarded AWS account appears as a separate key; repeat the workflow per account
  • Regional EC2 limits in AWS are enforced per region; set override values according to your organizational policy per account


Documentation Note

Override endpoints used by the Console may not appear in all public Apiary or Swagger references for CSPM. Validate requests against your tenant using GET before PUT or POST in production automation.


Verification and Monitoring

  • GET the override after PUT and confirm value matches the intended limit
  • Run or wait for the relevant CSPM scan and confirm plugin results reflect the new threshold
  • Store override_id per account in your automation system to avoid duplicate POST requests