Connectors

1. Plan. See the params, the secrets, the scopes to grant, the exact endpoints that Squasher calls, and the request cost per hour. A plan changes nothing.
2. Connect. Send the params and the secrets. Squasher pulls one page to verify them before it stores anything. When the page is good, Squasher stores the secrets encrypted and starts to poll.
3. Verify. Pull one page again at any time with the stored secrets. Verify shows sample records, the same records mapped to OCSF, and the OCSF coverage per class. It sends nothing to your project.
4. Disconnect. Stop polling and delete the stored secrets. This cannot be undone. To start again, connect again.

​

Connector catalog

​

Set up a connector with the CLI

squasher connections plan --project "$SQUASHER_PROJECT_ID" github.audit_log \
  --param github_org=acme

squasher connections create --project "$SQUASHER_PROJECT_ID" github.audit_log \
  --param github_org=acme --secrets-file secrets.json

squasher connections verify --project "$SQUASHER_PROJECT_ID" <connection_id>
squasher connections delete --project "$SQUASHER_PROJECT_ID" <connection_id> --dry-run

​

Connect an AWS account

1. Run connections.plan with the connector params. The plan shows aws_role.external_id, the principal to trust in aws_role.trust_principal (arn:aws:iam::381347172594:root, the Squasher AWS account), and the trust policy condition, for example {"StringEquals": {"sts:ExternalId": "sq-..."}}.
2. Create the reader role. In its trust policy, allow sts:AssumeRole for the principal with the condition, and grant the actions in the plan scopes:
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": { "AWS": "arn:aws:iam::381347172594:root" },
         "Action": "sts:AssumeRole",
         "Condition": { "StringEquals": { "sts:ExternalId": "sq-..." } }
       }
     ]
   }
   
3. Connect with the role ARN in the role_arn param. secrets is an empty object.

squasher connections plan --project "$SQUASHER_PROJECT_ID" aws.cloudtrail_sqs   --param aws_region=us-east-1 --param aws_account_id=123456789012   --param trail_bucket=acme-cloudtrail-logs   --param notification_queue_url=https://sqs.us-east-1.amazonaws.com/123456789012/acme-trail   --param role_arn=arn:aws:iam::123456789012:role/squasher-reader

​

Safe retries

• connections.create and connections.delete take dry_run=true. A dry run returns the preview and changes nothing.
• Send an Idempotency-Key header to retry safely. A retry with the same key and the same request in 24 hours gets the first response. The same key with a different request gets 422.
• connections.delete needs an Idempotency-Key. The CLI sends a new one for each delete.

​

Access