# User Guide - Cross Account Import

Author: huangzicheng@

Last updated: 2021-08-25

For how to create an import in infra API in general, please refer to the corresponding code in the central server. We will not cover this part in the doc.
## S3

During the creation of networks, infra API sets an external ID in the network status and exposes the AWS account ID as well. The following code shows an example of how to obtain these two fields.

```go
func getAccountID(network *cloudv1.Network) (string, error) {
    status, err := cloudv1.GardenerNetworkStatusFromNetwork(network)
    if err != nil {
        return "", err
    }
    return status.AWS.AccountID, nil
}

func getExternalID(network *cloudv1.Network) (string, error) {
    return network.Status.IAM.ExternalId
}
```

Then create an import CR with the import source and role ARN provided by the customers:
```go
	imp := &cloudv1.Import{
		Spec: cloudv1.ImportSpec{
			ClusterName:  "cluster-name",
			Source:       cloudv1.Source{
                // Fill with the source
            },
			AccessConfig: cloudv1.AccessConfig{
				RoleArn: "role-arn-provided-by-customer",
			},
		},
	}
    // Create the import CR 
    ...
```

## GCS 

Import from GCS requires the customer to set up correct permissions on the service account we provided. To obtain the service account email:

```go
func getServiceAccountEmail(network *cloudv1.Network) (string, error) {
    return network.Status.IAM.ServiceAccountEmail, nil
}
```

## Dry Run

Dry run is recently supported to verify the permission to access the import source. Instead of running an import job, a dry-run import will test the access to the import source - S3 or GCS, with the credentials it received. If the source by be accessed without issues, the import will end up with the status of `Complete`, otherwise `Failed`.

To create a dry-run import, simply set the field `DryRun` to true.

```go
	imp := &cloudv1.Import{
		Spec: cloudv1.ImportSpec{
			ClusterName:  "cluster-name",
			Source:       cloudv1.Source{
                // Fill with the source
            },
			AccessConfig: cloudv1.AccessConfig{
                // Only required for S3 import
				RoleArn: "role-arn-provided-by-customer",
			},
            DryRun: true,
		},
	}
    // Create the import CR 
    ...
```