diff --git a/metadata/service/control/analytics.yml b/metadata/service/control/analytics.yml
index 49d2fb8..8de6918 100644
--- a/metadata/service/control/analytics.yml
+++ b/metadata/service/control/analytics.yml
@@ -5,6 +5,7 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_api_aaa_mode: no-auth
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
@@ -21,6 +22,8 @@
     collector:
       version: ${_param:opencontrail_version}
       enabled: true
+      api:
+        aaa_mode: ${_param:opencontrail_api_aaa_mode}
       bind:
         address: ${_param:cluster_local_address}
         port: 9081
diff --git a/opencontrail/files/3.0/contrail-analytics-api.conf b/opencontrail/files/3.0/contrail-analytics-api.conf
index 3ccc887..eb58dad 100644
--- a/opencontrail/files/3.0/contrail-analytics-api.conf
+++ b/opencontrail/files/3.0/contrail-analytics-api.conf
@@ -11,6 +11,8 @@
 log_category = 
 log_file = /var/log/contrail/contrail-analytics-api.log
 
+aaa_mode = {{ collector.api.get('aaa_mode', 'no-auth') }}
+
 # Time-to-live in hours of the various data stored by collector into
 # cassandra
 # analytics_config_audit_ttl, if not set (or set to -1), defaults to analytics_data_ttl