Manage configuration changes

If you modify the AWS cloud instance configuration in Cortex after the initial setup, such as enabling or disabling security capabilities or audit log collection, your AWS environment will not automatically update. Because this is a manual onboarding deployment, any changes made within Cortex require corresponding manual updates within your AWS account.

• When enabling new capabilities: You must return to AWS to provision the additional resources, policies, or permissions required to support that specific feature.
• When disabling capabilities: To maintain a secure and minimalist cloud footprint, you should manually remove or revoke the specific AWS resources and permissions associated with that deactivated feature.

Always ensure your AWS IAM policies and resource deployments mirror your active Cortex configuration to prevent integration gaps or unnecessary permission exposure.