> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-1-create-aws-cloud-instance-in-cortex.md). # Phase 1: Create AWS cloud instance in Cortex ## Phase 1: Create AWS cloud instance in Cortex ### 1.1 Start the AWS onboarding wizard #### 1.1.2 Access the AWS onboarding wizard in Cortex Cloud: 1. In Cortex Cloud, select Settings → Data Sources & Integrations. 2. On the Data Sources & Integrations page, click + Add New. 3. On the Add Data Sources or Integrations page, search for Amazon Web Services (AWS), then hover over it and click Add. #### 1.1.3 Select the scope * Select the scope for this cloud instance: * Organization: (Default) A collection of AWS accounts that are managed centrally. * Organizational Unit: A group of AWS accounts within an organization. An organizational unit can also contain other organizational units. * Account: A single AWS account. #### 1.1.4 Choose the scan mode * Specify the scanning infrastructure for your cloud instance by selecting one of the following scan modes: * Cloud Scan: (Recommended) Security scanning is performed in the Cortex Cloud cloud environment. * Scan with Outpost: Security scanning is performed on infrastructure deployed to a cloud account owned by you. If you select this option, choose the outpost account to use for this instance. * Note: Scanning with an outpost may require additional AWS permissions and may incur additional CSP costs. #### 1.1.5 Configure advanced settings Click Show advanced settings to define the following advanced settings: * Instance Name: Enter a unique instance name or leave it empty to be automatically populated. The automatic naming convention is `AWS-` or `AWS-`. Cortex does not prevent you from reusing instance names, but it is best practice to use a unique name for every cloud instance. * Deployment Method: Select whether you want to onboard with a Cortex-generated CloudFormation template or to perform a manual deployment. * CloudFormation: (Recommended). Proceed to How to onboard Amazon Web Services. * Manual: Select this option to manually configure service accounts and permissions, so your cloud setup stays aligned with internal governance requirements. * Scope Modifications: Use these settings to fine-tune your AWS scope. You can modify the scope by including or excluding specific regions. Additionally, if you selected an organization or organizational unit as the scope, you can modify the scope by including or excluding specific accounts. For more details, see Apply region or account filters. * Additional Security Capabilities: Choose which security capabilities you want to benefit from. Some security capabilities are enabled by default and can be modified. Adding security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see Cloud service provider permissions. * Data security posture management: An agentless data security scanner that discovers, classifies, protects, and governs sensitive data. * Registry scanning: A container registry scanner that scans registry images for vulnerabilities, malware, and secrets. For more details, see Configure registry scanning for cloud accounts. * Serverless functions scanning: Implement serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment. * Automation: Use automation to pre-configure a list of integrations and associated commands to automate security issue responses. Commands can be utilized individually or as part of custom playbooks for issue remediation. * Log Level: (Optional - for Automation only) Configure the automation integration logging level. Possible values are: * Off (Default) * Debug * Verbose * Agentless disk scanning: (Recommended) Implement agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle. * Kubernetes security: Implement Kubernetes security to scan and assess Kubernetes cluster configurations, workloads, and security controls to identify misconfigurations, compliance violations, and security risks. This option detects issues in RBAC policies, network policies, pod security standards, container image security, and resource constraints. Keeping this enabled is strongly recommended to maintain continuous visibility into the cluster's security posture and to prevent undetected configuration gaps. * Cloud Tags: Define tags and tag values to be added to any new resource created by Cortex Cloud in AWS. Note: The `managed_by = paloaltonetworks` tag is automatically added to all resources. This tag is mandatory. You cannot edit or remove this tag. * Log Collection Configuration: To maximize security coverage, include the collection of audit logs using CloudTrail. Select the collection method: For detailed information on the permissions required, see Cloud service provider permissions. * Custom (user defined): You must use this option with manual onboarding. It uses an existing Amazon S3 bucket for storing your CloudTrail logs. * Important: It is critical to ensure that your KMS key region and SNS topic region are the exact same as the AWS region where you are deploying the CloudFormation stack. ### 1.2 Download the customized identifiers file The Identifiers JSON file is a customized configuration document generated based on the specific security capabilities selected during the initial onboarding wizard. It acts as a workbook to track service accounts and organization-specific metadata across the different phases of deployment. The file is divided into two primary sections, each serving a distinct purpose in your manual onboarding process: * The "identifiers" section: This section is pre-populated by the AWS onboarding wizard. It contains the specific details generated for your environment. You will reference these values when you set up the variables. * The "manual\_details" section: These fields are initially empty. During the manual setup, you will retrieve specific values from your AWS environment, such as your Organization ID and account group, and input them directly into this section of the file. In the AWS onboarding wizard, in the Manual Connection Setup step, click Identifiers to download your customized identifiers file. At this point in the deployment process, you move over to the Amazon Web Services environment to create the required resources, as described below. ### Identifiers file details The following is a list of the possible identifiers included in the custom configuration JSON, depending on the security capabilities you enabled in the Cortex AWS onboarding wizard: | Identifier | Description | Example | | ------------------------- | -------------------------------------------- | ---------------------------------------------- | | CortexPlatformRoleName | Name for the IAM role to create | CortexPlatformRole-m-a-9992206592268 | | ExternalID | UUID for cross-account trust | 1d890e40-2f50-4e55-b9db-bcce534213a8 | | OutpostRoleArn | Cortex's assume-role principal | arn:aws:iam::237422644089:role/gcp\_saas\_role | | Audience | OIDC audience for federated principal | cortex-audit-logs | | CollectorServiceAccountId | Google service account ID | 116501907218496843752 | | CloudTrailLogsBucket | S3 bucket containing CloudTrail logs | my-cloudtrail-bucket | | CloudTrailSnsArn | SNS topic ARN for CloudTrail notifications | arn:aws:sns:us-east-1:123456789012:my-topic | | CloudTrailKmsArn | (Optional) KMS key ARN if logs are encrypted | arn:aws:kms:us-east-1:123456789012:key/... | Note: Audience and CollectorServiceAccountId are OIDC federation credentials provided by Cortex. They are used in Step 2.6 to configure the trust policy for the CloudTrail Logs Ingestion Role. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-1-create-aws-cloud-instance-in-cortex.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.