Target AWS Resources Overview
The commands in this guide provision the following AWS resources:
Custom IAM Policy (Step 2.1)
A custom permission set
Grants Cortex read access to AWS services not covered by standard AWS managed policies (e.g. API Gateway, GuardDuty, SageMaker)
Cortex Platform Role (Step 2.2)
A cross-account IAM role
Allows Cortex (running in a different AWS account) to scan your AWS account; trust is locked to Cortex via ExternalID
SQS Queue (Step 2.3)
A "mailbox" for messages
Receives notifications when new CloudTrail log files are ready in S3
SQS Queue Policy (Step 2.4)
A permission rule on the queue
Allows the CloudTrail SNS topic to put messages into the SQS mailbox
SNS Subscription (Step 2.5)
A connection between SNS and SQS
Makes sure notifications flow from the CloudTrail SNS topic into the SQS mailbox
CloudTrail Logs Ingestion Role (Step 2.6)
An IAM role with OIDC web identity federation trust
Allows Cortex's Google Cloud service account to assume this role and read CloudTrail logs from S3 and messages from SQS — no AWS user or password required
Scanner Role (Step 2.7, optional)
An IAM role for outpost-based scanning
Allows the Cortex scanner to assume this role in your account; only required if using outpost scanning
Additional Permissions (Step 2.8)
Permissions and policies required by the selected features and capabilities
Grants Cortex permissions required by security capabilities.
SNS (Simple Notification Service) is a broadcast channel, like a mailing list that forwards messages to everyone subscribed. The SNS topic for CloudTrail must already exist (it is a prerequisite, not created here).
How audit log delivery works
When you enable audit log collection, the audit log pipeline operates like a secure delivery chain, moving events from your environment to Cortex through the following sequence:
CloudTrail → S3 Bucket → SNS → SQS → Cortex
CloudTrail is the "security camera": It records everything that happens in your AWS account and saves each log file into the S3 bucket
S3 Bucket is the "filing cabinet": Acts as the centralized storage repository for your CloudTrail logs. The moment a new log file lands in the bucket, an automated event notification is triggered and sent to SNS.
SNS is like a "bulletin board": It receives the notification and forwards it to everyone subscribed (in this case, the SQS queue)
SQS is like a "mailbox": It receives the forwarded notification and holds it until someone picks it up
Cortex is the "reader": Routinely checks the mailbox (SQS), picks up the notification, then fetches and processes the log file from the S3 bucket
Last updated
Was this helpful?