> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/target-aws-resources-overview.md). # Target AWS Resources Overview The commands in this guide provision the following AWS resources: | Resource | What it is | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Custom IAM Policy ([Step 2.1](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | A custom permission set | Grants Cortex read access to AWS services not covered by standard AWS managed policies (e.g. API Gateway, GuardDuty, SageMaker) | | Cortex Platform Role ([Step 2.2](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | A cross-account IAM role | Allows Cortex (running in a different AWS account) to scan your AWS account; trust is locked to Cortex via ExternalID | | SQS Queue ([Step 2.3](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | A "mailbox" for messages | Receives notifications when new CloudTrail log files are ready in S3 | | SQS Queue Policy ([Step 2.4](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | A permission rule on the queue | Allows the CloudTrail SNS topic to put messages into the SQS mailbox | | SNS Subscription ([Step 2.5](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | A connection between SNS and SQS | Makes sure notifications flow from the CloudTrail SNS topic into the SQS mailbox | | CloudTrail Logs Ingestion Role ([Step 2.6](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | An IAM role with OIDC web identity federation trust | Allows Cortex's Google Cloud service account to assume this role and read CloudTrail logs from S3 and messages from SQS — no AWS user or password required | | Scanner Role ([Step 2.7, optional](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | An IAM role for outpost-based scanning | Allows the Cortex scanner to assume this role in your account; only required if using outpost scanning | | Additional Permissions ([Step 2.8](/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md)) | Permissions and policies required by the selected features and capabilities | Grants Cortex permissions required by security capabilities. | **SNS** (Simple Notification Service) is a broadcast channel, like a mailing list that forwards messages to everyone subscribed. The SNS topic for CloudTrail must already exist (it is a prerequisite, not created here). ## How audit log delivery works When you enable audit log collection, the audit log pipeline operates like a secure delivery chain, moving events from your environment to Cortex through the following sequence: `CloudTrail → S3 Bucket → SNS → SQS → Cortex` 1. **CloudTrail** is the "security camera": It records everything that happens in your AWS account and saves each log file into the S3 bucket 2. **S3 Bucket** is the "filing cabinet": Acts as the centralized storage repository for your CloudTrail logs. The moment a new log file lands in the bucket, an automated event notification is triggered and sent to SNS. 3. **SNS** is like a "bulletin board": It receives the notification and forwards it to everyone subscribed (in this case, the SQS queue) 4. **SQS** is like a "mailbox": It receives the forwarded notification and holds it until someone picks it up 5. **Cortex** is the "reader": Routinely checks the mailbox (SQS), picks up the notification, then fetches and processes the log file from the S3 bucket --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/target-aws-resources-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.