> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/amazon-web-services-aws.md).

# Amazon Web Services (AWS)

The following table lists the static resources deployed on outposts in Amazon Web Services (AWS).

<table><thead><tr><th width="76.9000244140625">Scope</th><th width="88.20001220703125">IaC Resource Type</th><th width="103.9000244140625">Technical Resource Name</th><th width="104.5">Required for These Modules</th><th>Purpose</th></tr></thead><tbody><tr><td>Regional</td><td><code>aws_ebs_encryption_by_default</code></td><td><code>policy</code></td><td></td><td>This resource enforces encryption for all new Elastic Block Store (EBS) volumes at the account level. Cortex requires this setting during outpost onboarding to ensure that any temporary volumes used during the scanning process are automatically secured at rest.</td></tr><tr><td>Regional</td><td><code>aws_iam_account_password_policy</code></td><td><code>policy</code></td><td></td><td>DEPRECATED. This resource has been deprecated and is no longer part of the active outpost configuration. Cortex does not utilize this component during any part of the discovery or scanning phases.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>ads_scanner</code></td><td>ADS</td><td>This resource serves as the security identity for the virtual machines responsible for ADS scanning. Cortex utilizes this profile during the scanning phase to grant scanners the necessary permissions to attach and analyze disk snapshots for vulnerability discovery without requiring hardcoded credentials. For example, ads_scanner provides access to the communication bucket. The snapshots are already attached to the instances as disks and therefore the ADS scanner instance needs no permissions to read them.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>dspm_scanner</code></td><td>DSPM</td><td>This resource provides the unique security context for the DSPM scanning engines. During the outpost scanning and discovery stage, Cortex assigns this profile to enable scanners to securely access and inspect cloud data stores to identify sensitive information and potential exposure.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>proxy_vm</code></td><td>Registry, DSPM</td><td>This resource provides the security identity for the Envoy-based Proxy VM used to manage network traffic within the Outpost. Cortex uses this during both the onboarding and operational phases to facilitate secure, authenticated communication between internal scanning components and external registries or data endpoints.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>registry_scanner</code></td><td>Registry</td><td>This resource defines the permissions and identity for the virtual machines dedicated to container registry scanning. Cortex requires this during the scanning phase to allow the scanners to securely authenticate with and pull container images from your registries for security assessment.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>scanner</code></td><td>ADS</td><td>Even though a scanner_instance_profile_name input variable (default: CortexOutpostScannerEC2InstanceProfile) is exposed, it is no longer consumed by any resources. Setting a non-default value has no effect on what AWS deploys. This variable will be removed soon. This resource is the primary security identity for the core ADS scanner instances operating within the environment. During outpost discovery and scanning, Cortex applies this profile to enable the programmatic access required to evaluate the security configuration of your cloud infrastructure. The functionality of this resource is soon to be replaced by ads_scanner.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>scanner_of_serverless</code></td><td>Serverless</td><td>This resource is the security identity assigned to the scanning instances focused on serverless environment assessments. Cortex uses this during the serverless scanning stage to grant the scanners the authority to inspect Lambda functions and other serverless configurations for potential security risks. scanner_of_serverless accomplishes this by providing permissions to the communication bucket and can assume another role in the monitored account that has permissions to read Lambda functions.</td></tr><tr><td>Global</td><td><code>aws_iam_instance_profile</code></td><td><code>ssm_connector</code></td><td></td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost.</td></tr><tr><td>Global</td><td><code>aws_iam_outbound_web_identity_federation (Palo Alto Networks–internal extension to the AWS Terraform provider)</code></td><td><code>cortex_iam_outbound_web_identity</code></td><td>DSPM</td><td>This resource enables identity federation, allowing the DSPM module to authenticate and interact with external systems like Databricks or Snowflake. Cortex utilizes this during the scanning and discovery phase to extend its assessment capabilities to third-party data platforms without requiring static credentials. This resource emits the issuer_identifier consumed by the outpost-registration payload as aws_token_issuer_url.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>allow_outbound_federation_policy</code></td><td>DSPM</td><td>This resource grants the federated Cortex scanner identity permission to obtain a short-lived web identity token (sts:GetWebIdentityToken). Cortex utilizes this policy during DSPM scanning to allow the scanner role to call STS and exchange the customer JWT for temporary AWS credentials scoped to a *.dspm.cortex.local audience for up to one hour.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>artifact_bucket_delete_object_access</code></td><td>DSPM</td><td>This resource allows the gcp_saas_role to delete specific objects from the artifact storage bucket. This role acts as the Cortex single-tenant role, which Cortex utilizes during the DSPM scanning process to clean up temporary artifacts or processed data once the security analysis is complete.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>artifact_bucket_list_access</code></td><td>DSPM</td><td>This resource authorizes the gcp_saas_role to list the objects stored within the artifact bucket while explicitly preventing their retrieval. As the designated Cortex single-tenant role, it uses this during the DSPM discovery phase to inventory available scan artifacts and manage the data workflow without accessing sensitive content.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>artifact_bucket_put_policy_access</code></td><td>DSPM</td><td>This resource grants the gcp_saas_role the authority to set or modify the bucket policy for the artifact storage container. Cortex utilizes this identity, which functions as the Cortex single-tenant role, during DSPM onboarding to ensure the bucket maintains the strict security configurations required for safe data handling.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>artifact_bucket_write_access</code></td><td>DSPM</td><td>This resource enables the DSPM Instance Profile role to perform write operations and upload data into the artifact bucket. Cortex requires this during active DSPM scanning so that the scanner instances can securely store discovery results and intermediary analysis files.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>assume_role_other_accounts</code></td><td>Serverless, Registry, DSPM</td><td>This resource is assigned to Instance Profile roles to authorize scanner VMs to assume IAM roles in other AWS accounts. Cortex relies on this during the cloud discovery and scanning phases to perform multi-account security assessments from a centralized outpost.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>cf_template_bucket_access</code></td><td></td><td>This resource allows the gcp_saas_role to write CloudFormation templates to the designated CloudFormation template (cf-template) bucket. Cortex uses this role in its capacity as the Cortex single-tenant role during the initial outpost onboarding stage to deploy the infrastructure-as-code templates required to provision the environment.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>cortex_communications_bucket_access</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource provides the gcp_saas_role with the permissions to read from and write to the bucket-communication buckets. Cortex uses this identity, which serves as the Cortex single-tenant role, throughout the outpost lifecycle to facilitate the exchange of metadata, instructions, and status updates between the single-tenant components and the management plane.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>cortex_communications_proxy_bucket_access</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants the Proxy VM Instance profile the permission to write log data into the communications bucket. The proxy virtual machine uses this during active scanning operations to record the audit trails and diagnostic information necessary for monitoring outpost health and security.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>dspm_kms_access</code></td><td>DSPM</td><td>This resource permits the DSPM scanner to utilize KMS keys for cryptographic operations, even though the outpost account itself does not contain any internal KMS keys. Cortex utilizes this during the DSPM scanning phase to access and inspect encrypted customer data stores that require decryption for thorough security analysis.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>redshift</code></td><td>DSPM</td><td>This resource is assigned to the gcp_saas_role to provide the specific permissions needed to enable DSPM capabilities for Redshift scanning. Cortex makes use of this identity, which functions as the Cortex single-tenant role, during the discovery phase to inspect Redshift clusters for sensitive data exposure and security posture risks.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>saas_policy</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This is the primary policy for the gcp_saas_role, which acts as the Cortex single-tenant role. Cortex relies on this throughout the scanning process to perform critical tasks such as re-encrypting disks with Cortex KMS keys, reading messages from SQS queues, and assuming roles into the monitored accounts.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>saas_policy_ec2</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource empowers the gcp_saas_role to run scanner EC2 instances, attach and detach disk and network interface attachments, provision VPC endpoints or Elastic IPs, and more. As the primary identity for the Cortex single-tenant role, it uses these permissions during outpost onboarding and scanning to dynamically build the infrastructure and provision the Proxy VM.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>scanner_communications_bucket_access</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource enables scanner instances to perform read and write operations on the bucket-communication buckets across all AWS regions. During the scanning and discovery phases, Cortex uses this to ensure that regional instances can consistently communicate their findings back to the centralized outpost infrastructure.</td></tr><tr><td>Global</td><td><code>aws_iam_policy</code></td><td><code>ssm_read</code></td><td>DSPM, Registry</td><td>This resource allows scanner VMs to read from the SSM parameter store in order to retrieve secrets from the AWS Secrets Manager. Cortex utilizes this during the scanning stage to securely fetch the credentials or configuration parameters needed by the scanners to access protected resources within the environment.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>ads_scanner</code></td><td>ADS</td><td>This resource provides the underlying permissions for the ADS identity to perform its scanning functions. Cortex assigns this role during the scanning phase to allow the ADS scanners to interact with the AWS API and perform vulnerability assessments on infrastructure disks.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>dspm_scanner</code></td><td>DSPM</td><td>This resource defines the security permissions and identity used by the DSPM module. During the outpost scanning and discovery stage, Cortex utilizes this role to authorize scanners to inspect and audit cloud data stores for sensitive information.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>gcp_saas_role</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource establishes the primary management identity used by Cortex to orchestrate outpost operations. Cortex assumes this role throughout the outpost lifecycle to manage resources, handle cross-account communication, and execute core discovery tasks.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>proxy_vm</code></td><td>Registry, DSPM</td><td>This resource provides the permissions necessary for the Proxy VM to facilitate network communication within the environment. Cortex uses this role during outpost onboarding and operation to allow the Proxy VM to securely route traffic between internal components and external security registries.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>registry_scanner</code></td><td>Registry</td><td>This resource establishes the security permissions for the virtual machines dedicated to container registry assessments. Cortex requires this role during the scanning phase to permit scanners to authenticate with and retrieve images from container registries for security audits.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>scanner_of_serverless</code></td><td>Serverless</td><td>This resource provides the security permissions for the scanning engines focused on serverless environment assessments. Cortex utilizes this during the serverless scanning stage to grant the scanners the authority to inspect Lambda functions and other serverless configurations for potential risks.</td></tr><tr><td>Global</td><td><code>aws_iam_role</code></td><td><code>ssm_connector</code></td><td></td><td>This resource was previously utilized for infrastructure management but is no longer required in the current architecture. Cortex does not interact with this resource during the onboarding or scanning processes.</td></tr><tr><td>Global</td><td><code>aws_iam_service_linked_role</code></td><td><code>redshift</code></td><td>DSPM</td><td>This resource provides the specialized permissions needed to enable DSPM capabilities for Redshift cluster scanning by pre-creating the AWS service-linked role (AWSServiceRoleForRedshift) required by the Redshift service before scanners launch. Cortex makes use of this identity, which functions as the Cortex single-tenant role, during the discovery phase to assess the security posture of Amazon Redshift data warehouses.</td></tr><tr><td>Global</td><td><code>aws_iam_service_linked_role</code></td><td><code>spot</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource provides the specialized permissions needed to provision and manage EC2 Spot instances within the environment by pre-creating the AWS service-linked role (AWSServiceRoleForEC2Spot) required by the EC2 Spot service before Cortex scanners launch. Cortex utilizes this role throughout the scanning lifecycle to leverage cost-effective compute capacity for high-volume discovery tasks.</td></tr><tr><td>Regional</td><td><code>aws_internet_gateway</code></td><td><code>scan_platform</code></td><td>Registry, DSPM</td><td>This resource provides the gateway for traffic to flow between the outpost virtual network and the internet. Cortex utilizes this during the discovery and scanning phases to allow the Proxy VM to reach external security endpoints, updates, and registries.</td></tr><tr><td>Regional</td><td><code>aws_internet_gateway_attachment</code></td><td><code>scan_platform</code></td><td>Registry</td><td>This resource creates the logical link between the internet gateway and the outpost virtual network. Cortex requires this attachment during outpost onboarding to enable the external network connectivity required for successful scanner communication.</td></tr><tr><td>Zonal</td><td><code>aws_route</code></td><td><code>igw_egress</code></td><td>Registry, DSPM</td><td>This resource defines the default path for outbound traffic within the virtual network, routing it through the internet gateway. Cortex uses this during the discovery and scanning phases to provide the Proxy VM with the connectivity needed to reach external security services.</td></tr><tr><td>Zonal</td><td><code>aws_route_table</code></td><td><code>route_table</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource is a VPC route table containing the set of routing rules used to direct network traffic within specific availability zones. Cortex utilizes these zonal tables during the scanning and discovery stages to manage the flow of traffic for each isolated segment of the outpost.</td></tr><tr><td>Zonal</td><td><code>aws_route_table_association</code></td><td><code>route_table_assoc</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource links each zonal subnet to its respective route table to ensure proper traffic flow. Cortex configures these associations during outpost onboarding to guarantee that scanner instances follow the correct network paths for their specific location.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket</code></td><td><code>artifact</code></td><td>DSPM</td><td>This resource acts as the central storage repository for intermediate data findings and artifacts generated during DSPM audits. Cortex uses this during the scanning phase to hold temporary data that is being analyzed for sensitive content and security exposures. It also stores the scanner binaries and configuration files that scanner VMs download at boot.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket</code></td><td><code>communication</code></td><td>DSPM, ADS, Serverless, Registry</td><td>This resource provides the primary storage medium for metadata and logs exchanged between the outpost and the Cortex platform. Cortex utilizes this bucket throughout the operation of the outpost to synchronize scan results and receive instructions without direct network connectivity.</td></tr><tr><td>Global</td><td><code>aws_s3_bucket</code></td><td><code>s3_cloudformation_template</code></td><td></td><td>This resource serves as the storage container for the CloudFormation templates used to provision the customer-managed environment. Cortex uses this bucket during the initial outpost onboarding stage to retrieve the infrastructure-as-code files required to set up scanning components.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_lifecycle_configuration</code></td><td><code>artifact</code></td><td>DSPM</td><td>This resource manages the automatic cleanup of temporary data in the artifact bucket by expiring objects after two days. Cortex applies this lifecycle policy during the scanning phase to maintain storage efficiency and ensure data hygiene within the customer environment.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_lifecycle_configuration</code></td><td><code>communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource manages the automatic cleanup of logs and communication data in the communications bucket after two days. Cortex utilizes this throughout the outpost operation to ensure that internal communication records do not consume unnecessary storage space.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_notification</code></td><td><code>communication</code></td><td>ADS, Registry, Serverless, DSPM</td><td>This resource establishes an automated notification link between the communication buckets and the Cortex single-tenant infrastructure. Cortex uses this throughout the scanning lifecycle to trigger immediate processing whenever a scanner VM uploads new results to the bucket.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_ownership_controls</code></td><td><code>artifact</code></td><td>DSPM</td><td>This resource defines the ownership rules for objects stored within the artifact bucket. Cortex configures this during outpost onboarding to ensure that all generated security artifacts are owned by the management identity and can be consistently audited.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_ownership_controls</code></td><td><code>communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the ownership rules for objects stored within the communication bucket. Cortex utilizes this setting during onboarding to maintain consistent access controls over the logs and metadata transmitted between scanning components.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_public_access_block</code></td><td><code>artifact</code></td><td>DSPM</td><td>This resource provides a security baseline by preventing any data in the artifact bucket from being exposed to the public internet. Cortex configures this during the initial setup to safeguard sensitive DSPM discovery findings from unauthorized access.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_public_access_block</code></td><td><code>cloudformation_bucket_access_block</code></td><td></td><td>This resource provides a security baseline by preventing any data in the CloudFormation templates bucket from being exposed to the public internet. Cortex configures this during the initial setup to safeguard the customer-shipped CloudFormation templates used to bootstrap downstream scanned accounts.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_public_access_block</code></td><td><code>communication</code></td><td>DSPM</td><td>This resource provides a security baseline by preventing any data in the communication bucket from being exposed to the public internet. Cortex requires this during the onboarding stage to ensure that all internal logs and scan metadata remain strictly private.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_server_side_encryption_configuration</code></td><td><code>artifact</code></td><td>DSPM</td><td>This resource ensures that all objects in the artifact bucket are encrypted at rest using server-side encryption. Cortex utilizes this during the scanning phase to protect sensitive data findings in compliance with industry security standards.</td></tr><tr><td>Regional</td><td><code>aws_s3_bucket_server_side_encryption_configuration</code></td><td><code>communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource ensures that all objects in the communication bucket are encrypted at rest using server-side encryption. Cortex requires this during the scanning phase to maintain a secure communication channel between the outpost and the management plane.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>ads_scanner</code></td><td>ADS</td><td>This resource provides the underlying permissions for the ADS identity to perform its scanning functions. Cortex assigns this role during the scanning phase to allow the ADS scanners to interact with the AWS API and perform vulnerability assessments on infrastructure disks.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>aws_cloudwatch</code></td><td></td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>aws_lambda_endpoint</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>aws_ssm</code></td><td>Registry, DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>aws_sts</code></td><td>Serverless, Registry, DSPM</td><td>This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>cortex_interface_endpoint</code></td><td>DSPM,Registry,Serverless</td><td>This resource provisions a single security group that is attached to all Cortex interface VPC endpoints (STS, ECR API, ECR DKR, Monitoring, SSM, Lambda) in the region. Cortex utilizes this SG during scanning to ensure scanner workloads can reach the Cortex AWS API surface over private connectivity (port 443 from the Cortex scanner SG only).</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>cortex_scanner</code></td><td>DSPM, Registry, Serverless, ADS</td><td>This resource acts as a virtual firewall for the scanner virtual machines, controlling their network access levels. Cortex configures these security rules during the scanning phase to ensure that scanners can only communicate with authorized endpoints and internal outpost components.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>dspm</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>ecr_api_endpoint</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>ecr_dkr_endpoint</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>egress_proxy</code></td><td>Registry, DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>legacy_scanner</code></td><td></td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>legacy_sts_endpoint</code></td><td></td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>monitoring_endpoint</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>registry_scanner</code></td><td>Registry</td><td>This resource defines the permissions and identity for the virtual machines dedicated to container registry scanning. Cortex requires this during the scanning phase to allow the scanners to securely authenticate with and pull container images from your registries for security assessment.</td></tr><tr><td>Regional</td><td><code>aws_security_group</code></td><td><code>scanner_of_serverless</code></td><td>Serverless</td><td>This resource is the security identity assigned to the scanning instances focused on serverless environment assessments. Cortex uses this during the serverless scanning stage to grant the scanners the authority to inspect Lambda functions and other serverless configurations for potential security risks.</td></tr><tr><td>Regional</td><td><code>aws_sqs_queue</code></td><td><code>main</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource provides a message queue for orchestrating the flow of data between the outpost buckets and the Cortex management plane. Cortex uses this during the scanning phase to receive alerts about new scan findings, ensuring that data is processed asynchronously and efficiently.</td></tr><tr><td>Regional</td><td><code>aws_sqs_queue_policy</code></td><td><code>main</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the permissions for the communication queue, allowing S3 buckets to post event notifications. Cortex utilizes this during the scanning lifecycle to enable automated triggers that notify the single-tenant components when new data is ready for analysis.</td></tr><tr><td>Zonal</td><td><code>aws_subnet</code></td><td><code>main</code></td><td>ADS, Registry, Serverless, DSPM</td><td>This resource defines a specific range of IP addresses within the virtual network used to host scanning components. Cortex utilizes these zonal subnets during the scanning and discovery phases to deploy scanner instances in close proximity to the assets being audited.</td></tr><tr><td>Regional</td><td><code>aws_vpc</code></td><td><code>main</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource is the primary VPC (Virtual Private Cloud) that provides the isolated virtual network environment for the outpost. Cortex utilizes this VPC during the onboarding and scanning phases to host all scanning infrastructure and ensure that discovery activities are logically separated from other network traffic.</td></tr><tr><td>Regional</td><td><code>aws_vpc_endpoint</code></td><td><code>dynamodb</code></td><td>DSPM</td><td>This resource is a VPC endpoint that establishes a private, secure connection between the outpost VPC and the DynamoDB service. Cortex utilizes this during the DSPM scanning phase to allow scanner instances to securely interact with DynamoDB resources for security assessments without data ever traversing the public internet.</td></tr><tr><td>Regional</td><td><code>aws_vpc_endpoint</code></td><td><code>s3</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource is a VPC endpoint that establishes a private, secure connection between the outpost VPC and the S3 service. Cortex utilizes this during the scanning phase to allow scanner instances to securely interact with S3 resources for security assessments without data ever traversing the public internet.</td></tr><tr><td>Regional</td><td><code>aws_vpc_endpoint_policy</code></td><td><code>dynamodb</code></td><td>DSPM</td><td>This resource is a VPC endpoint policy that defines the access control rules for the DynamoDB endpoint, restricting traffic to authorized operations. Cortex utilizes this during the DSPM scanning stage to enforce a strict security posture by ensuring only authorized scanner roles can communicate with the service through the endpoint.</td></tr><tr><td>Regional</td><td><code>aws_vpc_endpoint_policy</code></td><td><code>s3</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource is a VPC endpoint policy that defines the access control rules for the S3 endpoint, restricting traffic to authorized operations. Cortex utilizes this during the scanning stage to enforce a strict security posture by ensuring only authorized scanner roles can communicate with the service through the endpoint.</td></tr><tr><td>Zonal</td><td><code>aws_vpc_endpoint_route_table_association</code></td><td><code>dynamodb</code></td><td>DSPM</td><td>This resource associates a VPC endpoint for DynamoDB with a VPC route table to enable private connectivity. Cortex utilizes this during the DSPM scanning phase to ensure that traffic from all subnets associated with the route table can reach the DynamoDB service privately without leaving the VPC.</td></tr><tr><td>Zonal</td><td><code>aws_vpc_endpoint_route_table_association</code></td><td><code>s3</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource associates a VPC endpoint for S3 with a VPC route table to enable private connectivity. Cortex utilizes this during the scanning phase to ensure that traffic from all subnets associated with the route table can securely interact with S3 without leaving the VPC.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>ads_scanner_to_s3_endpoint_egress</code></td><td>ADS</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>ads_scanner_to_sts</code></td><td>ADS</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>cortex_scan_to_service_endpoints</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the rule for allowing encrypted HTTPS traffic to enter the network interface endpoint. Cortex utilizes this during the scanning phase to provide a secure entry point for traffic traveling from internal scanner components to AWS managed services.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_aws_cloudwatch</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_aws_monitoring</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_aws_ssm</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_dynamodb_endpoint_egress</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_egress_proxy</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_s3_endpoint_egress</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>dspm_to_sts</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>egress_default</code></td><td>Registry, DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>egress_default</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the rule allowing the Proxy VM to initiate outbound connections to external endpoints. Cortex utilizes this during the operation phase to ensure the Proxy VM can communicate with the Cortex platform and external security registries to perform discovery tasks.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_aws_ssm</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_dkr</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_ecr</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_egress_proxy</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_s3_endpoint</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>registry_scanner_to_sts</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_of_serverless_to_egress_proxy</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_of_serverless_to_lambda_sg</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_of_serverless_to_s3_endpoint_egress</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_of_serverless_to_sts</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_sg_to_dynamodb</code></td><td>DSPM</td><td>This resource specifies the rule for allowing encrypted HTTPS traffic from the scanner instances to the DynamoDB network endpoint. Cortex utilizes this during the DSPM scanning phase to allow the secure exchange of metadata between the scanning engines and the database service.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_sg_to_egress_proxy</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the rule for allowing specialized traffic through port 10000 to exit the Proxy VM. Cortex uses this during outpost operations to maintain the primary communication tunnel between the local scanning infrastructure and the management platform.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_egress_rule</code></td><td><code>scanner_sg_to_s3</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource specifies the rule for allowing encrypted HTTPS traffic from the scanner instances to the S3 network endpoint. Cortex configures this during the scanning phase to ensure that scanners can securely upload results and download necessary discovery data.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>allow_cortex_scanner</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource specifies the rule for allowing scanner instances to communicate with the Proxy VM on port 10000. Cortex requires this rule during the scanning phase to ensure that all discovery results can be successfully routed through the proxy to the management plane.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>allow_dspm</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>allow_registry_scanner</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>allow_scanner_of_serverless</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>cortex_interface_endpoint</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource specifies the rule for allowing internal traffic from the scanner security groups to reach the network interface endpoint. Cortex configures this during the scanning and discovery phases to facilitate the secure transfer of data across the internal virtual network.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>ecr_api_ingress</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>ecr_dkr_ingress</code></td><td>Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>lambda_ingress</code></td><td>Serverless</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>monitoring_endpoint_ingress</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>monitoring_ingress</code></td><td>DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>ssm_ingress</code></td><td>DSPM, Registry</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr><tr><td>Regional</td><td><code>aws_vpc_security_group_ingress_rule</code></td><td><code>sts_ingress</code></td><td>Serverless, Registry, DSPM</td><td>DEPRECATED. This resource has been removed in a previous version and is no longer utilized by the outpost during scanning or onboarding.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/amazon-web-services-aws.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.