> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md).

# AWS security model and authentication

Cortex Cloud implements a defense-in-depth security model built on the principle of least privilege. Every permission granted to Cortex Cloud is scoped to a specific security capability and has a clear purpose. This section describes the security principles, authentication mechanisms, and operational safeguards that protect your AWS environment.

## **Security principles**

* **Minimal permissions by default:** Cortex Cloud operates with the minimum permissions necessary for each capability. Discovery and posture assessment rely on read-only access wherever possible. Additional permissions are only provisioned when you explicitly enable optional capabilities such as agentless disk scanning or data security posture management.
* **Capability-scoped write access:** Each optional capability uses a dedicated policy that is attached only when the capability is enabled. Operations that require limited write access, such as creating temporary resources during analysis, do not modify existing customer assets.
* **Permission transparency and health monitoring:** Cortex Cloud continuously validates that all required permissions remain granted. Every entitlement is mapped to a purpose description so you understand why each permission is required. Missing or revoked permissions are displayed as health status warnings in the connector dashboard.

## **Authentication mechanisms**

Cortex Cloud eliminates the risk of leaked credentials by strictly avoiding static IAM Access Keys, instead relying on temporary, short-lived tokens provided by the AWS Security Token Service (STS). Three isolated identity flows ensure that discovery, scanning, and logging operations remain functionally and cryptographically separated.

* **Discovery and scan flows:** These flows use cross-account AssumeRole calls. These calls include a mandatory sts:ExternalId condition to prevent "confused deputy" attacks, ensuring only your specific Cortex Cloud tenant can access your roles.
* **Audit logs flow:** Employs OIDC Federation through AssumeRoleWithWebIdentity. AWS natively validates Google-signed OIDC tokens from Cortex (GCP), which facilitates a secure identity handshake without the need for manual Identity Provider (IdP) management.
* **Cloud-native identity and trust:** Deployment uses cloud-provider-native security mechanisms for identity validation and access control. All permissions and resources are provisioned through customer-reviewed Infrastructure-as-Code templates to ensure transparency.

The following table maps each capability to the customer-side IAM role and the Cortex-side identity used for authentication:<br>

| Capability                                                                     | Customer account IAM role assumed | Cortex Cloud principal that assumes the role                                                                             |
| ------------------------------------------------------------------------------ | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Discovery, ADS, Kubernetes Security, Automation, DSPM (platform-level actions) | CortexPlatformRole                | role/gcp\_saas\_role                                                                                                     |
| DSPM (data scanning)                                                           | CortexPlatformScannerRole         | role/dspm\_scanner                                                                                                       |
| Registry scanning                                                              | CortexPlatformScannerRole         | role/registry\_scanner                                                                                                   |
| Serverless scanning                                                            | CortexPlatformScannerRole         | role/scanner\_of\_serverless                                                                                             |
| Audit log collection                                                           | CloudTrailReadRole                | Cortex Cloud log collector (via Google OIDC: accounts.google.com with a specific audience and Google service-account ID) |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.