Create an assumed role

Learn more about creating an assumed role in Cortex Cloud.

If you do not designate a separate AWS IAM user to provide access to Cortex Cloud to your logs and to perform API operations, you can create an assumed role in AWS to delegate permissions to a Cortex Cloud AWS service. This role grants Cortex Cloud access to your logs. For more information, see Creating a role to delegate permissions to an AWS service.

When setting up any type of Amazon S3 Collector in Cortex Cloud, these instructions explain setting up an Assumed Role.

Prerequisite

You need ensure you have an Amazon S3 bucket and Amazon Simple Queue Service (SQS) already configured as it's needed to configure an IAM policy. The S3 bucket and SQS required depends on how you plan to configure your Amazon S3 data source:

• When using a CloudFormation script provided by Cortex Cloud to configure Amazon S3 with SQS notifications, you'll need to either:

  • Use the out-of-the-box Amazon S3 bucket and Amazon Simple Queue Service (SQS), whose names change according to the Amazon S3 log type you are defining.
  • Create a new S3 bucket and SQS according to your system requirements.
• When configuring data collection from Amazon S3 manually, create a S3 bucket and SQS according to your system requirements.

When creating the S3 bucket and SQS, follow any other relevant instructions provided, for example in the prerequisite section, for the specific type of Amazon S3 data you want to ingest in the relevant topic.

1. Log in to the AWS Management Console, and open the IAM console to create a policy in the same region as your AWS account.

   1. In the navigation pane on the left, select Access Management → Policies, and click Create policy.
   2. For the Policy editor, select the JSON tab.
   3. Copy the following JSON policy and paste it within the editor window.

      The <s3-arn> and <sqs-arn> are placeholders. These are filled out using the S3 bucket and SQS that you configured in the prerequisite steps above.

      Note

      • You can retrieve your bucket’s ARN by opening the Amazon S3 Console in a browser window. In the Buckets section, select the bucket, click Copy ARN, and paste the ARN in the field.
      • You can retrieve the SQS queue ARN by opening another instance of the AWS Management Console in a browser window, and opening the Amazon SQS Console, and selecting the Amazon SQS that you created. In the Details section, under ARN, click the copy icon ()), and paste the ARN in the field.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "s3:GetObject",
                  "Resource": "<s3-arn>/*"
              },
              {
                  "Effect": "Allow",
                   "Action": [
                      "sqs:ReceiveMessage",
                      "sqs:DeleteMessage",
                      "sqs:ChangeMessageVisibility",
                      "sqs:GetQueueAttributes"
                  ],
                  "Resource": "<sqs-arn>"
              }
          ]
      }

   4. Click Next.
   5. Review and create the policy.
2. Create a role for Cortex Cloud in the IAM console of the AWS Management Console.

   Note

   For more information, see the AWS instructions.

   1. In the navigation pane on the left, select Access Management → Roles, and click Create role.
   2. Select trusted entity, and use the following values and options when creating the role:

      • Trusted entity type: Select Custom trust policy.
      • Custom trust policy: On the right pane, configure the following settings.

        • Under Edit statement → Read or write, verify the AssumeRole is selected.
        • Add a principle by clicking Add and setting the following:

          • Principal type: Select AWS account and root user.
          • ARN: Replace (Account) with the Account ID 006742885340. When using a Cortex XSIAM FedRAMP environment, specify the Account ID as 685269782068.

          When you are finished, click Add principal.
        • Add a condition for an External ID by clicking Add and setting the following:

          • Condition key: Select sts:ExternalId.
          • Qualifier: Select Default.
          • Operator: Select StringEquals.
          • Value: Enter the value of the External ID, a unique alphanumeric string, by generating a secure UUIDv4 using an Online UUID Generator. Copy the External ID as you will use this when configuring the Amazon S3 Collector in Cortex Cloud.

          When you are finished, click Add condition.
   3. Click Next and add permissions by selecting the policy you created.
3. Click Next to name, review, and create.

   • Role name: Specify a name for the new role, and click Create role.
4. Copy the Policy ARN and Role ARN for future use by opening the policy and role that you created.
5. Continue with the task for the applicable Amazon S3 logs you want to configure.

   The following type of logs are available.

   • Ingest network flow logs from Amazon S3.
   • Ingest network Route 53 logs from Amazon S3
   • Ingest audit logs from AWS Cloud Trail.
   • Ingest generic logs from Amazon S3.