> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md).
# Create a standard outpost
Create an outpost to deploy a Cortex Cloud outpost using infrastructure that Cortex Cloud creates for a fast, consistent deployment with minimal manual configuration.
## Step 1. Plan and prepare
Review the [fundamentals and prerequisites](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md#outpost-planning) before starting.
{% hint style="info" %}
**Notes:**
* Before you create your outpost, verify that your internet connection is active. An active internet connection is necessary for the notification to be sent to Cortex Cloud to create the new outpost.
* (Azure) Due to limitations in Terraform, the Azure subscription name cannot contain blanks. Take this into account while onboarding.
{% endhint %}
## Step 2. Define the outpost with the outpost creation wizard
Start the outpost creation wizard:
1. In Cortex Cloud, navigate to **Settings → Data Sources & Integrations → Outposts**.
2. Click **New Outpost**.
{% hint style="info" %}
**Tip**: Alternatively, while onboarding your Cortex Cloud with the cloud service provider (CSP) onboarding wizard, the wizard prompts you to choose a scan mode: Cloud scan or Outpost scan. When choosing Outpost scan, you have the opportunity to create your outpost. To start the cloud service provider (CSP) onboarding wizard, navigate to **Settings → Data Sources & Integrations → Add New**.
{% endhint %}
Perform the steps according to your CSP.
AWS
1. Choose **AWS**.
2. If you are using a FedRAMP-certified (Government) Cortex Cloud tenant, you are able to choose between the following environments:
* **Commercial:** (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.
* **Government:** AWS GovCloud environments for compatibility with FedRAMP-certified tenants.
3. Enter the AWS account instance name.
4. (Optional) Define tags and tag values to be added to any new resource created by Cortex in the cloud environment. Click **Next**.
5. Click **Download Terraform** to download the Terraform template file.
Azure
When creating an outpost for a specific Azure subscription, the outpost account must be in the same Azure organization as the monitored subscriptions.
{% hint style="info" %}
**Important**: If you want to deploy a Cortex Cloud Azure outpost using your own pre-created Entra ID app registration, follow the instructions for [Bringing your own Azure app (BYOA)](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md). This type of outpost is designed for organizations with strict governance policies that require control over Entra ID tenant-level resources.
{% endhint %}
1. Choose **Azure.**
2. If you are using a FedRAMP-certified (Government) Cortex Cloud tenant, you are able to choose between the following environments:
* **Commercial:** (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.
* **Government:** Microsoft Azure Government environments for compatibility with FedRAMP-certified tenants.
3. Enter the instance name and the tenant ID of the Azure tenant in which you want to establish the outpost.\
\
**Note**: Due to limitations in Terraform, the Azure subscription name cannot contain blanks.
4. (Optional) Define tags and tag values to be added to any new resource created by Cortex in the cloud environment. Click **Next**.
5. If you are deploying the outpost with your own pre-created Entra ID app registration:
1. Click **Show advanced settings** and toggle **Bring Your Own App (BYOA)** on.
2. Skip to the instructions for [bringing your own Azure app (BYOA)](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md), without performing the steps here.
6. Click **Download Terraform** to download the Terraform template file.
GCP
1. Choose **GCP**.
2. If you are using a FedRAMP-certified (Government) Cortex Cloud tenant, you are able to choose between the following environments:
* **Commercial:** (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.
* **Government:** GCP Assured Workloads for compatibility with FedRAMP-certified tenants.
3. Enter the project ID of the GCP project.
4. (Optional) Define tags and tag values to be added to any new resource created by Cortex in the cloud environment. Click **Next**.
5. Click **Download Terraform** to download the Terraform template file.
## Step 3. **Execute the template in the CSP to deploy the outpost**
In the previous step, you downloaded the Terraform template file in the outpost creation wizard.
Now, you log in to your CSP and execute the Terraform template file.
Perform the steps according to your CSP.
AWS
1. **Prerequisites:** Before you begin, ensure you have:
* An AWS account.
* Permission to create a stack and its resources in AWS.
* Installed Terraform on your local machine. You can download Terraform from the official [Terraform website](https://www.terraform.io/downloads.html) and follow the installation instructions for your operating system.
* Installed the AWS CLI tool and configured your profile with the `aws configure sso` wizard.
2. Open your local terminal (Command prompt, PowerShell, or Terminal).
3. Log in to your AWS account using the AWS CLI:
```
aws sso login --profile
```
`` is the profile you configured with the `aws configure sso` wizard.
4. Create a directory on your local machine to store and run the Terraform code. If you are creating more than one outpost, you need a separate directory for each one:
```
mkdir -p ~/terraform/aws-outpost-1
```
5. Navigate to the directory you created and extract the Terraform files.
```
cd ~/terraform/aws-outpost-1
tar -xzvf .tar.gz
```
6. Initialize Terraform in your project directory:
```
terraform init
```
7. Apply your Terraform configuration using the downloaded parameter file. When prompted, enter the subscription ID:
```
terraform apply --var-file=template_params.tfvars
```
8. When prompted, review the actions Terraform will perform and approve them by entering **yes**.
The Terraform template is deployed, and your outpost is created in pending status.
To view all outposts and their details, navigate to **Settings → Data Data Sources & Integrations → Outposts**.
Azure
> **Important**: If you are deploying the outpost with your own pre-created Entra ID app registration, and you are ready to execute the template in Azure, skip to the instructions for [deploying your own Azure app (BYOA)](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md#step-2-execute-the-template-in-azure-to-deploy-the-outpost), without performing the steps here.
1. **Prerequisites:** Before you begin, ensure you have:
* An active Azure subscription.
* Installed the Azure CLI tool.
* Permission to deploy a custom template and create its resources in Microsoft Azure ("Owner" or "Contributor" on the designated outpost subscription scope, and Active Directory "Cloud Application Administrator" or "Application Administrator" privileged roles).
* Installed Terraform 1.9.4 or above on your local machine. You can download Terraform from the official [Terraform website](https://www.terraform.io/downloads.html) and follow the installation instructions for your operating system.
* A static egress IP assigned to the machine running this Terraform. This is used to configure the Azure Storage IP whitelist (Recommended). Without this, future runs of this Terraform may fail on Azure storage configurations.
2. Open your local terminal (Command Prompt, PowerShell, or Terminal).
3. Log in to your Azure account using the Azure CLI:
```
az login
```
4. If prompted, select the subscription\_id of the designated subscription, or run:
```
az account set --subscription
```
Where `` is the subscription ID of the designated subscription.
5. Create a directory on your local machine to store and run the Terraform code. If you are creating more than one outpost, you need a separate directory for each one:
```
mkdir -p ~/terraform/azure-outpost-1
```
6. Navigate to the directory you created and extract the Terraform files.
```
cd ~/terraform/azure-outpost-1
tar -xzvf .tar.gz
```
7. Initialize Terraform in your project directory:
```
terraform init
```
8. Apply your Terraform configuration using the downloaded parameter file. When prompted, enter the subscription ID:
```
terraform apply --var-file=template_params.tfvars
```
9. When prompted for `var.storaage_account_ip_whitelist`, you can leave it empty to enable access from any public IP to the storage accounts. We recommend you to limit access to selected IPs. To limit access, enter a comma-separated list of public IP addresses, including your local machine's egress IP (to enable the completion of the Terraform run). For example: `8.8.8.8, 8.8.4.4`
10. Review the actions Terraform will perform and approve them by entering **yes**.
11. It is important to create a backup of the Terraform state file using one of the following methods:
Back up the `terraform.tfstate` and `terraform.tfstate.backup` files or use Terraform backend to save the state.
* Create copies of the `terraform.tfstate` and `terraform.tfstate.backup` files. These can then be moved to the working folder to allow Terraform to upgrade or destroy the created resources as necessary.
* Ensure you're using a backend block in your Terraform configuration. For more information, see [Backend block configuration overview](https://developer.hashicorp.com/terraform/language/backend).
The Terraform template is deployed, and your outpost is created in pending status.
To view all outposts and their details, navigate to **Settings → Data Sources & Integrations → Outposts**.
GCP
* **Prerequisites**: Before you begin, ensure you have:
* A GCP account
* Permission to create the required resources in Google Cloud Deployment Manager
* Installed Terraform on your local machine. You can download Terraform from the official [Terraform website](https://www.terraform.io/downloads.html) and follow the installation instructions for your operating system.
* Installed the GCP gcloud CLI tool
1. Open your local terminal (Command Prompt, PowerShell, or Terminal).
2. Log in to your GCP account using the gcloud CLI:
```
gcloud auth login
```
3. Create a directory on your local machine to store and run the Terraform code. If you are creating more than one outpost, you need a separate directory for each one:
```
mkdir -p ~/terraform/gcp-outpost-1
```
4. Navigate to the directory you created and extract the Terraform files.
```
cd ~/terraform/gcp-outpost-1
tar -xzvf .tar.gz
```
5. Initialize Terraform in your project directory:
```
terraform init
```
6. Apply your Terraform configuration using the downloaded parameter file. When prompted, enter the project ID:
```
terraform apply --var-file=template_params.tfvars
```
7. When prompted, review the actions Terraform will perform and approve them by entering **yes**.
The Terraform template is deployed, and your outpost is created in pending status.
To view all outposts and their details, navigate to **Settings → Data Sources & Integrations → Outposts**.
## Step 4. Verify the outpost
After executing the Terraform:
* **Check FICs**: In the Azure portal, go to your **App Registration → Certificates & secrets → Federated credentials**. You should see federated identity credentials created by Cortex.
* **Check Cortex Cloud**: The outpost should appear as **Pending** in the Cortex Cloud Outposts page at **Settings → Data Sources & Integrations → Outposts**.
The necessary permissions are granted and a notification is sent to Cortex Cloud with the execution details.
## What's next?
Start (or continue) CSP onboarding. Run the onboarding wizard to generate an authentication template for [AWS](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md), [GCP](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md), or [Azure](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.