> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-aws.md).

# Ingest Cloud Assets from AWS

{% hint style="info" %}

### Notice

Ingestion of cloud assets from AWS requires a Cortex XDR Pro per GB license.
{% endhint %}

Cortex XDR provides a unified, normalized asset inventory for cloud assets in AWS. This capability provides deeper visibility to all the assets and superior context for incident investigation.

To receive cloud assets from AWS, you must configure the Collection Integrations settings in Cortex XDR using the Cloud Inventory data collector to configure the AWS wizard. The AWS wizard includes instructions to be completed both in AWS and the AWS wizard screens. After you set up data collection, Cortex XDR begins receiving new data from the source.

We do not recommend ingestion of data from an AWS commercial environment into a FedRAMP-certified Cortex XDR tenant. However, if you must do so, contact Customer Support for assistance.

As soon as Cortex XDR begins receiving cloud assets, you can view the data in **Assets** → **Cloud Inventory**, where **All Assets** and **Specific Cloud Assets** pages display the data in a table format.

To configure the AWS cloud assets collection in Cortex XDR.

1. Open the AWS wizard in Cortex XDR.
   1. Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**.
   2. In the **Cloud Inventory** configuration, click **Add Instance**.
   3. Click **AWS**.
2. Define the **Account Details** screen of the wizard.

   Setting the connection parameters on the right-side of the screen is dependent on certain configurations in AWS as explained below.

   1. Select the **Organization Level** as either **Account** (default), **Organization**, or **Organization Unit**. The **Organization Level** that you select changes the instructions and fields displayed on the screen.
   2. **Sign in** to your [AWS master account](https://us-east-1.signin.aws.amazon.com/oauth?SignatureVersion=4\&X-Amz-Algorithm=AWS4-HMAC-SHA256\&X-Amz-Credential=AKIAIX36KZ4MDWDXXIGA\&X-Amz-Date=2021-11-02T20%3A56%3A17.707Z\&X-Amz-Signature=21b438a41bc3e6a9688ebd09d095598c470003224fa04eee8a50e6455b9a182b\&X-Amz-SignedHeaders=host\&client_id=arn%3Aaws%3Aiam%3A%3A015428540659%3Auser%2Fcloudformation\&code_challenge=Sy3gtQMJ2zZt8913FfHTuXXULPj_nLOIs77VSQ96Jnc\&code_challenge_method=SHA-256\&redirect_uri=https%3A%2F%2Fus-east-1.console.aws.amazon.com%2Fcloudformation%2Fhome%3Fregion%3Dus-east-1%26state%3DhashArgs%2523%252Fstacks%252Fcreate%252Freview%253FtemplateURL%253Dhttps%253A%252F%252Fcortex-xdr-xcloud-onboarding-scripts-dev.s3.us-east-2.amazonaws.com%252Fcortex-xdr-xcloud-master-dev-1.0.0.template%2526stackName%253DXDRCloudApp%2526param_ExternalID%253Dadbe79b2-4359-4dbe-a9a1-efebdb02e286%26isauthcode%3Dtrue\&region=us-east-1\&response_type=code\&state=hashArgs%23%2Fstacks%2Fcreate%2Freview%3FtemplateURL%3Dhttps%3A%2F%2Fcortex-xdr-xcloud-onboarding-scripts-dev.s3.us-east-2.amazonaws.com%2Fcortex-xdr-xcloud-master-dev-1.0.0.template%26stackName%3DXDRCloudApp%26param_ExternalID%3Dadbe79b2-4359-4dbe-a9a1-efebdb02e286).

      ![aws-sign-in.png](/files/p6xzVBK0lPIGV744QEW8)
   3. Create a stack called XDRCloudApp using the preset Cortex XDR template in AWS.

      The following details are automatically filled in for you in the AWS CloudFormation stack template:

      * **Stack Name**: The default name for the stack is **XDRCloudApp**.
      * **CortexXDRRoleName**: The name of the role that will be used by Cortex XDR to authenticate and access the resources in your AWS account.
      * **External ID**: The Cortex XDR Cloud ID, a randomly generated UUID that is used to enable the trust relationship in the role's trust policy.

      To create the stack, accept the IAM acknowledgment for resource creation by selecting the **I acknowledge that AWS CloudFormation might create IAM resources with custom names** checkbox, and click **Create Stack**.
   4. Wait for the **Status** to update to **CREATE\_COMPLETE** in the **Stacks** page that is displayed, and select the **XDRCloudAPP** stack under the **Stack name** column in the table.
   5. Select the **Outputs** tab and copy the **Value** of the Role ARN.
   6. Paste the Role ARN value in one of the following fields in the **Account Details** screen in Cortex XDR. The field name is dependent on the Organization Level that you selected.
      * **Account**: Paste the value in the **Account Role ARN** field.
      * **Organization**: Paste the value in the **Master Role ARN** field.
      * **Organization Unit**: Paste the value in the **Master Role ARN** field.
   7. Set the **Root ID** in Cortex XDR.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>This step is only relevant if you’ve configured the Organization Level as <strong>Organization</strong> in the <strong>Account Details</strong> screen in Cortex XDR. Otherwise, you can skip this step if the <strong>Organization Level</strong> is set to <strong>Account</strong> or <strong>Organization Unit</strong>.</p></div>

      1. From the main menu of the AWS Console, select **\<your username>** → **My Organization**.
      2. Copy the Root ID displayed under the **Root** directory and paste it in the **Root ID** field in the **Account Details** screen in Cortex XDR.
   8. Set the **Organization Unit ID** in Cortex XDR.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>This step is only relevant if you’ve configured the Organization Level as <strong>Organization Unit</strong> in the <strong>Account Details</strong> screen in Cortex XDR. Otherwise, you can skip this step if the <strong>Organization Level</strong> is set to <strong>Account</strong> or <strong>Organization</strong>.</p></div>

      1. On the main menu of the AWS Console, select your username, and then **My Organization**.
      2. Select the Organization Unit with an icon-ou (![aws-ou-icon.png](/files/UScplBIIuQMKSAzjJ6kM)) beside it in the organizational structure that you want to configure.
      3. Copy the **ID** and paste it in the **Organization Unit ID** field in the **Account Details** screen in Cortex XDR.
   9. Define the following remaining connection parameters in the **Account Details** screen in Cortex XDR:
      * **Account Role External ID** / **Master External ID**: The name of this field is dependent on the Organization Level configured. This field is automatically populated with a value. You can either leave this value or replace it with another value.
      * **Cortex XDR Collection Name**: Specify a name for your Cortex XDR collection that is displayed underneath the **Cloud Inventory** configuration for this AWS collection.
   10. Click **Next**.
3. Define the **Configure Member Accounts** screen of the wizard.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>This wizard screen is only displayed if you’ve configured the Organization Level as <strong>Organization</strong> or <strong>Organization Unit</strong> in the <strong>Account Details</strong> screen in Cortex XDR. Otherwise, you can skip this step when the <strong>Organization Level</strong> is set to <strong>Account</strong>.</p></div>

   Configuring member accounts is dependent on creating a stack set and configuring stack instances in AWS, which can be performed using either the Amazon Command Line Interface (CLI) or Cloud Formation template via the AWS Console. Use one of the following methods:

<details>

<summary>Define the account credentials using Amazon CLI</summary>

1. On the **Configure Member Accounts** page, select the **Amazon CLI** tab, which is displayed by default.
2. Open the Amazon CLI.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>For more information on how to set up the AWS CLI tool, see the <a href="https://aws.amazon.com/cli/">AWS Command Line Interface Documentation</a>.</p></div>
3. Run the following command to create a stack set, which you can copy from the **Configure Member Accounts** screen by selecting the copy icon (![gcp-copy.png](/files/HxRSBvJ2vooJdcsqrtgl)), and paste in the Amazon CLI. This command includes the **Role Name** and **External ID** field values configured from the wizard screen.

   ```programlisting
   aws cloudformation create-stack-set --stack-set-name StackSetCortexXdr01 --template-url https://cortex-xdr-xcloud-onboarding-scripts-dev.s3.us-east-2.amazonaws.com/cortex-xdr-xcloud-master-dev-1.0.0.template --permission-model SERVICE_MANAGED --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=true --parameters ParameterKey=ExternalID,ParameterValue=c9a7024c-3f07-40ed-a4fb-c3a5eba778e2 --capabilities CAPABILITY_NAMED_IAM
   ```
4. Run the following command to add stack instances to your stack set, which you can copy from the **Configure Member Accounts** screen by selecting the copy icon (![gcp-copy.png](/files/HxRSBvJ2vooJdcsqrtgl)), and paste in the Amazon CLI. For the `--deployment-targets` parameter, specify the organization root ID to deploy to all accounts in your organization, or specify Organization Unit IDs to deploy to all accounts in these Organization Units. In this parameter, you will need to replace `<Org_OU_ID1>`, `<Org_OU_ID2>`, and `<Region>` according to your AWS settings.

   ```programlisting
   aws cloudformation create-stack-instances --stack-set-name StackSetCortexXdr01 --deployment-targets OrganizationalUnitIds='["<Org_OU_ID1>", "<Org_OU_ID2>"]' --regions '["<Region>"]'
   ```

   In this example, the Organization Units are populated with `ou-rcuk-1x5j1lwo` and `ou-rcuk-slr5lh0a` IDs.

   ```programlisting
   aws cloudformation create-stack-instances --stack-set-name StackSet_myApp --deployment-targets OrganizationalUnitIds='["ou-rcuk-1x5j1lwo", "ou-rcuk-slr5lh0a"]' --regions '["eu-west-1"]'
   ```

   Once completed, in the AWS Console, select **Services** → **CloudFormation** → **StackSets**, and you can see the StackSet is now listed in the table.
5. Review the **Summary** screen of the wizard.

   If something needs to be corrected, click **Back** to correct it.
6. Click **Create**.

   Once cloud assets from AWS start to come in, a green check mark appears underneath the **Cloud Inventory** configuration with the **Last collection time** displayed. It can take a few minutes for the **Last Collection time** to display as the processing completes.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Whenever the Cloud Inventory data collector integrations are modified by using the <strong>Edit</strong>, <strong>Disable</strong>, or <strong>Delete</strong> options, it can take up to 10 minutes for these changes to be reflected in Cortex XDR.</p></div>

</details>

<details>

<summary>Define the account credentials using AWS CloudFormation</summary>

1. On the **Configure Member Accounts** page, select the **Cloud Formation** tab.
2. In the on-screen step **Download the CloudFormation template**, click **template**. Download the template file. The name of the downloaded file is `cortex-xdr-aws-master-ro-1.0.0.template`.
3. **Sign in** to your AWS Master Account using the AWS console, select **Services** → **CloudFormation** → **StackSets**, and click **Create StackSet**.
4. Define the following settings:

   -Select **Template is ready**.

   -Select **Upload a template file**, **Choose file**, and select the CloudFormation template that you downloaded.
5. Click **Next**.
6. Define the following settings.

   -**StackSet name**: Specify a name for the StackSet.

   **ExternalID**: The **ExternalID** value specified here must be copied from the one populated in the **External ID** field on the right-side of the **Configure Member Accounts** screen in Cortex XDR .
7. Click **Next**.
8. Select **Service-managed permissions**, and click **Next**.
9. Define the following settings.

   **Deployment targets**

   -Select **Deploy to the organization**.

   -Select **Enabled** for **Automatic deployments**.

   -Select **Delete stacks** for **Account removal behavior**.

   **Specify regions**

   -Select one region only. (It can be any region.)

   **Deployment options**

   -For the **Maximum concurrent accounts**, select **Percentage**, and in the field specify **100**.

   -For the **Failure tolerance**, select **Percentage**, and in the field specify **100**.
10. Click **Next**.
11. To create the StackSet, accept the IAM acknowledgment for resource creation by selecting the **I acknowledge that AWS CloudFormation might create IAM resources with custom names** checkbox, and click **Submit**.

    When the process completes, the **Status** of the StackSet is **SUCCEEDED** in the **StackSet details** page.
12. Review the **Summary** screen of the wizard.

    If something needs to be corrected, click **Back** to correct it.
13. Click **Create**.

    Once cloud assets from AWS start to come in, a green check mark appears underneath the **Cloud Inventory** configuration with the **Last collection time** displayed. It can take a few minutes for the **Last Collection time** to display as the processing completes.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Whenever the Cloud Inventory data collector integrations are modified by using the <strong>Edit</strong>, <strong>Disable</strong>, or <strong>Delete</strong> options, it can take up to 10 minutes for these changes to be reflected in Cortex XDR.</p></div>

</details>

After Cortex XDR begins receiving AWS cloud assets, you can view the data in **Assets** → **Cloud Inventory**, where **All Assets** and **Specific Cloud Assets** pages display the data in a table format. For more information, see Cloud Inventory Assets.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-aws.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.