> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md).

# Amazon S3 configuration example

This example demonstrates how to configure an Amazon S3 external cloud storage solution before backing up or exporting incidents. You can adapt these steps for other S3-compatible buckets.

For complete Amazon configuration instructions, see:

* [Amazon Simple Storage Solution (Amazon S3)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html)
* [AWS Identity and Access Management (AIM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html)

{% hint style="warning" %}

### Prerequisite

Before you begin, make sure you have:

* An AWS account
* Access to AWS Management Console
* Permission to create a stack and its resources in AWS CloudFormation
  {% endhint %}

1. Configure an Amazon S3 bucket:
   1. Log into the [AWS Management Console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html) and navigate to the S3 service.
   2. Using the S3 console, [create or configure a general purpose bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html).
   3. Record the bucket name and region for later.
2. Generate an access key and a secret key for the bucket:
   1. Open the [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html)service. 
   2. [Create a user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html). XSOAR uses this user to connect with the bucket you just created.
   3. In the Security credentials tab, create an access key using the **Third-party service** use case. The secret key is automatically generated.
   4. Record both keys for later.
3. Create a role, and its permissions policy, for the bucket:
   1. In AWS Identity and Access Management (IAM), [create a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) and follow the wizard. 
   2. In Step 1, select **AWS service** as the trusted entity and **S3** as the use case. Click **Next**.
   3. In Step 2, select **Permissions** → **Set permissions boundary - optional** → **Create role without a permissions boundary**to create a role. Click **Next**.
   4. Enter a role name and description. Then define a custom policy with the following JSON:

      ```programlisting
      {
         "Version": "2012-10-17",
         "Statement": 
         [ 
            { 
               "Effect": "Allow",         
               "Action": [
                  "s3:PutObject",
                  "s3:GetObject",
                  "s3:DeleteObject"
               ],
               "Resource": "arn:aws:s3:::YourBucketName/*"
            },
            {
               "Effect": "Allow","Action": "s3:ListBucket",
               "Resource": "arn:aws:s3:::YourBucketName"
            }
         ]}
      ```

      In the above JSON, replace *YourBucketName* with your actual bucket name in two places. This automatically associates the policy with the bucket via the Amazon Resource Name (ARN).

      Save the role and policy.

You can now configure Cortex XSOAR to back up and/or export incidents to Amazon S3 external cloud storage.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.