> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md).
# Task 2. Deploy your virtual machine on AWS
### **Considerations**
* Currently, only AWS Commercial Cloud, also known as AWS Global, is supported (not GovCloud).
* Cortex XSOAR supports only Nitro hypervisor-based instance types, for example m5.4xlarge. For more information, see [Amazon EC2 instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#instance-hypervisor-type).
* If you set your Cortex XSOAR environment as a standalone (single node), you cannot add nodes to it and switch to a cluster. If you deploy three nodes, you can later add nodes and expand the cluster. For more information, see [Manage nodes in a cluster](/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/manage-nodes-in-a-cluster.md).
* Before importing the VM image, export the VM from your virtualization environment. You need an Amazon S3 bucket in the correct region, and the VM image file must be uploaded to the S3 bucket.
* The VM Import/Export feature in AWS requires a role to perform certain operations on your behalf. You must create a service role named **`vmimport`** with a trust relationship policy document that allows VM Import/Export to assume the role, and you must attach an IAM policy to the role. This will allow the **`vmimport`** role to access the S3 bucket you created. For more information, see [VM Import/Export Requirements](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html), [Required service role](https://docs.aws.amazon.com/vm-import/latest/userguide/required-permissions.html#vmimport-role), and [IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-toplevel.html).
Important
Ensure the AWS VM role has gp2 ec2:CreateVolume permission.
### **High Availability and backup and restore**
To implement built-in High Availability, deploy a cluster with three nodes (VMs), with each VM on a different hypervisor. This ensures that if one hypervisor fails, the other VMs continue to operate.
You then need to:
* Establish trust between all nodes in the cluster (Task 6).
* Set the **Cluster FQDN** to the reverse proxy/ingress controller IP address (Task 7). The reverse proxy/ingress controller serves as a single entry point to distribute traffic across the nodes in the cluster.
* Allow Volume Snapshots operations.
For example, set up a custom policy as follows.
```programlisting
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:ListSnapshotsInRecycleBin",
"ec2:CopySnapshot",
"ec2:DeleteSnapshot",
"ec2:ModifySnapshotAttribute",
"ec2:DescribeSnapshotAttribute",
"ec2:CreateSnapshots",
"ec2:ResetSnapshotAttribute",
"ec2:CreateSnapshot",
"ec2:DescribeSnapshots",
"ec2:CreateTags"
],
"Resource": "*"
}
]
}
```
Note
If you subsequently delete the node you backed up, you also need to delete the snapshot. For more information, see Back up data.
**How to deploy your virtual machine on AWS**
1. In AWS, under Region, confirm the correct region is selected.
2. On your local computer, rename the OVA file to include the prefix `migrationhub-orchestrator-vmie-` to follow the AWS naming convention.
3. Upload the OVA image file to a private and secure S3 bucket that you set up.
1. Under **General purpose buckets**, select the bucket.
2. Under **Amazon S3** → **Buckets** → **\** → **Objects**, select the folder the OVA image file will upload to.
The folder must be named with the prefix `migrationhub-orchestrator-vmie-` and must only contain one OVA file. For more information, see [Import virtual machine images to AWS template](https://docs.aws.amazon.com/migrationhub-orchestrator/latest/userguide/import-vm-images.html).
3. In the Upload info page, drag and drop the OVA image file and select **Upload**.
4. Create a workflow using AWS Migration Hub Orchestrator.
Use the **`Import virtual machine images to AWS`** template to import an on-premises virtual machine image to AWS.
1. Open the **Migration Hub Orchestrator** console.
2. From the side menu, select **Migration & Transfer** → **AWS Migration Hub**.
AWS Migration Hub is only available in certain regions.
3. From the Migration Hub side menu, select **Orchestrate** → **Workflows** → **Create workflow**.
4. On the **Choose a workflow template** page, select **Import new virtual machine images to AWS**, then select **Next**.
5. Configure the workflow properties.
* Set the workflow name.
* Set Disk container as the path to the uploaded image.
* Under Target environment configuration, confirm the Boot mode - optional is set to **legacy-bios**.
6. Select **Next**.
7. Select the newly created workflow, then select **Run**.
5. Create a new identity and access management (IAM) role for the container storage interface (CSI).\
This role enables the virtual machine to create its own storage volume.
1. From the side menu, select **Security, Identity, & Compliance** → **IAM**.
2. From the **IAM role** side menu, select **roles**, then **create new role**.
3. Under **Select trusted entity**:
1. In the **Trusted entity type** section, select **AWS service**.
2. In the **Use case** section, select **EC2**.
4. Click **Next**.
5. Under **Add permissions**, in the **Permissions policies** section add [AmazonEBSCSIDriverPolicy](https://us-east-1.console.aws.amazon.com/iam/home?region=eu-central-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FAmazonEBSCSIDriverPolicy) (to allow Volume Snapshots operations) and [ROSAAmazonEBSCSIDriverOperatorPolicy](https://us-east-1.console.aws.amazon.com/iam/home?region=eu-central-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FROSAAmazonEBSCSIDriverOperatorPolicy) policy names.
6. Click **Next**.
7. Under **Name, review, and create**, in the **Role details** section enter a name and description for the new IAM role.
8. Click **Create role**.
6. Launch the virtual machine from the relevant AMI template.
1. From the side menu, navigate to **Services** → **Compute** → **EC2**.
2. From the side menu, go to **Images** → **AMIs**.
3. Select the relevant AMI template from the newly created workflow, then select **Launch instance from AMI**.
4. Configure the virtual machine properties.
* Instance type: Verify the virtual machine memory meets the CPU and memory requirements. For more information, see [System Requirements](/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements.md).
* Network settings: Create a static IP. Conform to any security group requirements, including a subnet.
* Key pair (login): Under Key pair name - required, leave the default value **Proceed without a key pair**.
5. Under **Advanced details** → **IAM instance profile** select the created IAM role.
6. Select **Launch instance**. Confirm selecting **Proceed without key pair** and select **Launch instance** again.
7. Repeat these steps for each VM in a cluster.
8. For first time login, open an external terminal and use the `ssh admin` command to SSH log in. The default user name and password is `admin`. You can then give the admin a new password.\
#### Give the admin a new password
{% hint style="warning" %}
Save the SSH password securely. If you lose this password you cannot recover or change it, and to use SSH you will need to redeploy the cluster.
{% endhint %}
The password must be at least eight characters long and contain at least:
* One lower case letter
* One upper case letter
* One number, or one of the following special characters: !@#%
If this is not a first time login, you can log in from the web console or from a terminal using the `ssh admin@` command to SSH log in.
The textual UI menu opens with all the configuration and installation options.
#### Navigate the textual UI
* To start using the textual UI, click anywhere on the screen.
* To move between the menu items, use the up and down arrow keys. To select a menu item, press the Enter key.
* To navigate between fields within a menu item, use the Tab key. To save settings, tab to the Save button and press the Enter key.
* To go back to the menu from a specific menu item field, press the esc key.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.