> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/amazon-s3-configuration-example.md).

# Amazon S3 configuration example

Configure an Amazon S3 bucket, IAM credentials, and permissions for Cortex XSOAR 8 SaaS incident exports.

This example shows how to configure Amazon S3 external cloud storage for incident export in Cortex XSOAR 8 SaaS, covering the S3 bucket, IAM credentials, and required permissions. You can adapt these steps for other S3-compatible buckets.

For complete Amazon configuration instructions, see:

* [Amazon Simple Storage Solution (Amazon S3)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html)
* [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html)

{% hint style="warning" %}
Before you begin, ensure you have:

* An AWS account
* Access to the AWS Management Console
* Permission to create a stack and its resources in AWS CloudFormation
  {% endhint %}

{% stepper %}
{% step %}

### Configure an Amazon S3 bucket

1. Log in to the [AWS Management Console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html) and navigate to the S3 service.
2. Using the S3 console, [create or configure a general purpose bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html).
3. Record the bucket name and region for later.
   {% endstep %}

{% step %}

### Create IAM access keys

1. Open the [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html)service.
2. [Create a user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html). Cortex XSOAR uses this user to connect with the bucket you just created.
3. In the Security credentials tab, create an access key using the **Third-party service** use case. The secret key is automatically generated.
4. Record both keys for later.
   {% endstep %}

{% step %}

### Create an IAM role and permissions policy

1. In AWS Identity and Access Management (IAM), [create a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) and follow the wizard.
2. In Step 1, select **AWS service** as the trusted entity and **S3** as the use case. Click **Next**.
3. In Step 2, select **Permissions** → **Set permissions boundary - optional** → **Create role without a permissions boundary to** create a role. Click **Next**.
4. Enter a role name and description. Then define a custom policy with the following JSON:

   ```programlisting
   {
      "Version": "2012-10-17",
      "Statement": 
      [ 
         { 
            "Effect": "Allow",         
            "Action": [
               "s3:PutObject",
               "s3:GetObject",
               "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::YourBucketName/*"
         },
         {
            "Effect": "Allow","Action": "s3:ListBuckets",
            "Resource": "arn:aws:s3:::YourBucketName"
         }
      ]}
   ```

   In the above JSON, replace *YourBucketName* with your actual bucket name in two places. This automatically associates the policy with the bucket via the Amazon Resource Name (ARN).

   Save the role and policy.
   {% endstep %}
   {% endstepper %}

### Next steps

Configure [Configure access to external storage](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md) to export incidents to Amazon S3.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/amazon-s3-configuration-example.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.