Amazon Web Services provider permissions - List of Amazon Web Services (AWS) permissions for use during Cortex Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - Administrator Guide - Cortex XDR - Cortex

Abstract

List of Amazon Web Services (AWS) permissions for use during Cortex Cortex XDR onboarding to enable continuous monitoring in your cloud environment.

Notice

Requires a Cortex XDR license that has the Cloud Posture Security or Cloud Runtime Security add-on.

When onboarding Amazon Web Services (AWS), Cortex XDR generates a CloudFormation authentication template that provisions the IAM roles and policies it needs to monitor your cloud environment. This page enumerates every permission that template requests, grouped by security capability.

Important

All conditional capabilities documented below require the mandatory Base and Discovery Engine permissions to be deployed alongside them. Base provides the foundational CortexPlatformRole and AWS-managed read-only baseline. Discovery Engine extends that baseline with the asset-inventory coverage that every other capability assumes.

Base (and Discovery) permissions represent the foundational, mandatory role assignments required to successfully onboard your AWS environment to Cortex.

Deployed at every onboarding scope. Provides core asset discovery and CSPM scanning.

Cortex Platform Role: CortexPlatformRole

The primary customer-side IAM Role that Cortex assumes to perform read-only asset discovery and CSPM scanning. The role itself carries no inline statements at the Base level; it is backed entirely by AWS-managed read-only policies. Capability policies (Discovery, ADS, DSPM, Kubernetes, Automation) attach additional permissions to this same role.

Created when	Mandatory for onboarding scopes.
Trust	sts:AssumeRole from Cortex principal, gated by an sts:ExternalId condition. When DSPM is enabled, both the deployment-account `CortexPlatformRole` and every per-member-account copy (Account Group / Organization scope) additionally trust export.rds.amazonaws.com. This is required because RDS performs snapshot export to S3 under its own service principal, so it must be allowed to assume the role to write DSPM scan data into the Cortex S3 bucket.
Inline statements	None at Base level.
AWS-managed policies	`ReadOnlyAccess`, `SecurityAudit`, `AmazonMemoryDBReadOnlyAccess`, `AmazonSQSReadOnlyAccess`, `AWSOrganizationsReadOnlyAccess`
Cortex-managed policies	Required: `Cortex-DISCOVERY-Policy` Conditional by capability: `Cortex-ADS-Policy`, `Cortex-DSPM-Policy`, `Cortex-K8s-Security-Policy`, `Cortex-Automation-Policy`
Assignment scope	Deployment account; at Account Group / Organization scope. Also every member account under the target organizational unit.

CortexPlatformRole permissions:

Permission	Purpose
arn:aws:iam::aws:policy/AmazonMemoryDBReadOnlyAccess	Grant read-only access to Amazon MemoryDB resources in the account via an AWS-managed policy. Cortex uses this to discover and assess in-memory database configurations for data security posture management. This policy provides visibility into MemoryDB clusters and their settings without modifying any customer resources. (AWS-managed policy)
arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess	Grant read-only access to Amazon Simple Queue Service (SQS), allowing retrieval of SQS queue attributes, messages, and configurations. Cortex uses this AWS-managed policy to inventory message queues and assess their security configurations as part of asset discovery. This policy provides visibility into SQS resources without making any modifications. (AWS-managed policy)
arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess	Grant read-only access to AWS Organizations, allowing the ability to list and view organizational configurations, metadata, and structure. Cortex uses this AWS-managed policy to understand the multi-account organizational hierarchy and assess security posture across the organization. This policy provides visibility into organizational units and policies without making any modifications. (AWS-managed policy)
arn:aws:iam::aws:policy/ReadOnlyAccess	Grant comprehensive read-only access to AWS services and resources, allowing Cortex to list and view configurations, metadata, and logs across the account. Cortex uses this policy to inventory and assess the security posture of all AWS resources without making any modifications. This read-only access ensures complete visibility for security monitoring while maintaining a zero-impact footprint on customer workloads. (AWS-managed policy)
arn:aws:iam::aws:policy/SecurityAudit	Grant access to read security configuration metadata, allowing inspection of IAM configurations, security policies, CloudTrail logs, and other security-relevant settings. Cortex uses this AWS-managed policy to assess security configurations across AWS services for compliance and posture management. This policy provides security-focused read access without the ability to modify any configurations. (AWS-managed policy)

Onboarding Lambda Execution Role: CortexTemplateCustomLambdaExecutionRole

Used only during stack creation, a short-lived service role by the onboarding registration Lambda.

Created when	Mandatory. All onboarding scopes. Lambda runs once on stack CREATE
Trust	Service: `lambda.amazonaws.com` (`sts:AssumeRole`)
Inline statements	None
AWS-managed policies	AWS-managed `service-role/AWSLambdaBasicExecutionRole` (CloudWatch Logs write). At Organization scope only, also `AWS-managed AWSOrganizationsReadOnlyAccess`. The Lambda calls `organizations:DescribeOrganization` once on stack CREATE to read the customer's AWS Organizations metadata (management-account ID, root ID, feature set) so the StackSet can be configured to fan out the Cortex roles to the correct member accounts.
Lifecycle	Short-lived; used only during stack creation
Assignment scope	Deployment account only

The Discovery Engine permissions (and Base permissions) form the core of Cortex's visibility and asset inventory capabilities. These permissions provide the foundational access necessary for continuous asset discovery and Cloud Security Posture Management (CSPM) scanning across your cloud estate.

Discovery Policy: Cortex-DISCOVERY-Policy

Attached to CortexPlatformRole

A customer-managed policy that extends the Base capability's asset discovery coverage beyond what the AWS-managed ReadOnlyAccess and SecurityAudit policies cover.

Created when	Mandatory. Deployed alongside the Base capability.
Attached to	`CortexPlatformRole`
Read/write profile	Read-only

Cortex-DISCOVERY-Policy permissions:

Permission	Purpose
apigateway:GET	Retrieve API Gateway resource configurations including REST APIs, stages, and deployments. Cortex uses this permission to discover API Gateway assets and assess their security configurations.
appsync:GetApiCache	Retrieve AppSync API cache configuration details. Cortex uses this permission to inventory AppSync resources and evaluate caching security settings.
athena:GetCapacityReservation	Retrieve Athena capacity reservation details. Cortex uses this permission to inventory Athena analytics resources for security posture assessment.
athena:GetNamedQuery	Retrieve details of a saved Athena named query. Cortex uses this permission to discover Athena query resources and assess data access patterns.
athena:ListCapacityReservations	List Athena capacity reservations in the account. Cortex uses this permission to discover all Athena capacity resources for asset inventory.
athena:ListDatabases	List databases within an Athena data catalog. Cortex uses this permission to inventory Athena database resources for security posture assessment.
athena:ListDataCatalogs	List Athena data catalogs in the account. Cortex uses this permission to discover data catalog resources and assess data governance configurations.
athena:ListNamedQueries	List saved Athena named queries. Cortex uses this permission to discover Athena query resources for asset inventory.
backup:DescribeFramework	Retrieve details of an AWS Backup framework. Cortex uses this permission to assess backup compliance frameworks and evaluate data protection posture.
backup:DescribeReportPlan	Retrieve details of an AWS Backup report plan. Cortex uses this permission to evaluate backup reporting configurations for compliance assessment.
backup:ListFrameworks	List AWS Backup frameworks in the account. Cortex uses this permission to discover backup compliance frameworks for security posture assessment.
backup:ListReportPlans	List AWS Backup report plans in the account. Cortex uses this permission to discover backup reporting configurations for compliance assessment.
backup:ListTags	List tags associated with AWS Backup resources. Cortex uses this permission to correlate backup resources with organizational tagging policies.
batch:DescribeSchedulingPolicies	Retrieve details of AWS Batch scheduling policies. Cortex uses this permission to inventory Batch compute resources and assess scheduling configurations.
batch:ListSchedulingPolicies	List AWS Batch scheduling policies in the account. Cortex uses this permission to discover Batch scheduling resources for asset inventory.
cloudwatch:DescribeAlarms	Retrieve information about all CloudWatch alarms configured in the account. Cortex uses this to assess monitoring coverage and identify gaps in alerting configurations as part of asset discovery. This read-only operation provides visibility into alarm states and thresholds without modifying any monitoring settings.
codebuild:BatchGetReportGroups	Retrieve details of CodeBuild report groups. Cortex uses this permission to inventory CI/CD reporting resources and assess build pipeline configurations.
codebuild:ListReportGroups	List CodeBuild report groups in the account. Cortex uses this permission to discover CI/CD reporting resources for asset inventory.
codedeploy:BatchGetApplications	Retrieve details of CodeDeploy applications. Cortex uses this permission to inventory deployment applications and assess CI/CD security configurations.
codedeploy:GetDeploymentConfig	Retrieve a CodeDeploy deployment configuration. Cortex uses this permission to evaluate deployment configurations for security best practices.
codedeploy:GetDeploymentGroup	Retrieve details of a CodeDeploy deployment group. Cortex uses this permission to assess deployment group configurations and target environment settings.
codedeploy:ListApplications	List CodeDeploy applications in the account. Cortex uses this permission to discover deployment applications for CI/CD asset inventory.
codedeploy:ListDeploymentConfigs	List CodeDeploy deployment configurations. Cortex uses this permission to discover deployment configurations for CI/CD asset inventory.
codedeploy:ListDeploymentGroups	List deployment groups for a CodeDeploy application. Cortex uses this permission to discover deployment targets for CI/CD asset inventory.
codedeploy:ListTagsForResource	List tags for CodeDeploy resources. Cortex uses this permission to correlate CodeDeploy resources with organizational tagging policies.
comprehend:ListEntityRecognizers	List Amazon Comprehend entity recognizers. Cortex uses this permission to discover machine learning resources for asset inventory and security assessment.
comprehend:ListTagsForResource	List tags for Amazon Comprehend resources. Cortex uses this permission to correlate Comprehend resources with organizational tagging policies.
comprehendmedical:ListEntitiesDetectionV2Jobs	List entity detection jobs in Amazon Comprehend Medical. Cortex uses this to discover and inventory healthcare AI resources in the account as part of comprehensive asset discovery. This read-only operation ensures visibility into AI/ML workloads without affecting any running jobs.
config:DescribeAggregationAuthorizations	Retrieve AWS Config aggregation authorization details. Cortex uses this permission to assess cross-account Config aggregation settings for compliance monitoring.
connect-campaigns:DescribeCampaign	Retrieve details about a specific Amazon Connect outbound campaign. Cortex uses this to inventory contact center resources and assess their configurations as part of asset discovery. This read-only operation does not modify any campaign settings.
connect-campaigns:ListCampaigns	Provide a summary of all Amazon Connect outbound campaigns in the account. Cortex uses this to discover and inventory contact center resources for comprehensive security posture assessment. This read-only operation does not affect any campaign configurations.
controltower:GetLandingZone	Retrieve configuration details for an AWS Control Tower landing zone. Cortex uses this to assess Control Tower governance configurations and understand the multi-account management setup as part of asset discovery. This read-only operation does not modify any landing zone settings.
controltower:ListLandingZones	List all AWS Control Tower landing zones in the account. Cortex uses this to discover Control Tower deployments and assess governance configurations as part of comprehensive asset discovery. This read-only operation provides visibility into multi-account management without making changes.
controltower:ListTagsForResource	List tags associated with AWS Control Tower resources. Cortex uses this to understand resource organization, ownership, and classification as part of asset discovery. This read-only operation helps maintain comprehensive visibility into resource metadata.
directconnect:DescribeConnections	List all AWS Direct Connect connections and their attributes in the account. Cortex uses this to inventory hybrid connectivity resources and assess network configurations for security posture management. This read-only operation does not modify any connection settings.
directconnect:DescribeDirectConnectGateways	Retrieve details about AWS Direct Connect gateways. Cortex uses this to discover and inventory network connectivity configurations as part of comprehensive asset discovery. This read-only operation provides visibility into hybrid network architecture without making changes.
directconnect:DescribeVirtualInterfaces	Display all virtual interfaces configured for the AWS account. Cortex uses this to inventory Direct Connect configurations and assess network connectivity for security analysis. This read-only operation does not modify any virtual interface settings.
ds:DescribeDirectories	Retrieve information about AWS Directory Service directories in the account. Cortex uses this to discover Active Directory configurations and assess identity infrastructure as part of asset discovery. This read-only operation provides visibility into directory services without modifying any settings.
ds:ListLogSubscriptions	List log subscriptions for AWS Directory Service directories. Cortex uses this permission to assess directory logging configurations for identity security monitoring.
ds:ListTagsForResource	List tags associated with a specific AWS Directory Service resource. Cortex uses this to understand directory resource organization and ownership as part of asset discovery. This read-only operation helps maintain comprehensive visibility into resource metadata.
ecs:DescribeCapacityProviders	Retrieve details of ECS capacity providers. Cortex uses this permission to inventory container compute capacity resources for security assessment.
forecast:ListTagsForResource	List tags associated with an Amazon Forecast resource. Cortex uses this to understand ML resource organization and ownership as part of comprehensive asset discovery. This read-only operation provides visibility into resource metadata without affecting any Forecast configurations.
glue:GetBlueprint	Retrieve details about an AWS Glue blueprint. Cortex uses this to inventory ETL configurations and assess data pipeline setups as part of asset discovery. This read-only operation does not modify any Glue resources.
glue:GetBlueprintRun	Retrieve details about a specific AWS Glue blueprint run. Cortex uses this to assess Glue workflow executions and understand data pipeline activity as part of asset discovery. This read-only operation does not affect any running workflows.
glue:GetBlueprintRuns	List execution history for AWS Glue blueprint runs. Cortex uses this to discover Glue execution history and assess data pipeline activity patterns as part of asset discovery. This read-only operation does not modify any Glue resources.
glue:GetConnection	Retrieve details of a Glue data connection. Cortex uses this permission to assess data integration connection configurations and security settings.
glue:GetConnections	List Glue data connections in the account. Cortex uses this permission to discover data integration endpoints and evaluate their security posture.
glue:GetMLTransforms	List Glue machine learning transforms. Cortex uses this permission to discover ML data processing resources for asset inventory.
glue:GetSecurityConfigurations	Retrieve security configurations for AWS Glue. Cortex uses this to assess Glue encryption and security settings, ensuring data pipeline security as part of asset discovery. This read-only operation provides visibility into security configurations without making changes.
glue:GetTags	Retrieve tags for Glue resources. Cortex uses this permission to correlate data pipeline resources with organizational tagging policies.
glue:ListBlueprints	List all AWS Glue blueprints in the account. Cortex uses this to discover Glue ETL configurations and inventory data pipeline resources as part of comprehensive asset discovery. This read-only operation does not modify any Glue resources.
guardduty:DescribePublishingDestination	Retrieve details of a GuardDuty finding export destination. Cortex uses this permission to assess threat detection reporting configurations for security monitoring.
guardduty:ListDetectors	List GuardDuty detectors in the account. Cortex uses this permission to discover threat detection resources and verify GuardDuty is enabled.
guardduty:ListPublishingDestinations	List GuardDuty finding export destinations. Cortex uses this permission to assess threat detection reporting configurations for security monitoring.
imagebuilder:GetDistributionConfiguration	Retrieve an EC2 Image Builder distribution configuration. Cortex uses this permission to assess image distribution settings for security posture evaluation.
imagebuilder:GetImage	Retrieve details of an EC2 Image Builder image. Cortex uses this permission to assess image configurations and identify security-relevant build settings.
imagebuilder:GetWorkflow	Retrieve details of an EC2 Image Builder workflow. Cortex uses this permission to assess image build workflow configurations for security evaluation.
imagebuilder:ListDistributionConfigurations	List EC2 Image Builder distribution configurations. Cortex uses this permission to discover image distribution resources for asset inventory.
imagebuilder:ListImageBuildVersions	List build versions for an EC2 Image Builder image. Cortex uses this permission to inventory image build history for security assessment.
imagebuilder:ListImages	List EC2 Image Builder images. Cortex uses this permission to discover image resources for asset inventory and security assessment.
imagebuilder:ListWorkflows	List EC2 Image Builder workflows. Cortex uses this permission to discover image build workflow resources for asset inventory.
kafka:ListClustersV2	List Amazon MSK (Managed Streaming for Apache Kafka) clusters. Cortex uses this permission to discover streaming data resources for asset inventory and security assessment.
lakeformation:DescribeLakeFormationIdentityCenterConfiguration	Retrieve the AWS Lake Formation Identity Center configuration. Cortex uses this to assess data lake access configurations and identity governance as part of asset discovery. This read-only operation does not modify any Lake Formation settings.
lakeformation:GetLFTag	Retrieve details about a specific AWS Lake Formation tag. Cortex uses this to understand data lake governance configurations and tag-based access control as part of asset discovery. This read-only operation does not modify any Lake Formation resources.
lakeformation:ListLFTags	List all AWS Lake Formation tags in the account. Cortex uses this to discover Lake Formation tag configurations and assess data governance policies as part of asset discovery. This read-only operation provides visibility into tag-based access controls without making changes.
logs:DescribeSubscriptionFilters	List CloudWatch Logs subscription filters. Cortex uses this permission to assess log delivery configurations for security monitoring evaluation.
logs:GetDataProtectionPolicy	Retrieve the data protection policy for a CloudWatch Logs log group. Cortex uses this permission to assess sensitive data protection configurations for compliance evaluation.
logs:ListTagsLogGroup	List tags for a CloudWatch Logs log group. Cortex uses this permission to correlate log group resources with organizational tagging policies.
memorydb:DescribeSnapshots	Retrieve information about Amazon MemoryDB cluster snapshots. Cortex uses this to inventory in-memory database backups and assess data protection configurations as part of asset discovery. This read-only operation does not modify any snapshot settings.
memorydb:DescribeSubnetGroups	Retrieve a list of Amazon MemoryDB subnet groups. Cortex uses this to assess MemoryDB network configurations and understand database connectivity as part of asset discovery. This read-only operation does not modify any network settings.
mq:DescribeConfiguration	Retrieve details of an Amazon MQ broker configuration. Cortex uses this permission to assess message broker configuration settings for security evaluation.
mq:ListConfigurations	List Amazon MQ broker configurations. Cortex uses this permission to discover message broker configuration resources for asset inventory.
quicksight:DescribeUser	Retrieve details of a QuickSight user. Cortex uses this permission to assess business intelligence user configurations for access security evaluation.
quicksight:DescribeVPCConnection	Retrieve details of a QuickSight VPC connection. Cortex uses this permission to assess business intelligence network connectivity for security evaluation.
quicksight:ListUsers	List QuickSight users in the account. Cortex uses this permission to discover business intelligence user accounts for access security assessment.
quicksight:ListVPCConnections	List QuickSight VPC connections. Cortex uses this permission to discover business intelligence network connections for security assessment.
rds:DescribeDBClusterSnapshots	List RDS database cluster snapshots. Cortex uses this permission to discover database snapshots for data security posture management scanning.
rds:DescribeDBSubnetGroups	List RDS database subnet groups. Cortex uses this permission to assess database network configurations and subnet placement for security evaluation.
rds:DescribeGlobalClusters	List RDS global database clusters. Cortex uses this permission to discover cross-region database deployments for security posture assessment.
rds:ListTagsForResource	List tags for RDS resources. Cortex uses this permission to correlate database resources with organizational tagging policies.
redshift:DescribeClusterSubnetGroups	List Redshift cluster subnet groups. Cortex uses this permission to assess data warehouse network configurations for security evaluation.
redshift:DescribeEndpointAccess	List Redshift endpoint access configurations. Cortex uses this permission to assess data warehouse endpoint exposure for network security evaluation.
redshift-serverless:GetEndpointAccess	Retrieve details of a Redshift Serverless endpoint access configuration. Cortex uses this permission to assess serverless data warehouse endpoint exposure for security evaluation.
redshift-serverless:GetNamespace	Retrieve details of a Redshift Serverless namespace. Cortex uses this permission to assess serverless data warehouse configurations for security evaluation.
redshift-serverless:ListEndpointAccess	List Redshift Serverless endpoint access configurations. Cortex uses this permission to assess serverless data warehouse endpoint exposure for security evaluation.
redshift-serverless:ListNamespaces	List Redshift Serverless namespaces. Cortex uses this permission to discover serverless data warehouse resources for asset inventory.
redshift-serverless:ListSnapshots	List Redshift Serverless snapshots. Cortex uses this permission to inventory serverless data warehouse snapshots for data protection assessment.
redshift-serverless:ListTagsForResource	List tags for Redshift Serverless resources. Cortex uses this permission to correlate serverless data warehouse resources with organizational tagging policies.
sagemaker:DescribeDataQualityJobDefinition	Retrieve details of a SageMaker data quality monitoring job definition. Cortex uses this permission to assess ML data quality monitoring configurations for security evaluation.
sagemaker:DescribeFeatureGroup	Retrieve details of a SageMaker feature group. Cortex uses this permission to inventory ML feature store resources for data security assessment.
sagemaker:DescribeFlowDefinition	Retrieve details of a SageMaker human review workflow definition. Cortex uses this permission to assess ML workflow configurations for security evaluation.
sagemaker:DescribeModelPackageGroup	Retrieve details of a SageMaker model package group. Cortex uses this permission to inventory ML model registry resources for security assessment.
sagemaker:DescribePipeline	Retrieve details of a SageMaker ML pipeline. Cortex uses this permission to assess ML pipeline configurations for security evaluation.
sagemaker:DescribeProject	Retrieve details of a SageMaker project. Cortex uses this permission to inventory ML project resources for security posture assessment.
sagemaker:ListDataQualityJobDefinitions	List SageMaker data quality monitoring job definitions. Cortex uses this permission to discover ML data quality monitoring resources for asset inventory.
sagemaker:ListFeatureGroups	List SageMaker feature groups. Cortex uses this permission to discover ML feature store resources for data security assessment.
sagemaker:ListFlowDefinitions	List SageMaker human review workflow definitions. Cortex uses this permission to discover ML workflow resources for asset inventory.
sagemaker:ListImages	List SageMaker container images. Cortex uses this permission to discover ML container image resources for security assessment.
sagemaker:ListModelPackageGroups	List SageMaker model package groups. Cortex uses this permission to discover ML model registry resources for asset inventory.
sagemaker:ListProjects	List SageMaker projects. Cortex uses this permission to discover ML project resources for asset inventory.
sagemaker:ListTags	List tags for SageMaker resources. Cortex uses this permission to correlate ML resources with organizational tagging policies.
securityhub:GetFindingAggregator	Retrieve a Security Hub finding aggregator configuration. Cortex uses this permission to assess cross-region security finding aggregation for posture evaluation.
securityhub:ListFindingAggregators	List Security Hub finding aggregators. Cortex uses this permission to discover security finding aggregation configurations for posture assessment.
servicecatalog:DescribePortfolio	Retrieve details of a Service Catalog portfolio. Cortex uses this permission to assess service governance configurations for security evaluation.
servicecatalog:SearchProvisionedProducts	Search for provisioned Service Catalog products. Cortex uses this permission to discover provisioned service resources for asset inventory and governance assessment.
ssm:ListResourceDataSync	List Systems Manager resource data sync configurations. Cortex uses this permission to assess systems management data synchronization for security monitoring.
workspaces:DescribeTags	List tags associated with Amazon WorkSpaces resources. Cortex uses this to understand WorkSpaces resource organization and ownership as part of asset discovery. This read-only operation provides visibility into resource metadata without affecting any WorkSpaces configurations.
workspaces:DescribeWorkspaceDirectories	Retrieve details about Amazon WorkSpaces directories. Cortex uses this to inventory WorkSpaces directory configurations and assess identity integration as part of asset discovery. This read-only operation does not modify any directory settings.
workspaces:DescribeWorkspaces	List and describes Amazon WorkSpaces instances in the account. Cortex uses this to discover virtual desktop resources and assess their configurations for security posture management. This read-only operation does not modify any WorkSpaces settings.
xray:GetGroups	Retrieve X-Ray trace groups. Cortex uses this permission to discover application tracing configurations for observability asset inventory.
xray:GetSamplingRules	Retrieve X-Ray sampling rules. Cortex uses this permission to assess application tracing sampling configurations for observability evaluation.
xray:ListTagsForResource	List tags for X-Ray resources. Cortex uses this permission to correlate application tracing resources with organizational tagging policies.

Conditional (opt-in). Routes AWS CloudTrail logs to a Cortex-owned pipeline, read by Cortex via OIDC federation.

CloudTrail Read Role: cortex-logs-ingestion-access

The customer-side IAM Role that Cortex assumes to read CloudTrail log objects.

The attached CloudTrailReadAccessPolicy is scoped exclusively to Cortex-created resources, with no access to any other S3 bucket, SQS queue, or KMS key in the customer's account.

Created when	Audit Logs enabled with Automatic collection mode
Trust	`sts:AssumeRoleWithWebIdentity` from a Cortex-controlled identity federated through Google's OIDC provider, gated by `accounts.google.com:oaud` and `accounts.google.com:sub` conditions
Attached policy	`CloudTrailReadAccessPolicy`
Assignment scope	Deployment account only

CloudTrail Read Policy: CloudTrailReadAccessPolicy

Attached to cortex-logs-ingestion-access.

A customer-managed policy that grants Cortex read access to the CloudTrail logs S3 bucket, the SQS notification queue, and the KMS key used to encrypt them.

Created when	Audit Logs enabled with Automatic collection mode.
Attached to	`cortex-logs-ingestion-access`
Read/write profile	Read-only
Resource scoping	Exclusively Cortex-created resources (S3 logs bucket, SQS notification queue, KMS key), with no access to any other S3 bucket, SQS queue, or KMS key in the customer's account.

CloudTrailReadAccessPolicy permissions:

Permission	Purpose	Scope
kms:Decrypt	Decrypt the encrypted log files stored in the Cortex log bucket. Cortex uses a dedicated, Cortex-created encryption resource that is scoped exclusively to the Cortex log bucket and can't be used to decrypt any customer data.	The Cortex-created CloudTrail KMS key only: `arn:aws:kms:<region>:<account-id>:key/<CloudTrailKMSKey>`
s3:GetObject	Download a CloudTrail log file after AWS notifies Cortex that it has been written. This permission is scoped to the Cortex-created log bucket only.	Objects in the Cortex-created log bucket only: `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>/*`
s3:ListBucket	View the list of log files in the Cortex-created log bucket. AWS requires this permission alongside s3:GetObject for downloads to succeed, and it is scoped to the Cortex-created log bucket only.	The Cortex-created log bucket only: `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>`
sqs:ChangeMessageVisibility	Briefly extend the processing lock on large log files so that AWS doesn't resend the notification before ingestion completes. This permission is scoped to the Cortex-created queue only.	The Cortex-created notification queue only: `arn:aws:sqs:<region>:<account-id>:cortex-ct-logs-queue-<account-id>-<tenant-id>`
sqs:DeleteMessage	Remove a notification from the queue after successful ingestion so that the same log file is not processed twice. This permission is scoped to the Cortex-created queue only.	The Cortex-created notification queue only: `arn:aws:sqs:<region>:<account-id>:cortex-ct-logs-queue-<account-id>-<tenant-id>`
sqs:GetQueueAttributes	Check the pending notification count to support backlog tracking and queue health monitoring. This read-only permission is scoped to the Cortex-created queue only.	The Cortex-created notification queue only: `arn:aws:sqs:<region>:<account-id>:cortex-ct-logs-queue-<account-id>-<tenant-id>`
sqs:ReceiveMessage	Read "new log file is ready" notifications from the Cortex-created queue to trigger log ingestion. This permission is scoped to the Cortex-created queue only.	The Cortex-created notification queue only: `arn:aws:sqs:<region>:<account-id>:cortex-ct-logs-queue-<account-id>-<tenant-id>`

Stack Lifecycle Role: EmptyBucketLambdaExecutionRole

An in-account IAM role used exclusively by an AWS Lambda custom resource that the Cortex onboarding CloudFormation template provisions to support stack lifecycle operations. Specifically, it empties a Cortex-provisioned S3 bucket of all objects, object versions, and delete markers so that CloudFormation can delete the bucket during stack teardown.

This role is not accessible to Cortex. Cortex has no trust relationship to it and cannot assume, invoke, or otherwise use it. It is invoked only by the AWS Lambda service inside the customer's own AWS account.

Created when	Created automatically by any Cortex onboarding template that provisions an S3 bucket which must be emptied before deletion. For example: DSPM scan-results buckets, log/CloudTrail buckets, or Automation artifact buckets.
Lifecycle	Bound 1:1 to the parent CloudFormation stack. The role is removed when the stack is deleted.
Trust	`sts:AssumeRole` from the AWS Lambda service principal (`lambda.amazonaws.com`) only. No Cortex principal is listed in the trust policy and no `sts:ExternalId` condition is present, because no external party, including Cortex, is ever permitted to assume this role.

Bucket Cleanup Policy: EmptyS3BucketPolicy

Attached to EmptyBucketLambdaExecutionRole

A customer-managed policy that grants the cleanup Lambda the S3 list/delete permissions needed to empty the CloudTrail logs bucket on stack deletion.

Created when	Audit Logs enabled.
Attached to	`EmptyBucketLambdaExecutionRole`
Resource scoping	Cortex-created CloudTrail logs S3 bucket only.
Lifecycle	Exercised only on stack deletion.

EmptyS3BucketPolicy permissions:

Permission	Purpose	Scope
s3:DeleteObject	Delete an object from an S3 bucket. Cortex uses this permission to remove temporary scan artifacts after scanning and processing is complete.	The Cortex-created CloudTrail logs bucket only: `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>` and `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>/*`
s3:DeleteObjectVersion	Delete a specific, version-controlled instance of an object from an S3 bucket. Cortex uses this permission to permanently remove older or duplicated versions of temporary scan artifacts, preventing unnecessary storage costs and ensuring the S3 bucket is completely emptied upon stack deletion.	The Cortex-created CloudTrail logs bucket only: `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>` and `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>/*`
s3:ListBucket	List the contents of the CloudTrail logs S3 bucket. Cortex uses this to discover available log files for ingestion, enabling continuous and complete security monitoring of AWS environments.	The Cortex-created CloudTrail logs bucket only: `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>` and `arn:aws:s3:::cortex-ct-logs-<account-id>-<tenant-id>/*`

A customer-managed policy that ADS attaches to the Base capability's CortexPlatformRole. ADS does not create a separate IAM Role.

ADS Policy: Cortex-ADS-Policy

Attached to CortexPlatformRole

A customer-managed policy that ADS attaches to the Base capability's CortexPlatformRole. ADS does not create a separate IAM Role.

Created when	Agentless Disk Scanning capability enabled.
Attached to	`CortexPlatformRole`
Tag scoping	All write/delete actions scoped to tag managed_by=paloaltonetworks, so Cortex can only modify snapshots and images Cortex itself created.
Condition scoping	KMS grants scoped to `kms:ViaService = ec2.*.amazonaws.com`.

Cortex-ADS-Policy permissions:

Permission	Purpose	Scope
ec2:CopyImage	Copy encrypted Amazon Machine Images (AMIs) along with their associated snapshots for agentless disk scanning. The tagging condition ensures that any snapshots created during the copy operation are properly tagged, providing clear resource ownership and enabling automated cleanup after scanning completes.	`ec2:::image/` (no condition) `ec2:::snapshot/` where `aws:RequestTag/managed_by = paloaltonetworks`
ec2:CopySnapshot	Create destination snapshots during the copy operation for agentless disk scanning. Cortex uses this to complete the re-encryption process, ensuring all newly created snapshot copies are properly labeled for lifecycle management and automated cleanup after analysis.	Source — `ec2:::snapshot/snap-` where `aws:ResourceTag/managed_by = paloaltonetworks` Destination — `ec2:::snapshot/${}` where `aws:RequestTag/managed_by = paloaltonetworks` (the `${*}` suffix is the `CopySnapshotSuffix` parameter default that constrains the destination snapshot's name pattern)
ec2:CreateSnapshot	Create new snapshots and tag them during the creation process for agentless disk scanning. Cortex uses this to ensure all snapshots it creates are properly identified for tracking, cost visibility, and automated cleanup after scanning completes.	Volume access — `ec2:::volume/` (no condition) Snapshot creation — `ec2:::snapshot/*` where `aws:RequestTag/managed_by = paloaltonetworks`
ec2:CreateSnapshots	Create snapshots in batch and tag them during the creation process for agentless disk scanning. Cortex uses this to ensure all batch-created snapshots are properly identified for tracking, cost visibility, and automated cleanup after scanning completes.	Source resources — `ec2:::instance/` AND `ec2:::volume/` (no condition) Snapshot output — `ec2:::snapshot/` where `aws:RequestTag/managed_by = paloaltonetworks`
ec2:CreateTags	Apply tags to snapshots and images created by Cortex during ADS scanning. Tagging is gated by the `ec2:CreateAction` condition so this permission can only tag resources that were just created by one of the listed actions in the same API call — it cannot be used to tag arbitrary existing resources.	Snapshots — `ec2:::snapshot/` where `ec2:CreateAction ∈ [CreateSnapshot, CopySnapshot, CreateSnapshots, CopyImage]` Images — `ec2:::image/` where `ec2:CreateAction = CopyImage` AND `aws:RequestTag/managed_by = paloaltonetworks`
ec2:DeleteSnapshot	Delete temporary snapshots after agentless disk scanning completes. Cortex removes snapshots it created during the scanning process to minimize storage costs and maintain a clean customer environment. Customer-owned snapshots are never affected.	`ec2:::snapshot/` where `ec2:ResourceTag/managed_by = paloaltonetworks`
ec2:DeregisterImage	Deregister temporary AMI images created during the agentless disk scanning process. Cortex removes these ephemeral re-encrypted images after scanning completes to prevent orphaned resources and unnecessary costs. Customer-owned images are never affected.	`ec2:::image/` where `ec2:ResourceTag/managed_by = paloaltonetworks`
ec2:DescribeImages	Retrieve the status and metadata of EC2 images during agentless disk scanning operations. Cortex uses this read-only permission to monitor image creation progress and verify that copied images are ready for scanning. No modifications are made to any customer resources.	`*` (no condition)
ec2:DescribeSnapshots	Retrieve the status and metadata of EBS snapshots during agentless disk scanning operations. Cortex uses this read-only permission to monitor snapshot creation progress and verify that snapshots are ready for scanning. No modifications are made to any customer resources.	`*` (no condition)
ec2:ModifySnapshotAttribute	Share snapshots with the Palo Alto Networks outpost scanning account for agentless disk analysis. Cortex modifies snapshot attributes to grant cross-account access so that the scanning infrastructure can analyze disk contents. Customer-owned snapshots are never shared.	`ec2:::snapshot/` where `ec2:Add/userId = ${OutpostAccountId}` AND `ec2:ResourceTag/managed_by = paloaltonetworks`
kms:CreateGrant	Create KMS grants that authorize the EC2 service to perform the cryptographic operations required for cross-account agentless disk scanning. Two separate grants are issued: one against the source (customer) key to allow Decrypt and Encrypt for snapshot re-encryption, and one against the Cortex ADS scanning key to allow Encrypt only on the destination.	Source key grant (any account) — `kms:::key/` where `kms:ViaService LIKE ec2..amazonaws.com` AND `kms:GrantIsForAWSResource = true` AND `kms:GrantOperations ⊆ [Decrypt, Encrypt]` Cortex ADS key grant (Cortex account only) — `kms::${KmsAccountADS}:key/` where `kms:ViaService LIKE ec2.*.amazonaws.com` AND `kms:GrantIsForAWSResource = true` AND `kms:GrantOperations ⊆ [Encrypt]`
kms:DescribeKey	Read KMS key metadata such as algorithm, state, and key usage on Cortex-managed KMS keys in the Cortex ADS scanning account. AWS requires this metadata before any cryptographic operation against those keys can be performed during agentless disk scanning. Restricted to keys in the Cortex ADS KMS account, and only when the call is made via the EC2 service.	`kms::${KmsAccountADS}:key/` where `StringLike kms:ViaService = ec2.*.amazonaws.com`
kms:GenerateDataKeyWithoutPlaintext	Obtain an encrypted data key from the Cortex-managed ADS KMS key for envelope encryption of EBS snapshots being re-encrypted into the Cortex scanning account during cross-account agentless disk scanning. The plaintext form of the data key is never returned to Cortex. Restricted to keys in the Cortex ADS KMS account, and only when invoked via the EC2 service.	`kms::${KmsAccountADS}:key/` where `StringLike kms:ViaService = ec2.*.amazonaws.com`

Conditional (opt-in). Lets Cortex pull customer container images from Amazon ECR for security scanning.

Cortex Scanner Role: CortexPlatformScannerRole

A second customer-side IAM Role (distinct from CortexPlatformRole) created whenever any of Registry Scanning, DSPM, or Serverless Scanning is enabled.

Created when	Any of Registry Scanning, Serverless Scanning, or DSPM capabilities are enabled.
Trust	`sts:AssumeRole` from Cortex scanners principal, gated by `sts:ExternalId` condition
Inline statements	None
AWS-managed policies	`ReadOnlyAccess`
Cortex-managed policies	Conditional by capability: Registry Scan: `ECRAccessPolicy` Serverless Scan: `LAMBDAAccessPolicy` DSPM: `Cortex-DSPM-Scanner-Policy`
Assignment scope	Deployment account; at Account Group / Organization scope. Also every member account under the target organizational unit.

Registry Scanning Policy: ECRAccessPolicy

Attached to CortexPlatformScannerRole

A customer-managed policy that adds ECR pull access to the shared scanner role.

Created when	Registry scanning capability enabled.
Attached to	`CortexPlatformScannerRole`
Function	ECR pull access

ECRAccessPolicy permissions:

Permission	Purpose
ecr:BatchGetImage	Retrieve detailed information for container images stored in Amazon ECR, which is required to pull the image. Cortex uses this permission to download container images for vulnerability scanning, identifying security issues in containerized workloads. This read-only operation does not modify any images or registry configurations.
ecr:GetDownloadUrlForLayer	Fetches the download URL for the individual layers that make up a container image in Amazon ECR. Cortex uses this as part of the image pull process to efficiently download each layer for vulnerability scanning and security analysis. This is a read-only operation that does not modify any registry content.
ecr:GetAuthorizationToken	Creates a temporary login token for authenticating with Amazon ECR. Cortex requires this token to securely authenticate before pulling container images for vulnerability scanning. The token is short-lived and used solely for read-only image retrieval operations during registry scanning.

Conditional (opt-in). Lets Cortex read AWS Lambda function code, configuration, and layer versions for security scanning. Read-only: no invoke, update, or delete.

Serverless Scanning Policy: LAMBDAAccessPolicy

A customer-managed policy that Serverless Scanning attaches to the shared CortexPlatformScannerRole.

Created when	Serverless Scanning capability enabled.
Attached to	`CortexPlatformScannerRole`
Read/write profile	Read-only access to Lambda function code, configuration, and layer versions. No invoke, update, or delete.

LAMBDAAccessPolicy permissions:

Permission	Purpose
lambda:GetFunction	Retrieve a Lambda function's configuration along with a presigned URL to download its deployment package (code zip or container image manifest). Cortex uses this presigned URL to pull the function's code into the scanner so it can be statically analyzed for vulnerabilities, malware, and embedded secrets.
lambda:GetFunctionConfiguration	Retrieve a Lambda function's configuration metadata (runtime, handler, environment variables, layers, execution role, VPC settings, and timeout) without returning the code download URL. Cortex uses these settings to determine how to interpret the function (runtime/handler), which layers must also be fetched, and to flag risky configuration such as plaintext secrets in environment variables.
lambda:GetLayerVersion	Retrieve a specific version of a Lambda layer, including a presigned URL to download the layer's content. Cortex uses this to download every layer referenced by a scanned function so the layer code is included in the same vulnerability, malware, and secrets analysis applied to the function itself.

Conditional (opt-in). Discovers, classifies, and assesses customer data assets across S3, RDS, DynamoDB, Redshift, and EBS. Unlike CSPM, DSPM reads actual customer data content (object samples and database rows) for sensitive-data classification.

DSPM Policy: Cortex-DSPM-Policy

A customer-managed policy that DSPM attaches to the Base capability's CortexPlatformRole. Grants the lifecycle and read permissions DSPM needs to discover sensitive data, orchestrate snapshot exports, and prepare data for the scanner role to actually read.

Attached to CortexPlatformRole

Created when	DSPM capability enabled
Attached to	`CortexPlatformRole`
Tag scoping	Destructive RDS / Redshift snapshot deletes scoped to tag `managed_by=paloaltonetworks` (Cortex-owned snapshots only).
Resource scoping	S3 `read = ` because DSPM discovers sensitive data in arbitrary buckets; S3 write/delete limited to the `Cortex-internal cortex-artifact` buckets.

Cortex-DSPM-Policy permissions:

Permission	Purpose	Scope
cloudwatch:GetMetricStatistics	Read service usage metrics from CloudWatch. Cortex uses this to size DSPM scan operations and monitor resource consumption.	`*` (no condition)
dynamodb:DescribeTable	Read DynamoDB table schemas and configurations. Cortex uses this to discover and assess DynamoDB tables as data assets.	`dynamodb::${AWS::AccountId}:table/` (no condition)
iam:PassRole	Pass the CortexPlatformRole to the RDS service so that RDS can write exported snapshot data to the Cortex S3 bucket on Cortex's behalf. Restricted to rds.amazonaws.com.	`iam::${AWS::AccountId}:role/${CortexPlatformRoleName}*` where `iam:PassedToService = rds.amazonaws.com`
kms:CreateGrant	Create KMS grants that authorize the RDS export service to use customer or Cortex KMS keys when writing encrypted snapshot data to S3. Grant scoped to AWS resources only.	`kms:::key/*` where `Bool kms:GrantIsForAWSResource = true`
kms:DescribeKey	Read Cortex-managed KMS key metadata. Cortex uses this to perform encrypted snapshot export and re-encryption.	`kms::${MTKmsAccountDSPM}:key/` (no condition)
kms:GenerateDataKeyWithoutPlaintext	Generate envelope-encryption data keys without exposing plaintext. Cortex uses this to protect exported snapshot data.	`kms::${MTKmsAccountDSPM}:key/` (no condition)
rds:AddTagsToResource	Add tags to RDS resources. Cortex uses this to tag Cortex-created snapshots with the `managed_by=paloaltonetworks` tag, enabling safe lifecycle management and cleanup.	`*` (no condition)
rds:CreateDBClusterSnapshot	Create a point-in-time snapshot of an RDS cluster. Cortex uses this to capture cluster state for scanning.	`*` (no condition)
rds:CreateDBSnapshot	Create a point-in-time snapshot of an RDS instance. Cortex uses this to capture instance state so that DSPM can scan it without impacting production.	`*` (no condition)
rds:DeleteDBClusterSnapshot	Delete RDS cluster snapshots. Cortex uses this to clean up Cortex-created cluster snapshots after scanning, minimizing storage cost. Restricted to resources with the `managed_by=paloaltonetworks` tag.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
rds:DeleteDBSnapshot	Delete RDS database snapshots. Cortex uses this to clean up Cortex-created instance snapshots after scanning, minimizing storage cost. Restricted to resources carrying the `managed_by=paloaltonetworks` tag.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
rds:DescribeDBClusters	List RDS database clusters in the account. Cortex uses this to discover database clusters as scan targets.	`*` (no condition)
rds:DescribeDBClusterSnapshots	List existing RDS cluster snapshots. Cortex uses this to identify candidates for export and scanning.	`*` (no condition)
rds:DescribeDBInstances	List RDS database instances in the account. Cortex uses this to identify data assets eligible for sensitive-data classification.	`*` (no condition)
rds:DescribeDBSnapshots	List existing RDS instance snapshots. Cortex uses this to identify candidates for export and scanning.	`*` (no condition)
rds:DescribeExportTasks	List RDS export tasks in the account. Cortex uses this to monitor snapshot export progress and determine when data is ready for scanning.	`*` (no condition)
rds:StartExportTask	Start an RDS export task. Cortex uses this to export RDS snapshot data to the Cortex S3 artifact bucket where DSPM scanners can read it.	`*` (no condition)
redshift:CreateClusterSnapshot	Create a snapshot of a Redshift cluster. Cortex uses this to capture cluster state for sensitive-data classification without impacting production.	`*` (no condition)
redshift:CreateTags	Add tags to Redshift resources. Cortex uses this to tag Cortex-created Redshift snapshots for tracking and automated cleanup.	`*` (no condition)
redshift:DeleteClusterSnapshot	Delete Redshift cluster snapshots. Cortex uses this to clean up Cortex-created Redshift snapshots after scanning. Restricted to resources carrying the `managed_by=paloaltonetworks` tag.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
redshift:DescribeClusters	List Redshift clusters in the account. Cortex uses this to discover data warehouses as scan targets.	`*` (no condition)
redshift:DescribeClusterSnapshots	List existing Redshift cluster snapshots. Cortex uses this to identify snapshots available for scanning.	`*` (no condition)
redshift-serverless:DeleteResourcePolicy	Delete resource policies from Redshift Serverless resources. Cortex uses this to revoke temporary scan access after scanning completes. Restricted to resources carrying the `managed_by=paloaltonetworks` tag.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
redshift-serverless:GetResourcePolicy	Read resource policies from Redshift Serverless resources. Cortex uses this to review existing policies before granting temporary scan access.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
redshift-serverless:PutResourcePolicy	Set resource policies on Redshift Serverless resources. Cortex uses this to establish temporary access to Redshift Serverless namespaces so that DSPM scanners can read data.	`*` where `aws:ResourceTag/managed_by = paloaltonetworks`
s3:DeleteObject	Delete an object from an S3 bucket. Cortex uses this to remove temporary scan artifacts from Cortex-managed cortex-artifact* buckets after processing.	`s3:::cortex-artifact`, `s3:::cortex-artifact/*` (no condition)
s3:GetBucketLocation	Retrieve the region of an S3 bucket. Cortex uses this to resolve the region of the Cortex artifact bucket for cross-region data transfer operations.	`s3:::cortex-artifact`, `s3:::cortex-artifact/*` (no condition)
s3:GetObject	Download objects from an S3 bucket. Cortex uses this to retrieve S3 object samples for sensitive-data classification and to read DSPM artifacts from Cortex buckets.	`s3:::cortex-artifact`, `s3:::cortex-artifact/` (no condition) `s3:::` (no condition)
s3:GetObjectAcl	Retrieve the access control list (ACL) of an S3 object. Cortex uses this to inspect per-object access controls and assess S3 data exposure risk.	`s3:::*` (no condition)
s3:ListBucket	List the contents of an S3 bucket. Cortex uses this to enumerate objects in customer S3 buckets and identify sensitive-data scan targets.	`s3:::cortex-artifact`, `s3:::cortex-artifact/` (no condition) `s3:::` (no condition)
s3:PutObject	Upload objects to an S3 bucket. Cortex uses this to write scan artifacts and intermediate data into the Cortex-managed cortex-artifact* S3 buckets.	`s3:::cortex-artifact`, `s3:::cortex-artifact/*` (no condition)

DSPM Policy: Cortex-DSPM-Scanner-Policy

A customer-managed policy that DSPM attaches to the shared CortexPlatformScannerRole. This is the role that actually reads customer data content for sensitive-data classification (the discovery/orchestration policy above runs on CortexPlatformRole).

Attached to CortexPlatformScannerRole

Created when	DSPM capability enabled
Attached to	`CortexPlatformScannerRole`
Function	Reads customer data content (object samples / database rows) for sensitive-data classification.

Cortex-DSPM-Scanner-Policy permissions:

Permission	Purpose	Scope
cloudwatch:GetMetricStatistics	Read AWS service usage metrics. Cortex uses this to pace scan throughput and avoid impacting customer workloads.	`*`
dynamodb:DescribeTable	Read DynamoDB table schema and configuration. Cortex uses this to characterize the table as a data asset prior to sampling.	`dynamodb::${AWS::AccountId}:table/`
dynamodb:Scan	Sample rows from DynamoDB tables. Cortex uses this for sensitive-data classification.	`dynamodb::${AWS::AccountId}:table/`
iam:PassRole	Pass the scanner role to AWS services that act on the scanner's behalf during scan orchestration. Restricted to roles whose name begins with CortexPlatformScannerRole in the same account.	`iam::${AWS::AccountId}:role/${CortexPlatformScannerRoleName}*`
kms:Decrypt	Decrypt KMS-encrypted customer data and exported snapshot payloads. Cortex uses this so that DSPM can analyze plaintext content for sensitive-data classification.	`*`
kms:DescribeKey	Read KMS key metadata. Cortex uses this to perform cryptographic operations against encrypted customer data and against Cortex-managed keys.	Customer keys — `` (no condition), paired with `kms:Decrypt` Cortex-managed key — `kms::${MTKmsAccountDSPM}:key/*` (no condition), paired with `kms:GenerateDataKeyWithoutPlaintext`
kms:GenerateDataKeyWithoutPlaintext	Obtain an encrypted data key from the Cortex-managed KMS key. Cortex uses this for envelope-encryption operations performed during DSPM scanning. Scoped to the Cortex-managed KMS account only; the plaintext key is never returned to the scanner.	`kms::${MTKmsAccountDSPM}:key/`
s3:GetBucketLocation	Resolve the AWS region of the Cortex artifact bucket. Cortex uses this so that the scanner connects to the correct regional S3 endpoint.	`s3:::cortex-artifact` `s3:::cortex-artifact/*`
s3:GetObject	Retrieve S3 object contents. Cortex uses this for both customer data samples for classification and DSPM-exported snapshot data staged in Cortex artifact buckets.	Cortex-managed DSPM artifact buckets — `s3:::cortex-artifact`, `s3:::cortex-artifact/` Customer-data classification reads — `` (account-wide)
s3:GetObjectAttributes	Retrieve object metadata such as size, checksum, and storage class. Cortex uses this to inspect objects in Cortex artifact buckets prior to retrieval.	`s3:::cortex-artifact` `s3:::cortex-artifact/*`
s3:ListBucket	List the contents of an S3 bucket. Cortex uses this to discover customer objects eligible for sensitive-data classification and to locate exported DSPM artifacts.	Cortex-managed DSPM artifact buckets — `s3:::cortex-artifact`, `s3:::cortex-artifact/` Customer-data classification enumeration — `` (account-wide)

Opt-in (AWS-only feature). Installs a tightly-scoped EKS access entry on each customer EKS cluster, granting Cortex read-only Kubernetes API access (AmazonEKSAdminViewPolicy) for cluster posture assessment. All access entries are tag-scoped to managed_by=paloaltonetworks, so Cortex can only manage entries it created itself.

Kubernetes Security Policy: Cortex-K8s-Security-Policy

Attached to CortexPlatformRole

A customer-managed policy that lets Cortex install one EKS access entry per cluster, associate it with the AWS-managed AmazonEKSAdminViewPolicy (read-only Kubernetes API access), and remove it on off-boarding.

Every action is double-restricted: The resource ARN is scoped to EKS clusters/access-entries in the customer's own account, and also the access entry must carry the tag managed_by=paloaltonetworks, so Cortex cannot create, modify, or delete any EKS access entry that does not carry this tag.

Created when	Kubernetes Security capability enabled.
Attached to	`CortexPlatformRole`
Resource scoping	EKS clusters / access-entries in the customer's own account.
Tag scoping	Access entry must carry tag `managed_by=paloaltonetworks` (double-restricted with resource ARN).
Associated Kubernetes permission	AWS-managed `AmazonEKSAdminViewPolicy` (read-only Kubernetes API access).

Cortex-K8s-Security-Policy permissions:

Permission	Purpose	Scope
eks:AssociateAccessPolicy	Bind the AWS-managed AmazonEKSAdminViewPolicy, which grants read-only Kubernetes API access, to a Cortex-tagged access entry. The IAM condition hard-restricts the associable policy to this single ARN, so no other Kubernetes access policy can be associated through this grant.	`eks::${AWS::AccountId}:access-entry/` where `eks:policyArn = arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminViewPolicy` AND `aws:ResourceTag/managed_by = paloaltonetworks`
eks:CreateAccessEntry	Create an IAM-to-Kubernetes access entry on a customer EKS cluster. Cortex uses this to authenticate to the cluster's Kubernetes API. The entry must be created with the `managed_by=paloaltonetworks` tag.	`eks::${AWS::AccountId}:cluster/` where `aws:RequestTag/managed_by = paloaltonetworks`
eks:DeleteAccessEntry	Remove a Cortex-tagged EKS access entry from a cluster. Restricted to entries with the `managed_by=paloaltonetworks` tag, so Cortex cannot delete entries it did not create itself.	`eks::${AWS::AccountId}:access-entry/` where `aws:ResourceTag/managed_by = paloaltonetworks`
eks:ListAssociatedAccessPolicies	Read which AWS-managed Kubernetes access policies are currently bound to a Cortex-tagged EKS access entry. Cortex uses this to verify the access configuration.	`eks::${AWS::AccountId}:access-entry/` where `aws:ResourceTag/managed_by = paloaltonetworks`
eks:TagResource	Tag a Cortex-created EKS access entry with the `managed_by=paloaltonetworks` tag. This tag is what subsequently scopes all read, associate, and delete actions to Cortex-owned entries.	`eks::${AWS::AccountId}:access-entry/` where `aws:RequestTag/managed_by = paloaltonetworks`

Conditional (opt-in). Lets Cortex execute manual and automatic response and orchestration actions on customer AWS resources, via built-in quick actions, playbooks, and custom responses authored by the customer.

Note

Unified Cortex platform cloud content packs require a specific set of automation permissions to enable full integration with your cloud environment. Before configuring access for these packs, review the automation permission scope guidelines.

Automation Policy: Cortex-Automation-Policy

A customer-managed policy that grants the Base capability's CortexPlatformRole write and delete actions across multiple AWS service categories (EC2, S3, IAM, KMS, Lambda, RDS, EKS, ECS, SSM, Secrets Manager, and others) so Cortex can execute response and remediation playbooks against any resource the playbook targets. Statements are scoped by action, not by tag or resource ARN. Every statement uses Resource: "*", which is what allows playbooks to act on resources Cortex did not itself create.

Attached to CortexPlatformRole.

Created when	Automation capability enabled.
Attached to	`CortexPlatformRole`

Cortex-Automation-Policy permissions:

Permission	Purpose
acm:UpdateCertificateOptions	Update the options for a specified ACM certificate. Cortex uses this for automated remediation of certificate configuration issues, helping maintain proper TLS/SSL security posture across AWS resources. This permission is invoked only when a security policy violation related to certificate management is detected and remediation is triggered.
budgets:DescribeBudgets	Retrieve the configured budgets for the account. Cortex uses this for cost monitoring and alerting capabilities, helping customers maintain visibility into cloud spending patterns. This read-only operation does not modify any budget configurations.
budgets:DescribeNotificationsForBudget	Retrieve the notification details associated with a specific budget. Cortex uses this to understand existing alerting configurations and provide comprehensive cost management insights for automation workflows. This read-only operation does not modify any notification settings.
ce:GetCostAndUsage	Retrieve detailed cost and usage data for the account. Cortex uses this for cloud cost analysis and optimization recommendations, helping customers understand and manage their AWS spending. This read-only operation provides financial visibility without modifying any billing configurations.
ce:GetCostForecast	Retrieve a forecast of future costs and usage for the account. Cortex uses this to provide predictive cost insights, helping customers plan budgets and identify potential cost anomalies. This read-only operation does not modify any billing or cost configurations.
cloudtrail:DescribeTrails	Retrieve information about the trails configured in CloudTrail. Cortex uses this to assess audit logging coverage and identify gaps in security monitoring across AWS accounts. This read-only operation provides visibility into logging configurations without modifying any trail settings.
cloudtrail:StartLogging	Start CloudTrail logging as automated remediation when an issue is detected due to the rule: AWS CloudTrail Logging Stopped. Cortex uses this to ensure audit logging is active, maintaining compliance with security best practices. This remediation action is triggered only when a specific security policy violation is detected.
cloudtrail:UpdateTrail	Update CloudTrail trail settings for automated remediation of misconfigurations, such as enabling log file validation when the rule AWS CloudTrail Log File Validation Disabled is triggered. Cortex uses this to ensure proper audit logging coverage and compliance with security best practices. This remediation action is invoked only when a specific security policy violation is detected.
ec2:AllocateAddress	Allocate an Elastic IP address. Cortex uses this permission for automated remediation workflows that require assigning a static IP address to a resource. This action is invoked only when a security policy violation is detected.
ec2:AllocateHosts	Allocate a Dedicated Host for EC2 instances. Cortex uses this permission for automated remediation of compliance requirements that mandate dedicated tenancy. This action is invoked only when a security policy violation is detected.
ec2:AssociateAddress	Associate an Elastic IP address with an EC2 instance or network interface. Cortex uses this permission for automated remediation of network configuration issues. This action is invoked only when a security policy violation is detected.
ec2:AttachVolume	Attach an EBS volume to an EC2 instance. Cortex uses this permission for automated remediation workflows that require volume management. This action is invoked only when a security policy violation is detected.
ec2:AuthorizeSecurityGroupEgress	Authorize outbound network access rules for a security group. Cortex uses this for automated remediation of network security issues, helping maintain proper egress controls. This permission is invoked only when a security policy violation related to network egress is detected and remediation is triggered.
ec2:AuthorizeSecurityGroupIngress	Configure inbound network access rules for remediation of issues detected due to the rule: AWS EC2 Security Group with Ingress Rule Not Authorized. Cortex uses this for automated security remediation to restrict overly permissive access rules. This permission is invoked only when a specific security policy violation is detected.
ec2:CopyImage	Copy an AMI during response playbooks (forensic preservation, hardened-baseline redistribution). This action is invoked only when a specific playbook is triggered.
ec2:CopySnapshot	Copy an EBS snapshot during response playbooks (forensic snapshot copy before remediation, cross-region evidence relocation, or re-encryption workflows). This action is invoked only when a specific playbook is triggered.
ec2:CreateFleet	Create an EC2 Fleet request to launch instances. Cortex uses this permission for automated remediation workflows that require provisioning compliant compute resources. This action is invoked only when a security policy violation is detected.
ec2:CreateImage	Create an Amazon Machine Image (AMI) from an EC2 instance. Cortex uses this permission for automated remediation workflows that require capturing instance state before applying changes. This action is invoked only when a security policy violation is detected.
ec2:CreateLaunchTemplate	Create an EC2 launch template. Cortex uses this permission for automated remediation workflows that require defining compliant instance launch configurations. This action is invoked only when a security policy violation is detected.
ec2:CreateNetworkAcl	Create a new network access control list (ACL) in a VPC. Cortex uses this for automated network security remediation, implementing additional network-level access controls when needed. This permission is invoked only as part of remediation workflows to address detected security issues.
ec2:CreateNetworkAclEntry	Create an entry in a network ACL. Cortex uses this permission for automated remediation of network access control issues by adding security rules. This action is invoked only when a security policy violation is detected.
ec2:CreateSecurityGroup	Create a new network security group. Cortex uses this for automated remediation workflows that require creating properly configured security groups to address detected security issues. Security groups are created with appropriate rules to maintain the desired security posture.
ec2:CreateSnapshot	Capture disk state during response playbooks (e.g., before stopping a compromised instance or changing attributes) to preserve evidence. This action is invoked only when a specific playbook is triggered.
ec2:CreateTags	Tag EC2 resources created or modified by playbooks (e.g., `incident-id`, `cortex-playbook`) for audit trail and cleanup. This action is invoked only as part of remediation workflows.
ec2:CreateTrafficMirrorSession	Create a traffic mirror session for network traffic inspection. Cortex uses this permission for automated remediation workflows that require network traffic analysis for security investigation. This action is invoked only when a security policy violation is detected.
ec2:CreateVolume	Create an EBS volume. Cortex uses this permission for automated remediation workflows that require provisioning encrypted or compliant storage volumes. This action is invoked only when a security policy violation is detected.
ec2:CreateVpcEndpoint	Create a VPC endpoint for private connectivity to AWS services. Cortex uses this permission for automated remediation of network security by enabling private service access without internet exposure. This action is invoked only when a security policy violation is detected.
ec2:DeleteFleets	Delete EC2 Fleet requests. Cortex uses this permission for automated cleanup of fleet resources created during remediation workflows. This action is invoked only when a security policy violation is detected.
ec2:DeleteInternetGateway	Delete an internet gateway. Cortex uses this permission for automated remediation of network isolation requirements by removing unnecessary internet access points. This action is invoked only when a security policy violation is detected.
ec2:DeleteLaunchTemplate	Delete an EC2 launch template. Cortex uses this permission for automated cleanup of non-compliant launch templates during remediation workflows. This action is invoked only when a security policy violation is detected.
ec2:DeleteSecurityGroup	Delete an existing network security group. Cortex uses this for automated cleanup of unused or misconfigured security groups as part of security hygiene workflows. This permission is invoked only when a security policy requires removal of a specific security group during remediation.
ec2:DeleteSnapshot	Clean up snapshots created by playbooks (intermediate re-encryption snapshots, expired evidence snapshots). This action acts only on snapshots Cortex itself created.
ec2:DeleteSubnet	Delete a VPC subnet. Cortex uses this permission for automated remediation of network segmentation issues. This action is invoked only when a security policy violation is detected.
ec2:DeleteVolume	Delete an EBS volume. Cortex uses this permission for automated cleanup of temporary volumes created during remediation workflows. This action is invoked only when a security policy violation is detected.
ec2:DeleteVpc	Delete a VPC. Cortex uses this permission for automated remediation of non-compliant network configurations. This action is invoked only when a security policy violation is detected and the VPC contains no active resources.
ec2:DeregisterImage	Clean up AMIs created by playbooks (intermediate hardening AMIs, superseded baselines). This action acts only on images Cortex itself created.
ec2:DescribeAddresses	List Elastic IP addresses in the account. Cortex uses this permission to identify Elastic IP address configurations that require remediation of security policy violations.
ec2:DescribeFleetInstances	List instances associated with an EC2 Fleet. Cortex uses this permission to assess fleet instance configurations during automated remediation workflows.
ec2:DescribeFleets	List EC2 Fleets in the account. Cortex uses this permission to assess fleet configurations during automated remediation workflows.
ec2:DescribeIamInstanceProfileAssociations	List IAM instance profile associations for EC2 instances. Cortex uses this permission to assess instance role assignments during automated remediation of IAM misconfigurations.
ec2:DescribeImages	Look up AMI metadata before deciding which remediation action to apply. For example, verify that an AMI flagged as public is still public) Read-only.
ec2:DescribeInstances	Retrieve information about EC2 instances in the account. Cortex uses this to inventory compute resources and assess their security configurations for automation purposes, such as identifying instances that require remediation. This read-only operation does not modify any instance settings.
ec2:DescribeInstanceStatus	Retrieve status information for EC2 instances. Cortex uses this permission to monitor instance health during automated remediation workflows.
ec2:DescribeInternetGateways	List internet gateways in the account. Cortex uses this permission to identify internet gateway configurations that require remediation of network security violations.
ec2:DescribeIpamResourceDiscoveries	Retrieve details about IPAM resource discovery configurations. Cortex uses this to understand IP address management configurations for network security analysis and automation workflows. This read-only operation does not modify any IPAM settings.
ec2:DescribeIpamResourceDiscoveryAssociations	Retrieve details about associations between IPAM and resource discoveries. Cortex uses this for comprehensive network topology understanding in automation workflows, enabling accurate security assessment of IP address management. This read-only operation does not modify any IPAM configurations.
ec2:DescribeKeyPairs	List EC2 key pairs in the account. Cortex uses this permission to assess SSH key pair configurations during automated remediation of access control issues.
ec2:DescribeLaunchTemplates	List EC2 launch templates in the account. Cortex uses this permission to identify launch template configurations that require remediation of security policy violations.
ec2:DescribeRegions	List available AWS regions. Cortex uses this permission to identify active regions during multi-region automated remediation workflows.
ec2:DescribeReservedInstances	List reserved EC2 instances in the account. Cortex uses this permission to assess reserved instance configurations during automated remediation workflows.
ec2:DescribeSecurityGroups	Retrieve information about security groups in the account. Cortex uses this to assess network security posture and identify misconfigurations requiring remediation as part of automation workflows. This read-only operation provides visibility into network access rules without modifying any security group settings.
ec2:DescribeSnapshots	Look up snapshot metadata before deciding which remediation action to apply. For example, select the correct snapshot for evidence preservation. Read-only.
ec2:DescribeSubnets	Retrieve information about subnets in the account. Cortex uses this to understand network topology for security analysis and automation workflows, enabling accurate assessment of network configurations. This read-only operation does not modify any subnet settings.
ec2:DescribeVolumes	List EBS volumes in the account. Cortex uses this permission to identify volume configurations that require remediation, such as unencrypted volumes.
ec2:DescribeVpcs	Retrieve information about VPCs in the account. Cortex uses this to inventory network infrastructure and assess security configurations for automation workflows. This read-only operation provides visibility into VPC architecture without modifying any network settings.
ec2:DetachInternetGateway	Detach an internet gateway from a VPC. Cortex uses this permission for automated remediation of network isolation requirements by removing internet connectivity. This action is invoked only when a security policy violation is detected.
ec2:DetachVolume	Detach an EBS volume from an EC2 instance. Cortex uses this permission for automated remediation workflows that require volume management operations. This action is invoked only when a security policy violation is detected.
ec2:DisassociateAddress	Disassociate an Elastic IP address from an instance or network interface. Cortex uses this permission for automated remediation of network configuration issues. This action is invoked only when a security policy violation is detected.
ec2:GetIpamDiscoveredPublicAddresses	Retrieve discovered public IP addresses from IPAM. Cortex uses this to identify externally exposed resources for security assessment, helping detect unintended public exposure of AWS resources. This read-only operation does not modify any IPAM or network configurations.
ec2:GetPasswordData	Retrieve the encrypted administrator password for a Windows EC2 instance. Cortex uses this permission to verify instance access configurations during automated remediation workflows.
ec2:ModifyFleet	Modify an EC2 Fleet configuration. Cortex uses this permission for automated remediation of fleet configuration issues. This action is invoked only when a security policy violation is detected.
ec2:ModifyImageAttribute	Modify EC2 image attributes to revoke public launch permissions. Cortex uses this for automated remediation when the rule AWS EC2 AMI Publicly Accessible detects a publicly shared AMI, restricting access to prevent unauthorized use. This remediation action is triggered only when a specific security policy violation is detected.
ec2:ModifyInstanceAttribute	Modify EC2 instance attributes, such as disassociating a security group for mitigation of issues detected due to the rule: AWS EC2 instance with network path from the internet. Cortex uses this for automated security remediation to restrict unauthorized network access to instances. This remediation action is triggered only when a specific security policy violation is detected.
ec2:ModifyInstanceMetadataOptions	Modify EC2 instance metadata options for remediation when the rule AWS EC2 Instance Not Using IMDSv2 is triggered. Cortex uses this to enforce IMDSv2 and other metadata security best practices through automated remediation, protecting instances from SSRF and credential theft attacks. This remediation action is invoked only when a specific security policy violation is detected.
ec2:ModifyNetworkInterfaceAttribute	Modify a network interface attribute. Cortex uses this permission for automated remediation of network interface security settings, such as adjusting security group assignments. This action is invoked only when a security policy violation is detected.
ec2:ModifySnapshotAttribute	Revoke public/cross-account snapshot sharing during remediation, for example, when the "AWS EBS Snapshot Publicly Accessible" rule is triggered. This action is invoked only when a specific policy violation is detected.
ec2:ModifySubnetAttribute	Modify a specific attribute of a subnet. Cortex uses this for automated network security remediation, such as adjusting auto-assign public IP settings to address detected security issues. This permission is invoked only when a security policy violation related to subnet configuration is detected.
ec2:ModifyVolume	Modify an EBS volume configuration. Cortex uses this permission for automated remediation of volume misconfigurations, such as enabling encryption or adjusting performance settings. This action is invoked only when a security policy violation is detected.
ec2:MonitorInstances	Enable detailed CloudWatch monitoring for EC2 instances. Cortex uses this permission for automated remediation of monitoring gaps by enabling detailed instance metrics. This action is invoked only when a security policy violation is detected.
ec2:RebootInstances	Reboot EC2 instances. Cortex uses this permission for automated remediation workflows that require an instance restart to apply security configuration changes. This action is invoked only when a security policy violation is detected.
ec2:ReleaseAddress	Release an Elastic IP address. Cortex uses this permission for automated cleanup of unused Elastic IP addresses during remediation workflows. This action is invoked only when a security policy violation is detected.
ec2:ReleaseHosts	Release Dedicated Hosts. Cortex uses this permission for automated cleanup of dedicated host resources during remediation workflows. This action is invoked only when a security policy violation is detected.
ec2:RevokeSecurityGroupEgress	Revoke outbound security group rules to block traffic for remediation of issues detected due to the rule: AWS EC2 instance with network path to the internet. Cortex uses this for automated remediation of overly permissive egress rules that could expose resources to unauthorized outbound communication. This remediation action is triggered only when a specific security policy violation is detected.
ec2:RevokeSecurityGroupIngress	Revoke inbound security group rules to block network access for remediation of issues detected due to the rule: AWS EC2 instance with network path from the internet. Cortex uses this for automated remediation of security misconfigurations, such as removing public access to sensitive ports. This remediation action is triggered only when a specific security policy violation is detected.
ec2:RunInstances	Launch new EC2 instances as part of automation workflows. Cortex uses this for automation workflows that require deploying properly configured compute resources, such as creating scanning infrastructure. Instances are launched with appropriate security configurations and tagged for lifecycle management.
ec2:StartInstances	Start one or more stopped EC2 instances. Cortex uses this for automation workflows involving instance lifecycle management, such as restarting instances after remediation actions are applied. This permission is invoked only as part of controlled automation workflows.
ec2:StopInstances	Stop one or more running EC2 instances. Cortex uses this for automated response actions, such as isolating compromised instances or stopping instances that violate security policies. This permission is invoked only when a specific security incident or policy violation requires instance isolation.
ec2:TerminateInstances	Terminate one or more running EC2 instances. Cortex uses this for automated incident response, enabling removal of compromised or unauthorized resources when security policies require it. This permission is invoked only when a specific security incident requires instance termination as a remediation action.
ec2:UnmonitorInstances	Disable detailed CloudWatch monitoring for EC2 instances. Cortex uses this permission for automated remediation workflows that require adjusting instance monitoring configurations. This action is invoked only when a security policy violation is detected.
ecs:UpdateClusterSettings	Modify settings for an existing ECS cluster. Cortex uses this for automated remediation of container security settings, such as enabling Container Insights or adjusting cluster configurations to meet security best practices. This permission is invoked only when a security policy violation related to ECS is detected.
eks:AssociateAccessPolicy	Associate an access policy with an EKS cluster. Cortex uses this for automated Kubernetes security configuration management, ensuring proper access controls are applied to EKS clusters. This permission is invoked only as part of remediation workflows to address detected security issues.
eks:CreateAccessEntry	Create an access entry for an EKS cluster. Cortex uses this permission for automated remediation of Kubernetes cluster access configurations. This action is invoked only when a security policy violation is detected.
eks:DescribeCluster	Retrieve detailed information about a specific EKS cluster. Cortex uses this to assess Kubernetes security configurations and identify remediation needs as part of automation workflows. This read-only operation provides visibility into cluster settings without modifying any EKS configurations.
eks:ListClusters	List EKS clusters in the account. Cortex uses this permission to identify Kubernetes clusters that require remediation of security policy violations.
eks:UpdateAccessEntry	Update an access entry for an EKS cluster. Cortex uses this permission for automated remediation of Kubernetes cluster access misconfigurations. This action is invoked only when a security policy violation is detected.
eks:UpdateClusterConfig	Update EKS cluster configuration for remediation when the rule AWS EKS Cluster Public Access Enabled is triggered. Cortex uses this for automated remediation of Kubernetes security configurations, such as disabling public API server access. This remediation action is invoked only when a specific security policy violation is detected.
elasticloadbalancing:ModifyLoadBalancerAttributes	Modify the attributes of a specified load balancer. Cortex uses this for automated remediation of load balancer security configurations, such as enabling access logging or adjusting security-related settings. This permission is invoked only when a security policy violation related to load balancer configuration is detected.
iam:CreateServiceLinkedRole	Create a service-linked role for an AWS service. Cortex uses this permission for automated remediation workflows that require enabling AWS service integrations. This action is invoked only when a security policy violation is detected.
iam:DeleteLoginProfile	Delete an IAM login profile for remediation when the rule AWS IAM User with Active Console Password is triggered. Cortex uses this for automated incident response, such as disabling console access for compromised or unauthorized user accounts. This remediation action is invoked only when a specific security policy violation is detected.
iam:GetAccountAuthorizationDetails	Retrieve information about all IAM users, roles, policies, and groups in the account. Cortex uses this to assess identity and access management posture for security analysis and to support automation workflows that evaluate IAM configurations. This read-only operation does not modify any IAM settings.
iam:GetAccountPasswordPolicy	Retrieve the account password policy for investigation of issues detected due to the rule: AWS IAM Account Password Policy Not Configured. Cortex uses this to assess password security configurations and identify compliance gaps. This read-only operation provides visibility into password policy settings without modifying any IAM configurations.
iam:PassRole	Pass an IAM role to an AWS service. Cortex uses this permission for automated remediation workflows that create or update resources with an attached role, such as an EC2 instance profile or a Lambda execution role. AWS requires this permission whenever a resource is created or updated with an attached role.
iam:PutUserPolicy	Attach an inline policy to an IAM user to suspend access for mitigation of issues detected due to the rule: AWS IAM Users with Administrator Access Permissions. Cortex uses this for automated IAM remediation to restrict overly permissive user access. This remediation action is invoked only when a specific security policy violation is detected.
iam:RemoveRoleFromInstanceProfile	Remove a role from an instance profile for remediation when the rule AWS EC2 with IAM instance profile is triggered. Cortex uses this for automated remediation of instance IAM configurations to address overly permissive role assignments. This remediation action is invoked only when a specific security policy violation is detected.
iam:UpdateAccessKey	Deactivate IAM access keys for remediation when the rule AWS IAM User Active Access Keys Unused for 90 days is triggered. Cortex uses this for automated security response to disable unused or potentially compromised access keys. This remediation action is invoked only when a specific security policy violation is detected.
iam:UpdateAccountPasswordPolicy	Configure the account password policy for remediation when the rule AWS IAM Account Password Policy Not Configured is triggered. Cortex uses this for automated remediation to enforce strong password requirements and compliance with security best practices. This remediation action is invoked only when a specific security policy violation is detected.
kms:CreateGrant	Create KMS grants on customer KMS keys when remediation playbooks must enable an AWS service, such as RDS or EBS, to use a key for re-encryption or attribute modification. Grants are scoped to the specific service principal and operation required by the playbook step.
kms:Decrypt	Decrypt ciphertext that was encrypted with a KMS key. Cortex uses this permission for automation workflows that require access to encrypted data as part of remediation processing.
kms:DescribeKey	Read KMS key metadata such as key ID, state, and usage. Cortex uses this permission to inspect KMS keys during automation workflows. AWS requires this metadata as a prerequisite for most other KMS operations.
kms:EnableKeyRotation	Activate automatic rotation for a customer master key (CMK). Cortex uses this for automated remediation to enforce encryption best practices, ensuring keys are regularly rotated to maintain cryptographic security. This remediation action is invoked only when a security policy violation related to key rotation is detected.
kms:GenerateDataKey	Generate a data key for client-side encryption. Cortex uses this for automation workflows requiring encryption of sensitive data, ensuring that data created or processed during remediation is properly encrypted. This operation maintains cryptographic security throughout automation processes.
lambda:CreateFunction	Create a Lambda function. Cortex uses this permission for automated remediation workflows that require deploying serverless functions for security enforcement. This action is invoked only when a security policy violation is detected.
lambda:DeleteFunction	Delete a Lambda function. Cortex uses this permission for automated cleanup of non-compliant Lambda functions during remediation workflows. This action is invoked only when a security policy violation is detected.
lambda:DeleteFunctionUrlConfig	Delete a Lambda function URL configuration. Cortex uses this permission for automated remediation of publicly exposed Lambda function endpoints. This action is invoked only when a security policy violation is detected.
lambda:DeleteLayerVersion	Delete a Lambda layer version. Cortex uses this permission for automated cleanup of non-compliant Lambda layer versions during remediation workflows. This action is invoked only when a security policy violation is detected.
lambda:GetAccountSettings	Retrieve Lambda account-level settings and limits. Cortex uses this permission to assess Lambda service configurations during automated remediation workflows.
lambda:GetFunctionUrlConfig	Retrieve the configuration details for a Lambda function URL. Cortex uses this to assess Lambda exposure and identify security misconfigurations, such as publicly accessible function URLs. This read-only operation does not modify any function URL settings.
lambda:GetPolicy	Retrieve the access policy associated with a Lambda function. Cortex uses this to assess function access controls and identify overly permissive configurations as part of automation workflows. This read-only operation does not modify any Lambda policies.
lambda:InvokeFunction	Execute a specified Lambda function. Cortex uses this for automation workflows that leverage serverless functions for remediation tasks, enabling custom remediation logic to be executed in response to detected security issues. This permission is invoked only as part of controlled automation workflows.
lambda:ListAliases	List aliases for a Lambda function. Cortex uses this permission to assess Lambda function versioning during automated remediation workflows.
lambda:ListFunctions	List Lambda functions in the account. Cortex uses this permission to identify Lambda functions that require remediation of security policy violations.
lambda:ListLayerVersions	List versions of a Lambda layer. Cortex uses this permission to inventory Lambda layer versions for dependency security assessment.
lambda:ListVersionsByFunction	List published versions of a Lambda function. Cortex uses this permission to assess Lambda function versions during automated remediation workflows.
lambda:PublishLayerVersion	Publish a new Lambda layer version. Cortex uses this permission for automated remediation workflows that require updating Lambda layer dependencies. This action is invoked only when a security policy violation is detected.
lambda:UpdateFunctionConfiguration	Update a Lambda function configuration. Cortex uses this permission for automated remediation of Lambda function misconfigurations, such as adjusting runtime or security settings. This action is invoked only when a security policy violation is detected.
lambda:UpdateFunctionUrlConfig	Update the configuration details for a Lambda function URL. Cortex uses this for automated remediation of Lambda security configurations, such as restricting public access to function URLs. This remediation action is invoked only when a security policy violation related to Lambda function URLs is detected.
rds:AddTagsToResource	Add tags to RDS resources for tracking and identification during automation workflows. Cortex uses this to create unique tags for RDS snapshots and other resources created during remediation, enabling proper lifecycle management and ensuring resources can be found and cleaned up at a later stage.
rds:CreateTenantDatabase	Create a new tenant database within an RDS DB instance. Cortex uses this for automation workflows involving database provisioning as part of security remediation or infrastructure management. This permission is invoked only as part of controlled automation workflows.
rds:DescribeDBInstances	List RDS database instances in the account. Cortex uses this permission to identify database instances that require remediation of security policy violations.
rds:ModifyDBCluster	Modify an RDS DB cluster for remediation when the rule AWS RDS DB Cluster Publicly Accessible is triggered. Cortex uses this for automated remediation of database security configurations, such as disabling public accessibility. This remediation action is invoked only when a specific security policy violation is detected.
rds:ModifyDBClusterSnapshotAttribute	Modify DB cluster snapshot attributes for remediation when the rule AWS RDS DB Cluster Snapshot Publicly Accessible is triggered. Cortex uses this to remediate overly permissive snapshot sharing configurations, restricting public access to database snapshots. This remediation action is invoked only when a specific security policy violation is detected.
rds:ModifyDBInstance	Modify an RDS DB instance for remediation when the rule AWS RDS DB Instance Publicly Accessible is triggered. Cortex uses this for automated database security remediation, such as disabling public accessibility. This remediation action is invoked only when a specific security policy violation is detected.
rds:ModifyDBSnapshotAttribute	Modify DB snapshot attributes for remediation when the rule AWS RDS DB Snapshot Publicly Accessible is triggered. Cortex uses this to restrict public snapshot access through automated remediation, preventing unauthorized access to database backups. This remediation action is invoked only when a specific security policy violation is detected.
rds:ModifyEventSubscription	Modify an existing RDS event subscription. Cortex uses this for automation workflows involving database monitoring configuration, such as adjusting notification settings for security-relevant database events. This permission is invoked only as part of controlled automation workflows.
redshift:ModifyCluster	Modify Redshift cluster configuration settings. Cortex uses this permission for automated remediation of data warehouse security misconfigurations, such as enabling encryption or adjusting network settings. This action is invoked only when a security policy violation is detected.
s3:CreateBucket	Create an S3 bucket. Cortex uses this permission for automated remediation workflows that require creating properly configured storage resources, such as logging buckets. This action is invoked only when a security policy violation is detected.
s3:DeleteBucket	Delete an S3 bucket. Cortex uses this permission for automated remediation of non-compliant storage resources. This action is invoked only when a security policy violation is detected and the bucket is confirmed empty.
s3:DeleteBucketPolicy	Remove the entire access policy associated with an S3 bucket. Cortex uses this for automated remediation of misconfigured bucket access policies that could expose data publicly. This remediation action is invoked only when a security policy violation related to S3 bucket policies is detected.
s3:DeleteBucketWebsite	Remove the static website configuration from an S3 bucket. Cortex uses this to remediate unintended public exposure of S3 content by disabling static website hosting on buckets that should not be publicly accessible. This remediation action is invoked only when a security policy violation is detected.
s3:GetBucketAcl	Retrieve the Access Control List (ACL) that controls access to an S3 bucket. Cortex uses this to assess S3 access configurations and identify security issues, such as overly permissive public access. This read-only operation does not modify any bucket ACL settings.
s3:GetBucketPolicy	Retrieve the resource-based access policy attached to an S3 bucket. Cortex uses this to analyze S3 access controls and identify misconfigurations that could expose data publicly. This read-only operation does not modify any bucket policies.
s3:GetBucketPublicAccessBlock	Retrieve the public access block configuration for an S3 bucket. Cortex uses this to assess S3 security posture and identify exposure risks when investigating issues detected due to the rule: AWS S3 Bucket Public Access Block Disabled. This read-only operation provides visibility into public access settings.
s3:GetBucketWebsite	Retrieve the configuration details for static website hosting on an S3 bucket. Cortex uses this to identify buckets configured for public web hosting and assess whether the configuration poses a security risk. This read-only operation does not modify any website hosting settings.
s3:GetEncryptionConfiguration	Retrieve the default server-side encryption settings applied to an S3 bucket. Cortex uses this to assess S3 encryption posture and identify unencrypted buckets that may require remediation. This read-only operation does not modify any encryption configurations.
s3:GetObject	Retrieve the contents of an S3 object. Cortex uses this permission for automation workflows that require reading object contents as part of remediation processing.
s3:ListAllMyBuckets	List all S3 buckets in the account. Cortex uses this permission to identify S3 buckets that require remediation of security policy violations.
s3:PutBucketAcl	Modify S3 bucket ACLs to block public access for remediation when the rule S3 Bucket Public Read Access is triggered. Cortex uses this to explicitly deny public access or remove public access entirely from buckets. This remediation action is invoked only when a specific security policy violation is detected.
s3:PutBucketLogging	Configure server access logging for remediation when the rule AWS S3 Bucket Logging Disabled is triggered. Cortex uses this to enforce logging best practices through automated remediation, ensuring bucket access is properly audited. This remediation action is invoked only when a specific security policy violation is detected.
s3:PutBucketOwnershipControls	Define and enforces the ownership controls configuration for an S3 bucket. Cortex uses this to enforce bucket ownership best practices through automated remediation, ensuring proper access control and preventing unintended cross-account access. This permission is invoked only as part of remediation workflows.
s3:PutBucketPolicy	Set or updates the bucket policy to block public access for remediation when the rule S3 Bucket Policy Public Access is triggered. Cortex uses this for automated remediation to enforce secure access policies and prevent unauthorized public access to S3 data. This remediation action is invoked only when a specific security policy violation is detected.
s3:PutBucketPublicAccessBlock	Configure the public access block settings for remediation when the rule AWS S3 Bucket Public Access Block Disabled is triggered. Cortex uses this to automatically block public access to sensitive S3 buckets, preventing unauthorized data exposure. This remediation action is invoked only when a specific security policy violation is detected.
s3:PutBucketVersioning	Enable versioning for remediation when the rule AWS S3 Bucket Versioning Disabled is triggered. Cortex uses this to enforce data protection best practices through automated remediation, ensuring objects are versioned for recovery and audit purposes. This remediation action is invoked only when a specific security policy violation is detected.
s3:PutObject	Upload new objects or replaces existing objects within an S3 bucket. Cortex uses this for automation workflows that need to store configuration files or artifacts during remediation processes. Objects are written only as part of controlled automation workflows.
secretsmanager:CreateSecret	Create a new secret in AWS Secrets Manager. Cortex uses this for automation workflows that require secure credential storage as part of remediation or infrastructure management processes. Secrets are created with appropriate encryption and access controls.
secretsmanager:RotateSecret	Set up or initiates rotation for a secret in AWS Secrets Manager. Cortex uses this for automated credential rotation as part of security hygiene workflows, ensuring secrets are regularly rotated to maintain security best practices. This remediation action helps prevent credential compromise from stale secrets.
secretsmanager:TagResource	Add tags to secrets or resources in AWS Secrets Manager. Cortex uses this to apply security-related tags during automation workflows, enabling better resource tracking and compliance reporting. Tags help identify Cortex-managed resources and support automated lifecycle management.
ssm:ListCommands	List Systems Manager command execution history. Cortex uses this permission to track the status of automated remediation commands executed on managed instances.
ssm:ListInventoryEntries	List Systems Manager inventory entries for managed instances. Cortex uses this permission to assess instance software inventory for compliance and vulnerability evaluation.
ssm:SendCommand	Execute a command on managed instances through Systems Manager. Cortex uses this permission for automated remediation of instance-level security misconfigurations. This action is invoked only when a security policy violation is detected.

Amazon Web Services provider permissions - List of Amazon Web Services (AWS) permissions for use during Cortex Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Notice

Important

Note