> For the complete documentation index, see [llms.txt](https://docs.cortex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.io/ingesting-data-into-cortex/integrations/aws.md).

# AWS

{% hint style="info" %}
Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor's documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance.
{% endhint %}

## Why use the integration for AWS

Amazon Web Services (AWS) provides on-demand cloud computing platforms and APIs.

As your AWS footprint grows across accounts, regions, and resource types, it gets harder to answer simple questions: what resources exist, who owns them, and how they connect to the services your teams run day to day. Integrating Cortex with AWS gives you a live, accurate picture of your AWS environment, so that information doesn't live only in the AWS console, or in a spreadsheet someone updates once a quarter.

When you connect AWS to Cortex, you get:

* A single catalog of your AWS resources that stays in sync automatically, instead of one you maintain by hand.
* Clear [ownership](/ingesting-data-into-cortex/integrations/aws/importing-entities-from-aws.md#ownership-and-dependencies-for-aws-entities), discovered from the tags you already use, so you can find who's responsible for a resource without asking around.
* Dependency mapping between your services and the AWS resources they rely on, so you can see the blast radius of a change before you make it.
* [Scorecards and CQL queries](/ingesting-data-into-cortex/integrations/aws/using-the-integration-for-aws.md#scorecards-and-cql) that measure your AWS resources against standards like tagging hygiene, deprecated runtimes, or required configurations.
* A [discovery audit](/ingesting-data-into-cortex/integrations/aws/importing-entities-from-aws.md#discovery-audit) that flags new or missing AWS resources, so your catalog doesn't quietly drift out of date.

If you are on a self-hosted Cortex instance, see the [self-managed AWS](/self-managed/features/integrations/aws.md) setup instructions.

## Configuring AWS

### Prerequisites

1. Users with the `Configure Integrations` permission can configure AWS.

### Step 1: Configuring the integration in Cortex

1. From the main sidebar, select **Integrations**.
2. Locate AWS, then click **Install**. The AWS side panel opens.
3. In the modal, the JSON configuration, Cortex AWS account ID, and External ID are displayed. In the configuration side bar instructions, you will also see the option to copy a starting "Read Only Access" JSON policy. Keep this browser window open, as you will need these in the next steps.

### Step 2: Configuring an IAM policy in AWS

You must configure an IAM policy for each account you want to connect to Cortex.

{% hint style="info" %}
When using Cloud Control, the role Cortex assumes to get access into your account needs to have read access to all the selected types. This access is included by default in the Read Only Access policy in Cortex, or it can be configured manually for each type.
{% endhint %}

1. Log in to the AWS Management Console, then open the [IAM console](https://console.aws.amazon.com/iam/).
2. Click **Policies**, then choose **Create policy**.
3. Switch to the JSON editor. In Cortex while configuring AWS, copy the JSON "Read Only Access" starting policy that appears in the in-app instructions. Paste it into the JSON editor.
   * This policy allows Cortex to list all resources, resource types, and resource tags.
   * If you choose to configure this manually, rather than using the starting policy provided, insert a valid IAM policy depending on the resource types you'd like to import. For example, if you want to import resources of type `AWS::IAM::role`, we'll need to have permission to `iam:ListRoles`, `iam:ListAttachedRolePolicies`, `iam:GetRole`, `iam:ListAccountAliases` and `iam:ListRolePolicies`.
     * For manual configurations, make sure to add the `cloudformation:ListTypes`, `cloudformation:ListResources`, and `cloudformation:GetResource` permissions so that we can pull the list of types available from AWS.
4. Click **Review Policy**, enter a name, then click **Create Policy**.

See the AWS documentation for more information: [Create IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html).

### Step 3: Create a role in AWS

This section is specific to cloud-based Cortex accounts. If you are on a self-hosted Cortex instance, please see the AWS account setup guide for self-hosted Cortex.

1. In AWS, navigate to **Roles > Create Role**.
2. For the trusted entity type, select **Another AWS account**.
3. In the **Account ID** field, enter the Cortex AWS account ID that was displayed in Cortex in the earlier steps.
4. Click **Require External ID**, then enter the Cortex external ID that was displayed in Cortex in the earlier steps.
5. Click **Next**.
6. Select your newly created policy, and click **Next**.
7. Enter a name for your role. Optionally, configure tags. When you are finished, click **Create Role**.
8. Search for your new role in the list and copy its name. You will need this in the next steps.
9. In the upper right corner of AWS, click your name. In the dropdown that appears, copy your AWS account ID. You will need these in the next steps.

Note that if you use multiple AWS accounts, they will share a common rotatable `externalId`.

### Step 4: Finish the configuration in Cortex

1. Navigate back to the browser window containing your [Cortex AWS settings page](https://app.getcortexapp.com/admin/settings/aws).
2. Configure the AWS integration form:
   * **Account ID**: Enter the AWS account ID you obtained in the previous steps.
   * **IAM role**: Enter the role name you obtained in the previous steps.
3. Click **Save**.