Skip to main content
Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor’s documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance.

​
Why use the integration for AWS

Amazon Web Services (AWS) provides on-demand cloud computing platforms and APIs. As your AWS footprint grows across accounts, regions, and resource types, it gets harder to answer simple questions: what resources exist, who owns them, and how they connect to the services your teams run day to day. Integrating Cortex with AWS gives you a live, accurate picture of your AWS environment, so that information doesn’t live only in the AWS console, or in a spreadsheet someone updates once a quarter. When you connect AWS to Cortex, you get:
  • A single catalog of your AWS resources that stays in sync automatically, instead of one you maintain by hand.
  • Clear ownership, discovered from the tags you already use, so you can find who’s responsible for a resource without asking around.
  • Dependency mapping between your services and the AWS resources they rely on, so you can see the blast radius of a change before you make it.
  • Scorecards and CQL queries that measure your AWS resources against standards like tagging hygiene, deprecated runtimes, or required configurations.
  • A discovery audit that flags new or missing AWS resources, so your catalog doesn’t quietly drift out of date.
If you are on a self-hosted Cortex instance, see the self-managed AWS setup instructions.

​
Configuring AWS

​
Prerequisites

  1. Users with the Configure Integrations permission can configure AWS.

​
Step 1: Configuring the integration in Cortex

  1. From the main sidebar, expand Integrations, then select Configurations.
  2. Locate AWS, then click Install. The AWS side panel opens.
  3. In the modal, the JSON configuration, Cortex AWS account ID, and External ID are displayed. In the configuration side bar instructions, you will also see the option to copy a starting “Read Only Access” JSON policy. Keep this browser window open, as you will need these in the next steps.

​
Step 2: Configuring an IAM policy in AWS

You must configure an IAM policy for each account you want to connect to Cortex.
When using Cloud Control, the role Cortex assumes to get access into your account needs to have read access to all the selected types. This access is included by default in the Read Only Access policy in Cortex, or it can be configured manually for each type.
  1. Log in to the AWS Management Console, then open the IAM console.
  2. Click Policies, then choose Create policy.
  3. Switch to the JSON editor. In Cortex while configuring AWS, copy the JSON “Read Only Access” starting policy that appears in the in-app instructions. Paste it into the JSON editor.
    • This policy allows Cortex to list all resources, resource types, and resource tags.
    • If you choose to configure this manually, rather than using the starting policy provided, insert a valid IAM policy depending on the resource types you’d like to import. For example, if you want to import resources of type AWS::IAM::role, we’ll need to have permission to iam:ListRoles, iam:ListAttachedRolePolicies, iam:GetRole, iam:ListAccountAliases and iam:ListRolePolicies.
      • For manual configurations, make sure to add the cloudformation:ListTypes, cloudformation:ListResources, and cloudformation:GetResource permissions so that we can pull the list of types available from AWS.
  4. Click Review Policy, enter a name, then click Create Policy.
See the AWS documentation for more information: Create IAM policies.

​
Step 3: Create a role in AWS

This section is specific to cloud-based Cortex accounts. If you are on a self-hosted Cortex instance, please see the AWS account setup guide for self-hosted Cortex.
  1. In AWS, navigate to Roles > Create Role.
  2. For the trusted entity type, select Another AWS account.
  3. In the Account ID field, enter the Cortex AWS account ID that was displayed in Cortex in the earlier steps.
  4. Click Require External ID, then enter the Cortex external ID that was displayed in Cortex in the earlier steps.
  5. Click Next.
  6. Select your newly created policy, and click Next.
  7. Enter a name for your role. Optionally, configure tags. When you are finished, click Create Role.
  8. Search for your new role in the list and copy its name. You will need this in the next steps.
  9. In the upper right corner of AWS, click your name. In the dropdown that appears, copy your AWS account ID. You will need these in the next steps.
Note that if you use multiple AWS accounts, they will share a common rotatable externalId.

​
Step 4: Finish the configuration in Cortex

  1. Navigate back to the browser window containing your Cortex AWS settings page.
  2. Configure the AWS integration form:
    • Account ID: Enter the AWS account ID you obtained in the previous steps.
    • IAM role: Enter the role name you obtained in the previous steps.
  3. Click Save.
Last modified on September 9, 2026