Prerequisites ↗

Use the following template to create a dedicated role with the permissions required for onboarding AWS to Cortex XSIAM:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CortexCloudOnboarding",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:UpdateAssumeRolePolicy",
        "iam:GetPolicyVersion",
        "iam:GetPolicy",
        "iam:UpdateRoleDescription",
        "iam:DeletePolicy",
        "iam:ListRoles",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:CreatePolicy",
        "iam:PassRole",
        "iam:CreateServiceLinkedRole",
        "iam:DetachRolePolicy",
        "iam:ListPolicyVersions",
        "iam:DeleteRolePolicy",
        "iam:UpdateRole",
        "iam:DeleteServiceLinkedRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:DeletePolicyVersion",
        "iam:SetDefaultPolicyVersion",
        "lambda:*",
        "kms:*",
        "s3:*",
        "sqs:*",
        "sns:*",
        "cloudtrail:*",
        "cloudformation:*"
      ],
      "Resource": "*"
    }
  ]
}

To enable serverless function scanning, grant the following permissions in your AWS account for scanning outposts and accessing logs:

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Action": [
       "lambda:GetFunction",
       "lambda:GetFunctionConfiguration",
       "lambda:GetLayerVersion",
       "iam:GetRole"
     ],
     "Resource": "*"
   }
 ]
}