Prerequisites for onboarding AWS

Before you begin onboarding AWS to Cortex XSIAM, ensure that you have the necessary permissions, credentials, and configuration details.

## Permissions and credentials

Ensure that you have the following permissions and credentials:

* In Cortex XSIAM, you must have a Cortex XSIAM role with Data Sources - View & Edit permissions to add/configure cloud accounts in Cortex XSIAM. This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.

### Required IAM permissions in AWS

Before deploying CloudFormation stacks, ensure the user or role performing the onboarding has the necessary IAM permissions.

#### Required permissions for onboarding AWS account scope

Use the following template to create a dedicated role with the permissions required for onboarding AWS to Cortex XSIAM:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "CortexCloudOnboarding",
 "Effect": "Allow",
 "Action": [
 "iam:GetRole",
 "iam:UpdateAssumeRolePolicy",
 "iam:GetPolicyVersion",
 "iam:GetPolicy",
 "iam:UpdateRoleDescription",
 "iam:DeletePolicy",
 "iam:ListRoles",
 "iam:CreateRole",
 "iam:DeleteRole",
 "iam:AttachRolePolicy",
 "iam:PutRolePolicy",
 "iam:CreatePolicy",
 "iam:PassRole",
 "iam:CreateServiceLinkedRole",
 "iam:DetachRolePolicy",
 "iam:ListPolicyVersions",
 "iam:DeleteRolePolicy",
 "iam:UpdateRole",
 "iam:DeleteServiceLinkedRole",
 "iam:ListRolePolicies",
 "iam:GetRolePolicy",
 "iam:DeletePolicyVersion",
 "iam:SetDefaultPolicyVersion",
 "lambda:*",
 "kms:*",
 "s3:*",
 "sqs:*",
 "sns:*",
 "cloudtrail:*",
 "cloudformation:*"
 ],
 "Resource": "*"
 }
 ]
}

```

#### Additional permissions required for serverless function scanning

To enable serverless function scanning, grant the following permissions in your AWS account for scanning outposts and accessing logs:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "lambda:GetFunction",
 "lambda:GetFunctionConfiguration",
 "lambda:GetLayerVersion",
 "iam:GetRole"
 ],
 "Resource": "*"
 }
 ]
}
```