# AWS Integration

This integration enforces AWS security best practices by:
- Securing RDS instances and clusters by modifying configurations and snapshot attributes.
- Implementing S3 bucket security controls including ACLs, logging, versioning, and public access restrictions.
- Managing EC2 security groups, instance attributes, and metadata options.
- Configuring EKS cluster security settings and CloudTrail logging.
- Managing IAM policies, login profiles, and access keys.

## Supported Platforms

| Platform                                                     | Authentication |
|--------------------------------------------------------------| --- |
| **Cortex XSOAR**                                             | Manual — configure an AWS Access Key and Secret Key on the integration instance. Optionally assume a role via STS. |
| **Cortex XSIAM**             (version < 3.0)                 | Manual — configure an AWS Access Key and Secret Key on the integration instance. Optionally assume a role via STS. |

## Multi-Account Support

When **Role name for cross-organization account access** and **AWS organization accounts** are both configured, commands are executed in parallel across every listed account. Each account result is tagged with its `AccountId`. Per-account failures do not abort the batch.

## Configuration (Cortex XSOAR / Cortex XSIAM (version < 3.0))

1. Create an IAM user (or use an existing one) with the required permissions for the commands you intend to run (see the **Prerequisites** section below).
2. Generate an **Access Key ID** and **Secret Access Key** for that user.
3. In the integration instance settings, in the **Access Key / Secret Key** field enter the access key as the Access Key (username) and the secret key as the Secret Key (password).
4. *(Optional)* If you want the integration to assume a role, enter the full role ARN in **Role ARN**. The IAM user must have `sts:AssumeRole` permission on that role.
5. *(Optional)* For cross-account fan-out, enter a comma-separated list of account IDs in **AWS organization accounts** and the role name (that exists in each account) in **Role name for cross-organization account access**.


## Prerequisites

For Cortex XSOAR / Cortex XSIAM (version < 3.0), the configured IAM user or assumed role must have the IAM permissions required by the specific commands you intend to run. Each command's required permission corresponds to its underlying AWS API action.

### Locating the required permissions for your use case

1. Identify the commands you plan to run (for example, `aws-ec2-instances-describe`).
2. Open the integration's command reference on the [Amazon Web Services page on xsoar.pan.dev](https://xsoar.pan.dev/docs/reference/integrations/aws).
3. For Cortex XSOAR / Cortex XSIAM, the configured IAM user or assumed role must have the IAM permissions required by the specific commands you intend to run. Each command's required permission corresponds to its underlying AWS API action.
4. Grant only the permissions for the commands you use, following the principle of least privilege.

For the full, authoritative list of AWS IAM actions, see the [AWS Service Authorization Reference](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html).