> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-s3.md).

# Integrate Prisma Cloud with Amazon S3

Learn how to integrate Prisma® Cloud with Amazon S3.

Amazon S3 is widely used for storage and staging data. You can integrate Prisma Cloud with Amazon S3 to get notifications for configuration, audit, and anomaly policy violations.

Using this integration, you can stream the Prisma Cloud alerts to an Amazon S3 bucket or folder. You can also decide how often the notifications should be published to the S3 bucket using **File Roll Up Time**.

This integration is supported only on alerts 2.0-enabled tenants.

1. Configure Amazon S3 to receive Prisma Cloud alerts.
   1. Log in to the AWS management console and select S3.
      * Create an S3 bucket in your preferred region.
      * (Optional) Create a folder. If the desired bucket or folder path already exists, you can skip this step.
   2. Select IAM and create a role for Prisma Cloud to be able to write notifications to the S3 bucket.
      * Create a new policy with the **s3:PutObject** permission for the bucket you created in Step 1. The policy document should be similar to:

        <figure><img src="/files/n7ZrkFRoOicWgOWrpull" alt="integrate amazon s3 1 1"><figcaption></figcaption></figure>

        Do not use `PutObject` permission on all buckets as it may generate an alert on the Prisma Cloud console.
      * To configure multiple S3 integrations with multiple buckets, the policy document should be similar to:

        <figure><img src="/files/4xGEyp0hSd58bTcgflbB" alt="integrate amazon s3 1 2"><figcaption></figcaption></figure>
   3. Create an IAM role with the following configurations:
      * Select type of trusted entity **Another AWS Account**.

        Enter the Account ID\* **188619942792**. In case of AWS Gov accounts, enter the Account ID\* **342570144056**.
      * Configure the **External ID** for IAM role. The External ID associated with the IAM role must be a UUID in a 128-bit format, and not any random string. If you’re using the Prisma Cloud web console, click **Generate Token** to generate the External ID while adding the S3 integration. If you’re using the Prisma Cloud API, you must manually create the External ID.

        <figure><img src="/files/PAbCDBRgrCPc5eAXMRLe" alt="integrate amazon s3 2"><figcaption></figcaption></figure>
      * Select the policy created in Step 2 and follow the steps to configure the IAM role.
      * **Save**.
2. Set up the Amazon S3 Integration on Prisma Cloud.
   1. Log in to Prisma Cloud.
   2. Select **Settings > Integrations & Notifications > Integrations**.
   3. Select **Add Integration > Amazon S3** from the list.

      <figure><img src="/files/9gyc2VL04IlCAUXMCacl" alt="amazon s3 int 1"><figcaption></figcaption></figure>
   4. Enter an **Integration Name** and (optional) **Description**.
   5. Enter **S3 URI** for the S3 bucket or folder path from Step 1. The format should be: `s3://bucketname/` or `s3://bucketname/foldername/` .
   6. Enter the **AWS Region** in which you created the S3 bucket.
   7. **Generate** the External ID to associate it to the IAM role which is required for Prisma Cloud to be able to write notifications to the S3 bucket.
   8. Enter the **Role ARN** of the IAM role setup during Step 1b.
   9. Select the **File Roll Up Time** from the drop-down. The default is 1 hour, you can change it to 15 minutes, 30 minutes, or 3 hours.

      <figure><img src="/files/oCZNHBcG1Y6Nshzm8qfh" alt="amazon s3 int 2"><figcaption></figcaption></figure>
   10. Click **Next**, review the **Summary**, and then **Test Integration**.
   11. **Save Integration** after the testing is successful.

       <figure><img src="/files/uZcyZy9PPghrWVQ7GeYu" alt="amazon s3 int 3"><figcaption></figcaption></figure>
   12. You should receive a success message and a test file should be created on the specified S3 URI.
   13. The integration will be listed on the **Integrations** page, where you can **View**, **Edit**, or **Delete** the integration from the **Actions** panel.

       <figure><img src="/files/M6BWsKAIlM2SPjiZsyDs" alt="amazon s3 int 4"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-s3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.