> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-sqs.md).

# Integrate Prisma Cloud with Amazon SQS

Learn how to integrate Prisma® Cloud with Amazon Simple Queue Service (SQS).

If you use Amazon Simple Queue Service (SQS) to enable custom workflows for alerts, Prisma® Cloud integrates with Amazon SQS. When you set up the integration, as soon as an alert is generated, the alert payload is sent to Amazon SQS.

The integration gives you the flexibility to send alerts to a queue in the same AWS account that you may have onboarded to Prisma Cloud or to a queue in a different AWS account. If you want to send alerts to an SQS in a different AWS account, you must provide the relevant IAM credentials—Access Key or IAM Role.

Amazon SQS allows a maximum payload size of 256KB. Some Prisma Cloud alerts, such as the anomaly policy alerts, can exceed this size limit and AWS recommends using [S3 in such cases](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-s3-messages.html). To set up an Amazon S3 integration to send alerts, see [Integrate Prisma Cloud with Amazon S3](/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-s3.md).

1. Configure Amazon SQS to receive Prisma Cloud alerts.
   1. Log in to the Amazon console with the necessary credentials to create and configure the SQS.
   2. Click **Simple Queue Services** (under **Application Integration**).
   3. **Create New Queue** or use an existing queue.

      <figure><img src="/files/fJh3IJDkXm9KG3wYhw7W" alt="sqs create new queue"><figcaption></figcaption></figure>
   4. Enter a Queue Name and choose a Queue Type—**Standard** or **FIFO**.
   5. Click **Configure Queue**.

      For the attributes specific to the Queue, use either the AWS default selection or set them per your company policies. **Use SSE** to keep all messages in the Queue encrypted, and select the default AWS KMS Customer Master Key (CMK) or enter your CMK ARN.

      <figure><img src="/files/66tX8i3uAZtGXGoLVqow" alt="sqs confiqure queue"><figcaption></figcaption></figure>
   6. **Create Queue**.

      This creates and displays your SQS Queue.
   7. Click the Queue that you created and view the **Details** and copy the **URL** for this queue.

      You provide this value in Prisma Cloud to integrate Prisma Cloud notifications in to this Queue.

      <figure><img src="/files/1HoTkE2kQLXNpXIxTawc" alt="sqs queue details"><figcaption></figcaption></figure>
2. If you are using a Customer Managed Key to encrypt queues in Amazon SQS, you must configure the Prisma Cloud Role with explicit permission to read the key.
   1. On the Amazon console, select **KMS > Customer Managed Keys** and **Create Key**.

      Refer to the AWS documentation for details on [creating keys](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).

      <figure><img src="/files/o3mK2NIcHBFShCBuKB7u" alt="sqs create encrypted key"><figcaption></figcaption></figure>
   2. Enter an Alias and Description, and add any required **Tags** and click **Next**.
   3. Select the IAM users and roles who can use this key through the **KMS** API and click **Next**.
   4. Select the IAM users and roles who can use this key to encrypt and decrypt the data.
   5. Review the key policy and click **Finish**.
3. Enable read-access permissions to Amazon SQS on the IAM Role policy.

   The Prisma Cloud IAM Role policy you use to onboard your AWS setup needs these permissions: screen:\["sqs:GetQueueAttributes", "sqs:ListQueues","sqs:SendMessage", "sqs:SendMessageBatch", "tag:GetResources","iam:GetRole"]

   If you have configured Server-Side Encryption (SSE) for SQS, you must also include the kms:GenerateDataKey IAM permission.

   When you add the above permissions to the CFT Templates and the account you run the template on is the same account to which the SQS Queue belongs, the Prisma Cloud IAM role will have the permissions required to write to the queue. If you do not want to add the permissons to the role or if the SQS Queue belongs to a different account, then proceed to [Integrate Prisma Cloud with Amazon SQS](#id72fd0b2f-689a-4053-830c-ecb02efa5fbc/id34bfb74f-01c2-49ac-bd11-8d4abe2ae787).
4. Set up Amazon SQS integration in Prisma Cloud.
   1. Log in to Prisma Cloud.
   2. Select **Settings > Integrations**.
   3. **Add Integration > Amazon SQS**. A modal wizard opens where you can add the SQS integration.

      <figure><img src="/files/9gyc2VL04IlCAUXMCacl" alt="amazon s3 int 1"><figcaption></figcaption></figure>
   4. Enter a **Name** and **Description** for the integration.
   5. Enter the **Queue URL** that you copied when you configured Prisma Cloud in Amazon SQS.

      The queue URL format on AWS China should be `https://sqs.<China region api identifier>.amazonaws.com.cn/<account id>/<queue name>`.

      <figure><img src="/files/3DYAawnwzddNnMqAmJC6" alt="amazon sqs int 1"><figcaption></figcaption></figure>
   6. (tt:\[Optional]) Select **More Options** to provide IAM credentials associated with a different AWS account.

      By default, Prisma Cloud accesses the SQS queue using the same credentials with which you onboarded the AWS account to Prisma Cloud. If your queue is in a different account or if you want to authorize access using a separate set of IAM security credentials, you can pick of the following options.

      Select the **IAM Access Key** and enter the Access Key and Secret Key, or **IAM Role** and enter the External ID and Role ARN.

      The External ID associated with the IAM role must be a UUID in a 128-bit format, and not any random string. For your convenience, the External ID is automatically generated on the Prisma Cloud web console when you click **Generate**. You must manually create one if you’re using the Prisma Cloud API.

      Any existing integrations will continue to work. If you modify an existing Amazon SQS integration, you must replace the External ID to complete the validation check and save your changes.

      This IAM permissions for both options must include sqs:SendMessage and sqs:SendMessageBatch. Additionally, the kms:GenerateDataKey is required if you have configured Server-Side Encryption (SSE) for SQS.
   7. **Next** to review the **Summary**.
   8. **Test** and **Save** the integration.

      After you set up the integration successfully, you can use the Get Status link in **Settings > Integrations** to periodically check the integration status.

      <figure><img src="/files/awWi0pESgyCaRa07SQhw" alt="get status"><figcaption></figcaption></figure>
   9. To edit the integration, on **Settings > Integrations**, click the corresponding **edit** icon. The integration **Summary** page opens.

      <figure><img src="/files/vbYOjTEQZkkt8daEQtQP" alt="amazon sqs int 2"><figcaption></figcaption></figure>
   10. **Edit** to update the integration as required.
   11. **Next** to review your edits.
   12. **Test** and **Save** the integration.
5. [Create an Alert Rule for Run-Time Checks](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md) or modify an existing rule to enable the Amazon SQS Integration.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-sqs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.