> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-account.md).
# Onboard Your AWS Account
To onboard your AWS public, AWS China, or AWS GovCloud accounts on Prisma Cloud in order to monitor and analyze your assets deployed on AWS, use the following workflow.
If you want Prisma Cloud to ingest VPC flow logs and any other integrations, such as Amazon GuardDuty, Amazon S3, or AWS Inspector, you must enable those services on the AWS management console. The Cloud Formation template (CFT) enables the ingestion of configuration data, Amazon S3 flow logs, AWS CloudTrail logs, and Amazon EventBridge (audit events) only. You can configure VPC flow logs and any other integrations, such as Amazon GuardDuty or AWS Inspector after onboarding the account.
Prisma Cloud does not support shared VPCs.
1. Before you begin onboarding your AWS account, decide whether you want to use the automated or manual process to create the roles to authorize permissions for Prisma Cloud.
The below onboarding workflow automates the process of creating the Prisma Cloud role and adding the permissions required to secure your AWS account. If you want to create these roles manually instead, see [Manually Set Up Prisma Cloud Role for AWS Accounts](/content-collections/connect/connect-cloud-accounts/onboard-aws/manually-set-up-prisma-cloud-role-for-aws.md).
1. Log in to your AWS console to create a CloudWatch log group.
The CloudWatch log group defines where the log streams are recorded.
1. Select **Services > CloudWatch > Logs > Create log group**.
2. Enter a name for the log group and click **Create**.
2. Enable flow logs.
1. Select **Services > VPC > Your VPCs**.
2. Select the VPC to enable flow logs for and select **Actions > Create flow log**.
3. Set the **Filter** to **Accept** or **All**.
Setting the filter to **All** enables Prisma Cloud to retrieve accepted and rejected traffic from the flow logs. Setting the filter to **Accept** retrieves Accepted traffic only. If you set the filter to **Reject**, Prisma Cloud will not retrieve any flow log data.
4. Verify that the **Destination** is configured to **Send to CloudWatch Logs**.
5. Select the **Destination log group** you created above.
6. Create a new [IAM Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) or use an existing one to [publish flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html) to the CloudWatch Log group.
If you are using an existing IAM role to publish logs to the CloudWatch log group, you must edit the IAM role to include the following permissions.
```
{
"Version": "2012-10-17",
"Statement":[
{
"Action":[
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutLogEvents"
],
"Effect":"Allow",
"Resource":"*"
}
]
}
```
You will also need to [Manually Set Up Prisma Cloud Role for AWS Accounts](/content-collections/connect/connect-cloud-accounts/onboard-aws/manually-set-up-prisma-cloud-role-for-aws.md) so that the IAM role can access the CloudWatch Log group.
7. Click **Create flow log**.
2. From **Settings > Providers**, select **Connect Provider > Cloud Account**.
3. Select **Amazon Web Services** as the cloud account you want to onboard and **Get Started**.
1. Select **Account** under **Scope**.
2. Select the **Security Capabilities and Permissions** that you want to enable for the AWS account.
The capabilities are grouped in to **Foundational** and **Advanced**. Based on your selection, Prisma Cloud dynamically generates a CFT that includes the associated permissions for the Prisma Cloud role.
* The **Foundational** (recommended) capabilities are enabled, by default:
* **Misconfigurations** grants the permissions required to scan cloud assets and ingest metadata.
* **Identity Security** grants the permissions required to calculate net effective permissions for identities and manage access.
* Enable and add permissions for [Agentless Workload Scanning](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md) (selected by default) to scan hosts and containers for vulnerabilities and compliance risks without having to install a defender. If you do not want the Agentless Workload Scanning capability, you can deselect the checkbox. Scans start automatically once you onboard your organization. You can also update the scanning [configuration](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-accounts.md) for agentless scans.
* The **Advanced** (additional) capabilities are:
* **Threat Detection** (enabled by default) grants the permissions required to detect DNS, Network, and Identity threats.
* Enable and add permissions for **Serverless Function Scanning** to scan cloud provider functions such as, AWS Lambda, Azure, and Google functions for [vulnerabilities](/content-collections/runtime-security/vulnerability-management/scan-serverless-functions.md) and [compliance](/content-collections/runtime-security/compliance/visibility/serverless.md). Scans start automatically once you onboard your organization. You can also update the [scanning](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-accounts.md) configuration for serverless scans.
* Add permissions for **Agent-Based Workload Protection** to allow for [automated deployment of defenders](/content-collections/runtime-security/install/deploy-defender/defender-types.md) to provide protection to secure cloud [VMs](/content-collections/runtime-security/install/deploy-defender/host/auto-defend-host.md), [containers](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/install/deploy-defender/container/container.md), and [Kubernetes orchestrators](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/install/deploy-defender/kubernetes/kubernetes.md). Registry scanning, Kubernetes audits, and other features required by defenders are also enabled.
* Enable **Data Security** to scan your assets to prevent data leaks. This feature is not enabled by default. After you onboard your account, further steps are required to [Subscribe to Data Security](/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/subscribe-dspm.md) scans.
3. Click **Next**.
4. **Configure Account**.
1. Enter an **Account ID** and **Cloud Account Name**.
A cloud account name uniquely identifies your AWS account on Prisma Cloud. A unique account ID is used to enable the trust relationship in the roles trust policy, which you will require later in the onboarding process.
2. Enable **Remediation** (optional) to grant permissions to remediate misconfigured assets. After you enable it, the Prisma Cloud role gets read-write access permissions to your AWS organization to successfully execute remediation commands.
3. Expand **Advanced Settings** to view the **Use Tenant Specific External ID** (optional) capability.
* By default, if you do **not** select the **Use Tenant Specific External ID** checkbox, Prisma Cloud provides a unique auto-generated external ID as part of the CFT when you **Download IAM Role CFT** in Step 4 below.
* If you select the **Use Tenant Specific External ID** checkbox, Prisma Cloud auto-generates a single external ID at the **tenant level**. This allows you to have that **single tenant level external ID** for that particular AWS account when you download the CFT in Step 4 below.
While editing a previously onboarded account, if you select **Use Tenant Specific External ID**, make sure to create a new cloud formation stack in the AWS console for new role ARN creation and then enter the new role ARN in the **IAM Role ARN** field in the Prisma Cloud console.
4. Click **Create IAM Role** only if your role has permissions to log in to your AWS management console in order to create a stack, else **Download IAM Role CFT**. Depending on your selection, click **View Steps** under each to follow the steps to generate **IAM Role ARN**.
To automate the process of creating the Prisma Cloud role that is trusted and has the permissions required to retrieve data on your AWS deployment, Prisma Cloud uses a CFT. The CFT enables the ingestion of configuration data, Amazon S3 flow logs, and AWS CloudTrail logs (audit events) only, and it does not support the ability to enable VPC flow logs for your AWS account.
Make sure that you are already logged in to your AWS management console before you click **Create IAM Role**. Prisma Cloud creates a dynamic link that opens the **Quick create stack** page in your AWS management console based on the **Security Capabilities and Permissions** you selected. The details are uploaded automatically and you do not need to enter them manually in order to create the stack. Make sure you complete the onboarding process within 1 hour, else the link will expire, in which case you will have to click **Create IAM Role** again. If you have installed browser plugins and have pop-ups blocked, first allow pop-up and then click **Create IAM Role** to continue the process.
Once you **Download IAM Role CFT**, it is valid for 30 days. Even if you close the dialog before completing the onboarding process, you can onboard again within 30 days again using the same Account ID and Role ARN created with the previously downloaded CFT.
5. Paste the **IAM Role ARN**.
6. Select one or more [account groups](/content-collections/administration/create-manage-account-groups.md) or select **Default Account Group**.
You must assign each cloud account to an account group and [create an Alert Rule for run-time checks](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md) to associate with that account group to generate alerts when a policy violation occurs.
7. Click **Next**.
5. **Review Status**.
Verify the **Details** of the AWS Account and the status checks for the **Security Capabilities** you selected while onboarding the account on Prisma Cloud.
1. Ensure that all the security capabilities you selected display a green **Successful** or **Enabled** icon.
2. For the security capabilities that display a red **Checks Failed** icon, click the corresponding drop-down to view the cause of failure. To resolve the isssue, see [Troubleshoot AWS Onboarding Errors](/content-collections/connect/connect-cloud-accounts/onboard-aws/troubleshoot-aws-errors.md).
3. Click **Save and Close** to complete onboarding or **Save and Onboard Another Account**.
After you sucessfully onboard your AWS account on Prisma Cloud, the account is automatically available in Runtime Security and enabled for **Workload Discovery** and **Serverless function scans**. For **Agentless scans**, you have to complete the configuration to trigger the scan.
You can view the newly onboarded AWS account on the **Cloud Accounts** page.
* Prisma Cloud checks whether Runtime Security permissions are enabled only if you have one or more compute workloads deployed on the AWS cloud accounts that are onboarded. The cloud status transitions from green to amber only when you have compute workloads deployed and the additional permissions are not enabled for remediation.
* If you have services that are not enabled on your AWS account, the status screen provides you some details.
* [Configure Flow Logs](/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-flow-logs.md) if you want to enable monitoring of VPC flow logs data to be published to S3 buckets in a Logging Account that you need to onboard.
4. If an onboarded account displays a yellow or red status, you can either reload or refresh the cloud account and it’s associated security capabilities. Select **Home > Settings > Providers > Cloud Accounts** and click on the **Status** of the cloud account you want to refresh. Next, select the refresh button on the **Status** window to reload your cloud account.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-account.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.