> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/update-aws-account.md).
# Update an Onboarded AWS Account
After you add your cloud account to Prisma Cloud, you may need to update the Prisma Cloud stack to provide additional permissions for new policies that are frequently added to help you monitor your cloud account and ensure that have a good security posture. When you update the CFT stack, Prisma Cloud can ingest data on new services that are supported. These CFTs are available directly from the Prisma Cloud administrative console.
In addition to updating the CFT stack for enabling permissions for new services, you can use this workflow to update the account groups that are secured with Prisma Cloud or to enable or disable the security capabilities and permissions. If you enable a security capability that you had not enabled during the initial onboarding, make sure you **Download IAM Role CFT** again and complete the required steps in order for the updated permissions to be granted to Prisma Cloud.
For instruction on updating your AWS Organization, see [Update an Onboarded AWS Organization](/content-collections/connect/connect-cloud-accounts/onboard-aws/update-aws-org.md).
1. Log in to the Prisma Cloud administrative console.
2. Select the AWS cloud account you want to modify.
Select **Settings > Providers > Cloud Accounts** and click the **Edit Cloud Account** icon for the cloud account to manage from the list of cloud accounts.
3. From **Configure Account**, **Download IAM Role CFT**.
While updating configuration of the AWS account, under **Advanced Settings** if you select the **Use Tenant Specific External ID** (optional) checkbox, the downloaded CFT will include a **tenant level external ID**. For continuous ingestion after selecting **Use Tenant Specific External ID**:
* Make sure you create a new cloud formation stack in the AWS console for new role ARN creation.
* Next, make sure to enter the new role ARN in the **IAM Role ARN** field in the Prisma Cloud console.
4. tt:\[(To change permissions for the Prisma Cloud role)] Update the Prisma Cloud App using the CFT you downloaded in the above step. You can update the stack either using the AWS console or the AWS CLI.
1. Log in to [AWS console](https://aws.amazon.com/).
2. Select **Services > CloudFormation > Stacks**.
3. Select the **PrismaCloudApp** stack to update and select **Update**.
Select **Replace current template** and **Upload a template file** you downloaded earlier.
If you decide to create a new stack instead of updating the existing stack, you must copy the PrismaCloudRoleARN value from the CFT outputs tab.
4. Configure stack options.
5. Click **Next** and verify the settings.
6. **Preview your changes** to the CloudFormation template for the role you updated.
7. **Update** your CFT.
If you created a new stack, you must log in to the Prisma Cloud administrative console, select your cloud account on **Settings > Cloud Accounts**, click the **Edit** icon, navigate to **Configure Account**, and enter the **PrismaCloudRoleARN** value from the AWS CFT output in the **IAM Role ARN** field.
If you want to use [AWS Command Line Interface](https://aws.amazon.com/cli/) to deploy the updated Prisma Cloud App stack. Using the AWS CLI tool, enter the following command to deploy the CFT that you downloaded.
`aws cloudformation deploy --template-file /tmp/prisma-cloud-aws-iam-role.template --stack-name --parameter-overrides PrismaCloudRoleName= --capabilities CAPABILITY_NAMED_IAM`
8. Check the status to verify that Prisma Cloud can successfully retrieve information on your cloud assets.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/update-aws-account.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.