> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aquasec-scanner-reference.md).

# Aqua Security step configuration

You can scan your container images and ingest scan results from [Aqua Security Enterprise](https://www.aquasec.com/solutions/docker-container-security/).

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Aqua Security step settings <a href="#aqua-security-step-settings" id="aqua-security-step-settings"></a>

The recommended workflow is to add an **Aqua Security** step to a **Security** or **Build** stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

For the **Aqua Security** step, you have two configuration options:

* **Default**: Connects to your Aqua Security instance using an **Access Token** for authentication.
* **Self-Hosted**: Connects to your on-premises Aqua Security instance using a **Username and Password** for authentication.

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

**Domain (*****extraction*****)**

**Name**

**Tag/Digest**

**Region**

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

**Access ID**

Enter the username for your on-premises Aqua Security instance. This field is visible only when you select the **Self-Hosted** scan configuration.

**Access Token**

* For the **Default** scan configuration, enter your Aqua Security access token.
* For the **Self-Hosted** scan configuration, enter the password associated with your Aqua Security username.

Always store sensitive credentials securely by creating a Harness text secret. Reference the secret in your configuration using the format `<+secrets.getValue("my-access-token")>`. For detailed steps, see [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

#### Ingestion <a href="#ingestion" id="ingestion"></a>

**Ingestion File**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### View AquaSec Assurance Policy violations <a href="#view-aquasec-assurance-policy-violations" id="view-aquasec-assurance-policy-violations"></a>

AquaSec Assurance Policy violations will appear in scan results as `Info` severity issues, with the issue type set to `EXTERNAL_POLICY`. Additionally, you can apply OPA policies in Harness STO to enforce or manage these failures. Additionally, you can apply an OPA policy to fail the pipeline based on the security assurance policy violations. This can be achieved using the [Security Tests - External Policy Failures](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#block-the-pipeline-based-on-external-policy-failures) policy from the [security tests policy samples](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#security-test-policy-samples).

### Configure External Policy Failures <a href="#configure-external-policy-failures" id="configure-external-policy-failures"></a>

You can configure Harness STO to treat external policy failures as vulnerabilities. To do this, navigate to Account Settings, go to the Default Settings page, select Security Test Orchestration, and click the External Policy Failures setting.

Enable the external policy failures setting to map them to a selected severity level — `Critical`, `High`, `Medium`, or `Low` to treat them as vulnerabilities instead of `Info` level issues. This setting takes effect from the next pipeline execution.

{% hint style="info" %}
This feature is behind the Feature flag `STO_EXTERNAL_POLICY_FAILURES_AS_VULNS`. Contact [Harness Support](mailto:support@harness.io) to enable this flag.
{% endhint %}